In February 2026, something unprecedented happened in the technology industry: companies that compete fiercely in every other domain — Amazon, Apple, Google, Microsoft, NVIDIA, Meta — joined together under the Linux Foundation to launch Project Glasswing, a collaborative initiative to protect the world’s digital infrastructure using frontier AI. The coalition now includes over 40 major technology companies, and its mission is simple and urgent: give the people who maintain the internet’s critical software access to the same AI-powered security tools that were previously available only to the largest corporations.
The Problem Glasswing Aims to Solve
The modern internet runs on open-source software. Linux powers 96% of the world’s top servers. OpenSSL secures most encrypted web traffic. Apache and Nginx serve the majority of websites. These projects are maintained by small teams, often volunteers or underfunded foundations, who are responsible for code that billions of people depend on daily.
Meanwhile, AI-powered cyberattacks are escalating. Attackers are using AI to discover vulnerabilities in open-source code faster than maintainers can patch them. The asymmetry is brutal: attackers need to find one flaw, maintainers need to protect against all of them — and the attackers now have AI tools that can scan codebases at machine speed.
Project Glasswing flips this asymmetry. By providing open-source maintainers with free access to frontier-level AI security tools — including, reportedly, Anthropic’s restricted Claude Mythos model — the initiative gives defenders the same AI advantage that attackers have been building.
How It Works in Practice
Glasswing operates through several coordinated programs:
- Automated vulnerability scanning. Critical open-source projects are continuously analyzed by AI models that identify potential security flaws, generate detailed reports, and in many cases suggest specific patches. This runs automatically — maintainers receive alerts rather than having to initiate scans.
- Prioritized patching. Not all vulnerabilities are equally dangerous. AI models assess the exploitability, blast radius, and real-world impact of each discovered flaw, helping maintainers focus their limited time on the issues that matter most.
- Supply chain monitoring. AI tracks changes across dependency chains, flagging suspicious modifications to upstream packages that could indicate supply chain attacks — one of the fastest-growing categories of cyberattack.
- Incident response support. When a zero-day vulnerability is disclosed, Glasswing’s AI tools can rapidly assess which systems are affected, generate patches, and coordinate disclosure across the ecosystem.
Why Competitors Are Cooperating
The cooperation between fierce rivals makes sense when you understand the incentive structure. A vulnerability in OpenSSL doesn’t just affect one company — it affects everyone. The Heartbleed bug in 2014 exposed data on an estimated 500,000 servers across every major cloud provider and enterprise. When foundational infrastructure is compromised, competitive advantage is meaningless because everyone loses.
Each company in the coalition also brings unique strengths: Google contributes its expertise in large-scale code analysis, Microsoft brings its understanding of enterprise security at scale, NVIDIA provides compute infrastructure, and Anthropic contributes its frontier AI models. The Linux Foundation provides neutral governance that no single company controls.
The Bigger Picture
Project Glasswing represents a maturing of the AI industry’s relationship with security. For years, AI companies focused on capability — making models smarter, faster, more capable. Glasswing is the first major initiative where frontier AI capability is being directed specifically at protecting digital infrastructure rather than advancing commercial products.
Whether Glasswing succeeds will depend on sustained funding, continued cooperation among competitors with historically adversarial relationships, and the ongoing willingness of AI labs to share their most capable models for defensive purposes. But the initiative represents the most significant collaborative cybersecurity effort in the history of the internet — and a model for how AI’s most powerful capabilities might be governed for public benefit.