Claude Mythos Finds 23,019 Vulnerabilities in First Month

Anthropric’s Project Glasswing delivered dramatic results in its opening month. According to the first-month report from May 22, 2026, Claude Mythos identified 23,019 vulnerabilities across 1,000+ open-source projects, with 90.6% confirmed as real on independent sampling.

Project Glasswing: A Defensive Cybersecurity Initiative

Anthropric launched Project Glasswing on April 7, 2026, distributing Claude Mythos Preview to roughly 50 partner organizations—including AWS, Apple, Google, Microsoft, NVIDIA, CrowdStrike, and JPMorgan Chase—exclusively for defensive cybersecurity work.

Prompt Engineering Breakthroughs Drive AI Model Performance

Across the industry, structured prompting techniques continue to unlock significant performance gains. Eight well-written examples in a prompt were enough for a 540-billion parameter model to beat fine-tuned GPT-3 on the GSM8K math benchmark. A 2024 study by OpenAI showed that structured prompts produce output preferred by human annotators in 73% of cases compared to unstructured prompts on free-form writing tasks.

Advanced reasoning frameworks show even more dramatic improvements. In ‘Game of 24’, GPT-4 with standard Chain-of-Thought solved only 4% of problems, while Tree of Thoughts achieved 74%. ReAct beats imitation learning and reinforcement learning methods by 34% in absolute success rate on ALFWorld with one or two in-context examples.

Self-Refine demonstrates an average 20% performance improvement across 7 different tasks with GPT-3.5, ChatGPT, and GPT-4 without training or supervised data.

Practical applications confirm these gains. A test of two follow-up email prompts on 50 real clients in 2025 found the structured prompt (CREATE + Chain-of-Thought) got a reply 64% of the time versus 19% for the basic prompt.

Frameworks and Tools Mature

Anthropic put context engineering in writing on their engineering blog in ‘Effective context engineering for AI agents’. Stanford released DSPy in late 2023 and by 2026 it has reached version 2.x with the MIPROv2 optimizer. DSPy shows 10–40% quality improvements compared to manual prompting on RAG pipelines and classifiers.

Gemini 3.5 Flash Goes GA

Google brought Gemini 3.5 Flash to general availability on May 19 at Google I/O 2026. The model beats Gemini 3.1 Pro at roughly 4x the speed on coding and agentic benchmarks. API pricing stands at $1.50 per million input tokens and $9.00 per million output tokens.

Google also announced Gemini 3.5 Pro at I/O, with Sundar Pichai stating ‘give us until next month to get it to you’. The model is confirmed for June but with no specific date provided.

Anthropic Roadmap Signals

A Sonnet 4.8 source map accidentally shipped with @anthropic-ai/claude-code npm v2.1.88 on March 31, 2026, containing source filter lists with the strings sonnet-4-8, opus-4-7, and mythos. Polymarket closed at 3% on a Sonnet 4.8 ship date of May 24, 2026.

Grok 5 Still Training

xAI’s Grok 5 is still training on Colossus 2, expanded from 1 GW to 1.5 GW in April. Reported specs include ~6 trillion parameters MoE, 1.5M context, and native multimodal. Polymarket contract for Grok 5 public release by June 30, 2026 collapsed from 68 cents in February to 12% by early April and currently sits in the 12–33% range.

Source: WaveSpeed Blog