Skip to main content
Apple

Apple Joins Anthropic's Project Glasswing: Mythos AI, NSA Controversy, and the Quiet End of Apple's 'Build-Our-Own-AI' Era

TL;DR: Apple has joined Anthropic’s Project Glasswing, a twelve-company consortium that gets preview access to Claude Mythos — a model Anthropic describes as powerful enough to find “thousands of high-severity vulnerabilities” in every major operating system and browser. Anthropic has explicitly said Mythos Preview will not be made generally available. Separately, Heise and the Financial Times report that roughly half a dozen Anthropic engineers are working on-site with the NSA to adapt Mythos for offensive cyber operations against adversary networks. The two threads together mark a strategic shift: Apple is no longer pretending it will train a frontier foundation model in-house. It is now an integrator of third-party AI for its most security-sensitive workloads.

1. Project Glasswing — what was announced #

On 7 April 2026, Anthropic announced Project Glasswing, a new initiative the company describes as “an urgent attempt to put these capabilities to work for defensive purposes.” The launch group is twelve organizations:

  • Amazon Web Services
  • Apple
  • Anthropic
  • Broadcom
  • Cisco
  • CrowdStrike
  • Google
  • JPMorganChase
  • Linux Foundation
  • Microsoft
  • NVIDIA
  • Palo Alto Networks

The framing is unusual for an AI-vendor announcement. Anthropic is not positioning Mythos as a product. It is positioning the partner group as a private defensive coalition, with Mythos Preview released only to organizations that “build or maintain critical software.” More than forty additional organizations have access to the preview, per Anthropic.

The stated goal: use the model to find and fix security holes before the model is released to the world. Anthropic’s own description of Mythos is striking: “thousands of high-severity vulnerabilities, including some in every major operating system and web browser.” One example Anthropic has published: a Linux kernel flaw that, when chained, gives an attacker “complete control over a machine.” Some of these flaws, the company says, “have survived decades of human review and millions of automated security tests.”

2. Claude Mythos — capability, benchmarks, and access #

Mythos is the successor to Claude Opus 4.6 in Anthropic’s model family. Per the system card Anthropic published alongside the announcement, the model shows measurable gains in:

  • Reasoning
  • Agentic search
  • Computer use
  • Agentic coding

These are exactly the capabilities that make a model useful for offensive security work — the same property profile that makes it dangerous. Anthropic’s own statement: “We do not plan to make Claude Mythos Preview generally available, but our eventual goal is to enable our users to safely deploy Mythos-class models at scale — for cybersecurity purposes, but also for the myriad other benefits that such highly capable models will bring.”

That sentence carries the entire product strategy in one clause. The defensive coalition is the cover; the long-term plan is a paid deployment tier for high-end enterprise and government use.

3. Why Apple joined — the strategic shift #

Apple’s presence in a defensive-AI coalition is the visible part. The strategic meaning is in what is not happening: a public Apple foundation model.

Three signals make the shift legible:

  • Siri 2.0 runs on Google Gemini. In January 2026, Apple signed a multi-year deal to use a custom 1.2-trillion-parameter Gemini model as the foundation for Siri’s next generation, due to ship with iOS 27 in September 2026. The reported cost: roughly $1 billion per year. (Bloomberg)
  • OpenAI’s “burned” partnership. OpenAI has retained outside legal counsel over Apple’s implementation of the 2024 ChatGPT-Siri integration, which it says buried the feature behind friction. The dispute is part of a wider talent war after Apple’s former head of foundation models, Ruoming Pang, left for OpenAI’s “Device” team. (Bloomberg, 14 May 2026)
  • Project Glasswing membership. Apple is now in the inner circle for the most security-sensitive AI model that is not being released publicly.

The pattern: Apple is not building frontier AI. Apple is buying it, integrating it, and gating access to it through its platform. That is the Apple-as-integrator thesis, made operational.

4. The NSA angle — offensive AI, in plain language #

On 4 June 2026, Heise online — citing two anonymous sources via the Financial Times — reported that several Anthropic employees are on-site at the National Security Agency, helping the agency adapt Claude Mythos for offensive cyber operations. The reported arrangement: a “half dozen” engineers embedded at NSA facilities, tailoring the model for specific use cases. Whether the engineers are directly supporting offensive deployment, or only adjacent adaptation work, is not clear from the report.

The rationale, as relayed by one FT source: “The best way to build a good defense is to build a good attack.” The reported use case: infiltrating networks in “hostile or adversarial states such as China or Iran.”

For an Apple audience, the relevant question is not whether the NSA programme is novel — it is whether Apple’s brand of “Privacy. That’s iPhone.” is compatible with being a partner in a model ecosystem that is simultaneously being shaped for state offensive cyber work.

5. The Pentagon backdrop #

The NSA arrangement is the second front in a wider Anthropic-versus-US-government dispute. Earlier in 2026, the US Department of Defense directed that Anthropic’s technology be removed from the Pentagon’s own systems, after Anthropic publicly set red lines on certain military use cases. Anthropic has responded with legal action.

Heise’s reading: the NSA cooperation suggests the underlying disagreement is “less deep than assumed.” Anthropic is willing to work with one part of the US national security apparatus on cyber operations, even as it fights another part over the rules of engagement. That is a coherent position for a company whose red lines are about autonomous weapons and mass surveillance, not about cyber operations against adversary networks. It is, however, a more permissive posture than the public Anthropic marketing usually implies.

6. What this means for iOS 27, macOS, and enterprise #

For consumers, the practical consequences are bounded. Mythos will not appear in any shipping Apple product, and Apple Intelligence on-device still runs on Apple’s own models, not Anthropic’s. The defensive side of Glasswing — feeding Apple the most current view of vulnerability classes across the OS-and-browser stack — is exactly the kind of intelligence that would normally flow through Apple’s Security Engineering and Architecture group under Ivan Krstić.

The more interesting effects are upstream:

LayerEffect
Foundation modelApple is no longer pursuing one. Google and Anthropic now own that layer for Apple.
On-device AIApple’s small models (≈3B parameters) become a feature, not a moat. The moat is integration.
Security telemetryGlasswing gives Apple a structural view of vulnerability classes across every major OS — a defensive advantage that compounds with iOS 27’s hardened runtime.
Enterprise positioningApple can sell iPhone and Mac as the safe end of an AI stack it does not own, with a security update cadence that benefits from Glasswing intelligence.
Brand“Privacy. That’s iPhone.” becomes harder to defend when the AI it depends on is shaped by NSA-adjacent offensive work.

7. What to watch #

  • iOS 27 security disclosures at WWDC 2026 (week of 9 June). If Mythos-style vulnerability intelligence shows up in iOS 27’s security notes, Glasswing is paying off.
  • The Anthropic-Pentagon lawsuit. A settlement or adverse ruling would clarify how the company’s red lines actually work.
  • EU AI Act enforcement. Apple’s choice to integrate, rather than build, shifts liability. The European Commission will ask who is the “provider” of an Apple Intelligence feature that runs on Anthropic or Google. The answer has not been written yet.

Sources #