Project Glasswing and open source: The good, bad, and ugly

Anthropic's Project Glasswing commits $100M in AI resources to find and fix vulnerabilities in critical open source software using its Mythos AI program, which can generate working exploits 72.4% of the time. While experts acknowledge the potential, serious concerns remain: open source maintainers are already overwhelmed and an AI-driven flood of vulnerability reports will add significant burden. AI tools are better at finding bugs than fixing them, creating an imbalance. Additional worries include lock-in risk since Mythos is proprietary software, and whether $104M is nearly enough to secure the open source ecosystem that underpins 97% of all software. The Linux Foundation points to OSS-CRS as a potential open standard to mitigate lock-in, but the author remains skeptical and wishes Mythos itself were open source.