From The Three Buddy Problem podcast on Glasswing, the major AI labs' tilt towards offensive cybersecurity, and the labs' self-interest:
"What are people using [Glasswing] for? … Glasswing is going to give you access to Mythos 5 or 5.1, and you're going to get a certain amount of money and credits to use it. …
“They have not been pruned through. You might just have a 100 new vulns, a 1,000 new vulns, 10,000 new vulns in your code base. You now have, to the extent that anybody gives a flying fuck about software liability, you now have a responsibility to do something about the vulnerabilities in this code base.
“And you have nothing, nothing special that you're leveraging to fix that. So I invite you now to spend $3 for every dollar that you spent on Mythos, now on some other model, because Mythos is not going to patch shit for you, presumably to patch these vulnerabilities, to test and patch. So you're signing up, people are like rushing in the door to be told about all these vulnerabilities and to then have the headache of how do I fix all these vulnerabilities.”
“Not to mention the part where you're like, you know, feeding your source code to a company that has historically had no compunction about, you know, taking over other people's businesses or trying to compete in their own business, like whatever. Let's set all of those concerns aside.”
“They're also making everyone do the scanning themselves. It's not like you're a part of Glasswing and now they're going to tell you, hey, here's all the 0-days, here's all the vulnerabilities in all of the libraries that we know you're using because we've been scanning them and we haven't publicly disclosed them, here's a newer version of open-source libraries that don't have those vaults or like here's an awareness of the patches that are coming or here's, no, no, don't bother re-scanning all of this stuff. We already scanned it.
“We don't want you to waste money, water, tokens, time, redoing the work that all of your friends are already doing. They don't do any of that shit.”
…
“So I bring us right back to you've hired all the offensive talent on earth and very little defensive talent. You seem to be obsessed with building a vulnerability discovery machine and you have to some extent built that. Congratulations.
“When are you building the thing that fixes the vulns?”
carwil•1h ago
"What are people using [Glasswing] for? … Glasswing is going to give you access to Mythos 5 or 5.1, and you're going to get a certain amount of money and credits to use it. …
“They have not been pruned through. You might just have a 100 new vulns, a 1,000 new vulns, 10,000 new vulns in your code base. You now have, to the extent that anybody gives a flying fuck about software liability, you now have a responsibility to do something about the vulnerabilities in this code base.
“And you have nothing, nothing special that you're leveraging to fix that. So I invite you now to spend $3 for every dollar that you spent on Mythos, now on some other model, because Mythos is not going to patch shit for you, presumably to patch these vulnerabilities, to test and patch. So you're signing up, people are like rushing in the door to be told about all these vulnerabilities and to then have the headache of how do I fix all these vulnerabilities.”
“Not to mention the part where you're like, you know, feeding your source code to a company that has historically had no compunction about, you know, taking over other people's businesses or trying to compete in their own business, like whatever. Let's set all of those concerns aside.”
“They're also making everyone do the scanning themselves. It's not like you're a part of Glasswing and now they're going to tell you, hey, here's all the 0-days, here's all the vulnerabilities in all of the libraries that we know you're using because we've been scanning them and we haven't publicly disclosed them, here's a newer version of open-source libraries that don't have those vaults or like here's an awareness of the patches that are coming or here's, no, no, don't bother re-scanning all of this stuff. We already scanned it.
“We don't want you to waste money, water, tokens, time, redoing the work that all of your friends are already doing. They don't do any of that shit.”
…
“So I bring us right back to you've hired all the offensive talent on earth and very little defensive talent. You seem to be obsessed with building a vulnerability discovery machine and you have to some extent built that. Congratulations.
“When are you building the thing that fixes the vulns?”
From Three Buddy Problem: Why is Anthropic Afraid of GLM 5.3?, Oct 2, 2026 https://podcasts.apple.com/us/podcast/why-is-anthropic-afrai...