Project Glasswing July 2026 Report: What the 90-Day Progress Update Is Expected to Reveal

Glasswing's 90-day report structure follows the coordinated vulnerability disclosure timeline. The program runs autonomous vulnerability discovery using Claude Mythos across partner organization environments, coordinates disclosure with affected parties during the 90-day window, and publishes findings that have completed the disclosure process at the end of the window. The July 2026 report covers the second phase of the program: the expansion that began June 2, 2026, bringing in additional partner organizations and new sector coverage. The report is expected to include an updated findings total (10,000+ from the initial phase; the expansion will add to that count), CVE status updates for the 9 confirmed CVEs from the initial phase, new CVE disclosures if any additional Glasswing findings have completed the CVD process and received formal assignment, critical infrastructure sector findings if the June expansion explicitly included healthcare, power, or water sector partners, and a Claude Security patch count update from the public beta's current 2,100+ patches.

The convergence of the Glasswing 90-day window closing and Black Hat USA 2026 Briefings on August 5-6 is not coincidental. Major security research disclosures and major security conferences create a reinforcing cycle: research that drops before a major conference shapes the discussions, panels, and hallway conversations that happen there. A Glasswing July report that drops in the week before Black Hat will frame what the AI security community talks about at the conference. Research that follows confirms, challenges, or extends the Glasswing findings will get more attention and more informed Q and A than it would in isolation. For practitioners, this means that attending Black Hat without having read the Glasswing July report, when it is available, means entering the highest-density AI security conversation of the year without the baseline context that most of the room will share. The Mythos Brief at decryptiondigest.com/mythos-brief will be updated with the July report findings as soon as the report is published.

Five specific questions should shape how defenders evaluate the July 2026 Glasswing report. First: CVE patch status. Of the 9 confirmed Glasswing CVEs (including FreeBSD NFS RCE CVE-2026-4747, wolfSSL cert forgery CVE-2026-5194, Linux LPE, VMM escape, and V8-adjacent vulnerabilities), which have been patched by the affected vendors? Unpatched CVEs remain active exposure, and organizations running affected software need to apply compensating controls. Second: critical infrastructure findings. The Glasswing expansion explicitly targets critical infrastructure sectors. What did Mythos find in healthcare, power, and water sector partner environments? Third: CVD process scale. Has the coordinated disclosure framework scaled to handle a larger partner base, and what has the process looked like at 200+ organizations? Fourth: Claude Security update. Has the public beta patch count grown beyond 2,100+, and what does the patch acceptance rate look like from partner organizations? Fifth: new CVE disclosures. Have any of the 10,000+ findings from the initial phase completed the CVD process and received formal CVE assignment beyond the initial 9?

Three primary channels cover the Glasswing July report release. Anthropic publishes major research disclosures at anthropic.com/research and announces them via the Anthropic blog and social channels. The NVD at nvd.nist.gov provides the authoritative record for any new CVE assignments, typically updated within days of formal assignment. The Decryption Digest publishes daily cybersecurity briefings and will cover the Glasswing July report on its publication date with practitioner-oriented synthesis. Subscribe at decryptiondigest.com to receive same-day coverage. For the most direct practitioner response to the report, Mythos Brief subscribers at decryptiondigest.com/mythos-brief receive a dedicated update email when the July report is published, covering the updated CVE status, new findings, and defensive action recommendations. The Mythos Brief update goes deeper than the daily newsletter synthesis: it includes updated defensive implications analysis for each confirmed CVE and the new disclosures.

The Mythos Brief is the living document for Glasswing findings. The initial Brief covered all 9 confirmed CVEs with CVSS scores, affected component types, and defensive recommendations. When the July 2026 report drops, the Brief will be updated with new CVE status, updated patch guidance for any CVEs that were previously unpatched, and defensive implications analysis for any new disclosures. Mythos Brief subscribers at decryptiondigest.com/mythos-brief receive the update notification directly, with a synthesis of the changes from the July report and recommended defensive actions for organizations that may be affected by new disclosures or updated status on existing CVEs. The Brief is designed to be the preparation document for practitioners who need to understand the Glasswing findings without reading the full Anthropic technical reports.

When the Glasswing July 2026 report drops, the practitioner response follows the same framework as any major vulnerability disclosure: assess exposure, prioritize remediation, and update detections. For the CVE patch status question: check your asset inventory against the affected software list for each of the 9 CVEs and compare patch status against vendor advisories. Any organization running FreeBSD with NFS, wolfSSL, Linux systems exposed to privilege escalation, or virtualized environments should have already assessed CVE-2026-4747, CVE-2026-5194, and the Linux LPE CVE. The July report will clarify which vendor patches are available for any CVEs that remained unpatched after the initial disclosure. For new CVE disclosures: apply the same process to any new CVEs announced in the July report, using the Glasswing CVE reference sheet in the Mythos Brief as the starting point for the affected software inventory check. For critical infrastructure findings: if your organization operates in healthcare, power, or water sectors, the critical infrastructure findings section should be triaged against your specific technology stack.

The Glasswing program operates on a defined disclosure timeline: vulnerability discovery, coordinated disclosure with the affected vendor, remediation development, and public disclosure after the 90-day window or when the vendor issues a patch. The initial 9 CVEs represent findings where that full cycle completed within the first 90-day window. The 10,000+ total findings include everything discovered in that window, not all of which have completed the CVD process. The July 2026 report covers findings from the June 2 expansion. Future reports will follow the same cycle: 90-day window, coordinated disclosure with expanded partner base, public report on findings that have completed the process. For defenders, this means Glasswing is not a one-time disclosure event: it is an ongoing program that will produce new CVEs and new findings on a regular cadence. Building a monitoring process for Glasswing reports, not just responding to individual CVEs, is the appropriate operational posture.

The Glasswing disclosure tracker, CVE patch status monitor, critical infrastructure findings preview, and alert setup for report release are available in the Mythos Brief. The tracker provides current patch status for all 9 confirmed Glasswing CVEs, updated as vendor advisories are published. Mythos Brief subscribers at decryptiondigest.com/mythos-brief receive notification when the July report is published and access to the updated tracker with the new report's disclosures.