Anthropic / Project Glasswing AI agent First public signal Aug 17, 2026

Anthropic unreleased CVD model

An unreleased Anthropic model explicitly named on fixed Project Glasswing findings in dnsmasq and runc.

Indexed entries

CVE IDs tracked

Critical/high entries

92%

Evidence index

What is verified

Three qualifying Project Glasswing cards say only that an unreleased Anthropic model produced the finding. They cover dnsmasq CVE-2026-4892, CVE-2026-4890/CVE-2026-13002, and runc CVE-2026-41579.

Bugflation preserves that source label. It does not infer Mythos, Opus, Sonnet, or a future product name from the broader program.

Sources

Attributed findings

Catalogued entries credited to Anthropic unreleased CVD model.

ID Title System Evidence date Severity

CVE-2026-4892 + 3 more Anthropic's CVD ledger attributes three findings to an unreleased model Memory corruption, denial of service, and container-runtime validation vulnerabilities - direct Anthropic unreleased CVD model (direct) Aug 17, 2026 high