Anthropic / Project Glasswing AI agent First public signal Jul 20, 2026

Claude Opus 4.6

Anthropic's Opus 4.6 model, explicitly named on fixed Project Glasswing findings in PostgreSQL and rabbitmq-c.

Indexed entries

CVE IDs tracked

Critical/high entries

96%

Evidence index

What is verified

Two qualifying Project Glasswing cards explicitly name Claude Opus 4.6: PostgreSQL CVE-2026-6479 and rabbitmq-c CVE-2026-44236. Both cards are public, fixed, patched, vendor-confirmed, and mapped to a CVE and GHSA.

The profile is deliberately limited to those two identifiers. Other Project Glasswing rows name Mythos, Sonnet, an unreleased model, or no particular model.

Sources

Anthropic: PostgreSQL CVE-2026-6479
Anthropic: rabbitmq-c CVE-2026-44236
Anthropic CVD ledger JSON

Attributed findings

Catalogued entries credited to Claude Opus 4.6.

ID Title System Evidence date Severity

CVE-2026-6479, CVE-2026-44236 Anthropic's CVD ledger identifies two Opus 4.6 findings Authentication downgrade and memory-safety vulnerabilities - direct Claude Opus 4.6 (direct) Jul 21, 2026 high