Enterprise Security in the Agentic AI Era

Anthropic

4 min read

Anthropic

Sources: Anthropic (homepage) · Project Glasswing · Claude Code Security · Frontier Red Team — zero days

AI lab; producer of Claude foundation models (Opus, Sonnet, Haiku) and preview-stage Claude Mythos Preview frontier model. CoSAI Premier Sponsor, ISO 42001 certified.

Notable Output (security-relevant)

  • Project Glasswing (announced May 12, 2026): 12-partner coalition initiative with $100M in usage credits + $4M in OSS-security donations applying Mythos to defensive vulnerability discovery on critical software. Partners: AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, Palo Alto Networks, plus 40+ extended-access organizations. Mythos is also deployed offensively (non-Glasswing-partner) via XBOW (see XBOW’s evaluation). Mythos is NOT planned for general availability: preview-only at $25/$125 per M tokens via Claude API, Amazon Bedrock, Google Cloud Vertex AI, and Microsoft Foundry. Anthropic commits to 90-day public reporting on Glasswing findings.
  • Claude Code Security (announced Feb 20, 2026): defender-first vulnerability-discovery capability built into Claude Code on the web. Limited research preview for Enterprise + Team customers with expedited free access for OSS maintainers. Read-and-reason analysis + multi-stage self-critique verification (“Claude attempts to prove or disprove its own findings”) + severity + confidence ratings + dashboard review with human-approval-gated patches. Capability anchor: Anthropic FRT found 500+ vulnerabilities in production OSS codebases using Claude Opus 4.6 (cited via red.anthropic.com/2026/zero-days/). See the paper page.
  • 2026 Agentic Coding Trends Report (early 2026): vendor strategic forecast with Trend 8 (“agentic coding improves security defenses — but also offensive uses”) and Priority 4 (“embedding security architecture as a part of agentic system design from the earliest stages”).
  • Frontier Red Team blog (red.anthropic.com): technical detail layer for the FRT’s CTF evaluations, PNNL critical-infrastructure partnership, and zero-days discovery work.
  • defending-code-harness (anthropics/defending-code-reference-harness, Apache 2.0): agentic harness scoped to C/C++ memory-safety bugs; a find counts once a crafted input crashes the target under AddressSanitizer, and a generated patch is verified against re-attack. Runs under a gVisor sandbox with an egress allowlist and outputs SARIF plus patches, per Semgrep’s July 2026 LLM-generated repository summary.1 Semgrep reports the repository unmaintained and maintains a fork, semgrep/defending-code-harness.
  • Threat Intelligence report series (from August 2025): periodic case-study disclosures from a dedicated Threat Intelligence team inside the Safeguards organization, covering misuse of Claude by real actors. The August 2025 edition carries GTG-2002 and GTG-5004; the November 2025 GTG-1002 disclosure and the June 2026 LLM ATT&CK Navigator continue the line. The series sits outside the vulnerability-discovery slots below and reports on adversaries rather than on capability: 832 banned accounts mapped to MITRE ATT&CK, plus the ARiES risk-scoring methodology and an argued gap in the ATT&CK taxonomy.

Relevance to This Wiki

Anthropic occupies four distinct slots in AI vulnerability discovery. The first three sit on the ai-in-sec-defense axis: (a) coalition organizer (Project Glasswing, the May 2026 capability-distribution mechanism across 52+ organizations); (b) commercial-preview product vendor (Claude Code Security, the Feb 2026 defender-first productization on Claude Code on the web); (c) model substrate (Mythos + Claude Opus 4.6, the underlying capability that the Anthropic FRT used to find 500+ OSS vulnerabilities). The fourth distributes method rather than access: (d) open-source reference implementation — defending-code-reference-harness`, an Apache-2.0 agentic harness for C/C++ memory-safety discovery with execution-verified patching, which Semgrep’s July 2026 survey reports tied for most-starred of the nine harnesses it compares, at ~6K stars alongside Trail of Bits’ skills marketplace.1 The first three slots distribute access under terms Anthropic sets — partner restrictions, the no-GA stance, an enterprise entitlement. The fourth distributes method under a permissive licence and retains nothing: Semgrep reports the repository unmaintained, with a fork maintained at semgrep/defending-code-harness. The defender-first framing holds across the three controlled channels and is carried by a third party in the fourth.

Methodologically, Anthropic is convergent with OpenAI (Codex Security) on rejecting rule-based SAST as the prior generation and adopting the human-security-researcher metaphor. See Adversarial Reflexion for the cross-product FP-control discipline.

Contradicts MOAK empirical results

The Anthropic Red Team publicly stated: “Opus 4.6 is currently far better at identifying and fixing vulnerabilities than at exploiting them. This gives defenders the advantage.” (cited in MOAK origin story, Apr 9 2026).

MOAK’s published results demonstrate 98% autonomous exploitation of CISA KEVs using Claude Opus 4.6 as a primary model inside a five-agent agentic pipeline — directly contradicting the claim that Opus 4.6 does not give attackers exploitation capability. The Anthropic statement may accurately characterize bare-model capability; it does not account for agentic orchestration, which MOAK demonstrates closes the gap. See MOAK origin story for the full analysis.

Notes

Footnotes

  1. Semgrep — Comparing open source AI code security harnesses, July 2026 (no day-level date exposed; author not named). The licence, category description and unmaintained status are human-written; the star count is human-written but point-in-time; the AddressSanitizer/gVisor/SARIF mechanism detail is from Semgrep’s LLM-generated repository summary. Summarized at OSS AI Security Harness Comparison. ↩ ↩2

Graph View

Backlinks