Skip to main content

Apple Joins Anthropic's Project Glasswing: Mythos AI, NSA Controversy, and the Quiet End of Apple's 'Build-Our-Own-AI' Era

TL;DR: Apple has joined Anthropic’s Project Glasswing, a twelve-company consortium that gets preview access to Claude Mythos — a model Anthropic describes as powerful enough to find “thousands of high-severity vulnerabilities” in every major operating system and browser. Anthropic has explicitly said Mythos Preview will not be made generally available. Separately, Heise and the Financial Times report that roughly half a dozen Anthropic engineers are working on-site with the NSA to adapt Mythos for offensive cyber operations against adversary networks. The two threads together mark a strategic shift: Apple is no longer pretending it will train a frontier foundation model in-house. It is now an integrator of third-party AI for its most security-sensitive workloads.

1. Project Glasswing — what was announced #

On 7 April 2026, Anthropic announced Project Glasswing, a new initiative the company describes as “an urgent attempt to put these capabilities to work for defensive purposes.” The launch group is twelve organizations:

  • Amazon Web Services
  • Apple
  • Anthropic
  • Broadcom
  • Cisco
  • CrowdStrike
  • Google
  • JPMorganChase
  • Linux Foundation
  • Microsoft
  • NVIDIA
  • Palo Alto Networks

The framing is unusual for an AI-vendor announcement. Anthropic is not positioning Mythos as a product. It is positioning the partner group as a private defensive coalition, with Mythos Preview released only to organizations that “build or maintain critical software.” More than forty additional organizations have access to the preview, per Anthropic.

The stated goal: use the model to find and fix security holes before the model is released to the world. Anthropic’s own description of Mythos is striking: “thousands of high-severity vulnerabilities, including some in every major operating system and web browser.” One example Anthropic has published: a Linux kernel flaw that, when chained, gives an attacker “complete control over a machine.” Some of these flaws, the company says, “have survived decades of human review and millions of automated security tests.”

2. Claude Mythos — capability, benchmarks, and access #

Mythos is the successor to Claude Opus 4.6 in Anthropic’s model family. Per the system card Anthropic published alongside the announcement, the model shows measurable gains in:

  • Reasoning
  • Agentic search
  • Computer use
  • Agentic coding

These are exactly the capabilities that make a model useful for offensive security work — the same property profile that makes it dangerous. Anthropic’s own statement: “We do not plan to make Claude Mythos Preview generally available, but our eventual goal is to enable our users to safely deploy Mythos-class models at scale — for cybersecurity purposes, but also for the myriad other benefits that such highly capable models will bring.”

That sentence carries the entire product strategy in one clause. The defensive coalition is the cover; the long-term plan is a paid deployment tier for high-end enterprise and government use.

3. Why Apple joined — the strategic shift #

Apple’s presence in a defensive-AI coalition is the visible part. The strategic meaning is in what is not happening: a public Apple foundation model.

Three signals make the shift legible:

  • Siri 2.0 runs on Google Gemini. In January 2026, Apple signed a multi-year deal to use a custom 1.2-trillion-parameter Gemini model as the foundation for Siri’s next generation, due to ship with iOS 27 in September 2026. The reported cost: roughly $1 billion per year. (Bloomberg)
  • OpenAI’s “burned” partnership. OpenAI has retained outside legal counsel over Apple’s implementation of the 2024 ChatGPT-Siri integration, which it says buried the feature behind friction. The dispute is part of a wider talent war after Apple’s former head of foundation models, Ruoming Pang, left for OpenAI’s “Device” team. (Bloomberg, 14 May 2026)
  • Project Glasswing membership. Apple is now in the inner circle for the most security-sensitive AI model that is not being released publicly.

The pattern: Apple is not building frontier AI. Apple is buying it, integrating it, and gating access to it through its platform. That is the Apple-as-integrator thesis, made operational.

4. The NSA angle — offensive AI, in plain language #

On 4 June 2026, Heise online — citing two anonymous sources via the Financial Times — reported that several Anthropic employees are on-site at the National Security Agency, helping the agency adapt Claude Mythos for offensive cyber operations. The reported arrangement: a “half dozen” engineers embedded at NSA facilities, tailoring the model for specific use cases. Whether the engineers are directly supporting offensive deployment, or only adjacent adaptation work, is not clear from the report.

The rationale, as relayed by one FT source: “The best way to build a good defense is to build a good attack.” The reported use case: infiltrating networks in “hostile or adversarial states such as China or Iran.”

For an Apple audience, the relevant question is not whether the NSA programme is novel — it is whether Apple’s brand of “Privacy. That’s iPhone.” is compatible with being a partner in a model ecosystem that is simultaneously being shaped for state offensive cyber work.

5. The Pentagon backdrop #

The NSA arrangement is the second front in a wider Anthropic-versus-US-government dispute. Earlier in 2026, the US Department of Defense directed that Anthropic’s technology be removed from the Pentagon’s own systems, after Anthropic publicly set red lines on certain military use cases. Anthropic has responded with legal action.

Heise’s reading: the NSA cooperation suggests the underlying disagreement is “less deep than assumed.” Anthropic is willing to work with one part of the US national security apparatus on cyber operations, even as it fights another part over the rules of engagement. That is a coherent position for a company whose red lines are about autonomous weapons and mass surveillance, not about cyber operations against adversary networks. It is, however, a more permissive posture than the public Anthropic marketing usually implies.

6. What this means for iOS 27, macOS, and enterprise #

For consumers, the practical consequences are bounded. Mythos will not appear in any shipping Apple product, and Apple Intelligence on-device still runs on Apple’s own models, not Anthropic’s. The defensive side of Glasswing — feeding Apple the most current view of vulnerability classes across the OS-and-browser stack — is exactly the kind of intelligence that would normally flow through Apple’s Security Engineering and Architecture group under Ivan Krstić.

The more interesting effects are upstream:

LayerEffect
Foundation modelApple is no longer pursuing one. Google and Anthropic now own that layer for Apple.
On-device AIApple’s small models (≈3B parameters) become a feature, not a moat. The moat is integration.
Security telemetryGlasswing gives Apple a structural view of vulnerability classes across every major OS — a defensive advantage that compounds with iOS 27’s hardened runtime.
Enterprise positioningApple can sell iPhone and Mac as the safe end of an AI stack it does not own, with a security update cadence that benefits from Glasswing intelligence.
Brand“Privacy. That’s iPhone.” becomes harder to defend when the AI it depends on is shaped by NSA-adjacent offensive work.

7. What to watch #

  • iOS 27 security disclosures at WWDC 2026 (week of 9 June). If Mythos-style vulnerability intelligence shows up in iOS 27’s security notes, Glasswing is paying off.
  • The Anthropic-Pentagon lawsuit. A settlement or adverse ruling would clarify how the company’s red lines actually work.
  • EU AI Act enforcement. Apple’s choice to integrate, rather than build, shifts liability. The European Commission will ask who is the “provider” of an Apple Intelligence feature that runs on Anthropic or Google. The answer has not been written yet.

8. Update — 30 days after launch #

In the month since the Glasswing announcement, the Anthropic story has moved faster than the Apple narrative. Five new primary signals matter for the Apple-as-integrator thesis:

  • The cohort is now 150 partners, not 50. On 1 June 2026, Anthropic expanded Project Glasswing, extending the partnership to roughly 150 new organizations in more than 15 countries. Each new partner has to meet Anthropic’s security requirements first. The 10,000 high- or critical-severity vulnerabilities figure, first reported in the original launch, is the baseline against which this expansion is being measured.
  • Anthropic has filed an S-1 with the SEC. On 31 May 2026, the company confidentially submitted a draft S-1 to the US Securities and Exchange Commission for a proposed IPO. The filing is under Rule 135 of the Securities Act — publication only, not a sale. What it confirms is that the company views the next two quarters as a viable window to go public, and that the integration-heavy revenue (Claude Code, Cowork, the new Services Track) is the story it intends to tell public-market investors.
  • Series H closed at $65B on a $965B post-money valuation. Two weeks before the S-1, Anthropic raised $65 billion led by Altimeter, Dragoneer, Greenoaks, and Sequoia. Run-rate revenue crossed $47 billion earlier that month, the company said. The order of operations — Series H first, S-1 second — is what a company does when it has the metrics it needs and the window of public-market conditions it wants.
  • The Services Track and Partner Hub. On 2 June 2026, Anthropic turned the Claude Partner Network — backed by a $100 million investment in partner training, technical support, and shared marketing — into a tiered program. Accenture is training 30,000 professionals. Cognizant has rolled Claude out to roughly 350,000 associates. Deloitte, KPMG, PwC, Infosys — all named. The message to enterprise procurement teams is that “Claude in production” is now a partner-served capability, not an Anthropic-direct sale.
  • Verizon DBIR partnership. On the same day, Anthropic and Verizon published the methodology behind a year-long study of 832 accounts banned for malicious cyber activity, mapped to the MITRE ATT&CK framework. The data lands in Verizon’s 2026 Data Breach Investigations Report. This is the second commercial channel — alongside the Services Track — through which the Mythos work is becoming a paid product line.
  • Mythos Preview’s exploit-building is the differentiator. On 21 May 2026, the Frontier Red Team blog published the qualitative evaluation that justified the controlled rollout. The quote that matters: “Claude Mythos Preview’s ability to develop exploits is a step-change over previous frontier models. … Mythos Preview is capable of finding complex vulnerabilities, but what concerned us most in our internal testing was that Mythos Preview could both turn vulnerabilities into exploit primitives, and combine those primitives together into complete end-to-end attack chains.” That is the part of the story a partner like Apple cannot get from any other lab.

For the Apple story, the relevant update is not the valuation. It is the controlled-rollout pattern: Series H, then S-1, then Services Track, then a commercial Defender channel, with Mythos Preview held behind the partner group the whole time. Apple is now one of 150 organizations on the inside of a product line whose public version does not yet exist. The asymmetry — Apple on the inside, the rest of the industry on the outside — is the structural moat the Glasswing membership was designed to create.

Sources #

© 2026 iOSApple Team