The $100M Question: Who Protects the Software That Protects You?

In May, Anthropic published its first update on Project Glasswing. The headline number was staggering: more than ten thousand high- or critical-severity vulnerabilities found across the world's most important software in a single month. But the number that should keep board members up at night was buried deeper in the report.

Of the 530 high- or critical-severity bugs disclosed to open-source maintainers, just 75 had been patched.

That's a 14 percent fix rate. And the maintainers—many of them unpaid volunteers—had already asked Anthropic to slow down the disclosures because they couldn't keep up.

The Software Nobody Owns but Everybody Uses

If you're a board member or executive reading this, there's a good chance your enterprise runs on open-source software you've never heard of. wolfSSL, a cryptography library used by billions of devices, had a vulnerability so severe (CVE-2026-5194, CVSS 9.1) that an attacker could forge certificates and impersonate your bank's website. Mythos Preview found it. A volunteer maintainer patched it.

That pattern repeats thousands of times across your technology stack. Black Duck's 2026 Open Source Security and Risk Analysis found that the average commercial codebase now contains 581 open-source vulnerabilities—a 107 percent increase year over year. Ninety-three percent of audited codebases included components with no development activity in the past two years. Nobody's maintaining the code. But everybody's depending on it.

In my experience advising organizations on cybersecurity risk, this is the conversation that never makes it to the boardroom. Executives ask about ransomware. They ask about phishing. They rarely ask: "Who maintains the open-source libraries in our critical systems, and what happens when those maintainers can't keep up?"

That question just became urgent.

AI Finds Faster Than Humans Can Fix

Anthropic scanned more than 1,000 open-source projects with Mythos Preview. The model identified 23,019 issues, 6,202 of which it rated high- or critical-severity. Independent security firms validated 90.6 percent of the assessed findings as true positives.

Here's the structural problem: on average, it takes two weeks to patch a high- or critical-severity bug found by Mythos Preview. The model can scan an entire major project in minutes. The math doesn't work. Discovery has been automated. Remediation hasn't.

Cloudflare, one of Glasswing's partners, pointed Mythos at fifty of their own repositories and found 2,000 bugs—400 of them high- or critical-severity—with a false positive rate their team considered better than human testers. Mozilla found and fixed 271 vulnerabilities in Firefox 150, more than ten times what they found in the previous version using a different model.

This isn't theoretical anymore. ReversingLabs' 2026 Software Supply Chain Security Report documented a 73 percent increase in malicious open-source packages over the past year. Attackers are already targeting the supply chain. Now we have confirmation that the software they're targeting is riddled with vulnerabilities that nobody had the resources to find—until AI did it all at once.

The Industry's Response: Two Major Bets in One Week

The week of June 22 saw two significant moves. The Linux Foundation launched Akrites, backed by AWS, Anthropic, Cisco, Google, Microsoft, and others, to create a shared Security Incident Response Team and a standardized vulnerability disclosure process for critical open-source projects. The idea is simple: give maintainers a single, trusted partner instead of a flood of uncoordinated reports.

Days later, OpenAI expanded its Daybreak cybersecurity initiative with "Patch the Planet"—a collaboration with Trail of Bits to help open-source projects move from findings to fixes. More than 30 projects have committed to participate, including cURL, Go, Python, and Sigstore.

Anthropic itself has committed $4 million to open-source security organizations—$2.5 million to Alpha-Omega and OpenSSF through the Linux Foundation, and $1.5 million to the Apache Software Foundation.

These are meaningful steps. They are not sufficient. Four million dollars sounds like a lot until you realize that Anthropic committed $100 million in Mythos usage credits to Glasswing partners. The ratio tells you where the investment is going: into finding, not fixing.

What to Ask Your CISO This Week

This is where the rubber meets the road for boards and executives. In Cyber Risk Is Business Risk, I walk through the Three Questions framework—the essential questions every board member should be able to answer about their organization's security posture. Here's how to apply that framework to this specific issue:

Do we know what open-source components are in our critical systems? If your CISO can't produce a software bill of materials (SBOM) for your most important applications, that's a red flag. You can't manage risk you can't see.

What's our patch velocity for open-source dependencies? The industry average is ugly. If your organization takes months to deploy patches for known vulnerabilities in open-source components, you're carrying risk that just got orders of magnitude more visible.

Are we participating in the ecosystem, or just consuming it? Organizations that depend on open-source software have a strategic interest in ensuring it's maintained. That means funding, contributing engineering time, or at minimum, running your own codebase through the vulnerability scanning tools that are now broadly available.

For the full Three Questions framework and a board-ready approach to these conversations, see Chapters 4 and 5 of Cyber Risk Is Business Risk.

The Bottom Line

We've entered a phase where AI can find software vulnerabilities faster than the global developer community can fix them. That gap is a risk multiplier for every organization that depends on software—which is every organization.

The question isn't whether your systems contain exploitable open-source vulnerabilities. After Glasswing, the answer to that is almost certainly yes. The question is what your organization is doing about it, and whether your board is even having the conversation.