A new era of vulnerability discovery, driven by advanced AI models, is rapidly changing the cybersecurity landscape, making traditional remediation strategies increasingly unsustainable. This shift, highlighted by initiatives like Anthropic's Project Glasswing and internal experiments by major technology companies, reveals a significant increase in the speed and volume of vulnerability identification, creating a bottleneck in the ability of organizations to fix these issues.
Project Glasswing, first publicly updated by Anthropic in May 2026, demonstrated the profound impact of frontier AI models. Within approximately one month, partners using these models identified over 10,000 high- or critical-severity vulnerabilities. Some teams experienced a tenfold increase in their bug-finding rates. Mozilla, for instance, addressed 271 issues in a single Firefox release, while Cloudflare detected 2,000 findings with a false-positive rate superior to human testers. The open-source community also reported thousands of additional vulnerabilities.
This surge in discovery capability is corroborated by internal findings from companies like Cisco and the Government of Alberta. Cisco utilized various frontier models to scan 1.8 billion lines of code across its portfolio, covering 25 languages, in just eight weeks—a task estimated to take eight years using conventional methods. Cisco reported a false-positive rate under 3% for these scans. Similarly, the Government of Alberta employed Claude to review 466 million lines of code across 27 ministries in approximately 20 hours.
The accelerated rate of vulnerability discovery is outpacing remediation efforts. The 2026 Verizon DBIR indicated that vulnerability exploitation had become the leading initial access vector at 31%, surpassing credential abuse. Despite this, only 26% of CISA Known Exploited Vulnerabilities (KEVs) were fully remediated, and the median time to fix had risen to 43 days. This suggests that the challenge has shifted from finding vulnerabilities to effectively patching them at the required speed.
In response to this evolving threat landscape, Cisco has developed several initiatives and provided guidance. The Foundry Security Spec is a model-agnostic blueprint designed to make frontier model outputs auditable, enabling organizations to build tailored harnesses for higher fidelity results. This initiative was specifically mentioned in Anthropic’s initial Glasswing report.
Cisco also introduced Foundry-Security-Spec CodeGuard, an open-source, model-agnostic security framework that integrates secure-by-default practices into AI coding agent workflows, guiding AI assistants to generate more secure code. Additionally, Foundation-Sec-8B is an open-weight model that extends Llama-3.1-8B, pre-trained on a cybersecurity-specific corpus including threat intelligence, vulnerability databases, and incident response documentation, to enhance understanding of security concepts for applications like threat detection and vulnerability assessment.
Other Cisco tools include Antares, a small, open-weight model designed to localize known vulnerabilities within large codebases without requiring source code to be sent to the cloud. DefenseClaw provides security governance for the entire AI agent lifecycle, scanning skills and MCP servers, inspecting prompts and tool calls at runtime, pausing risky actions for human approval, and exporting evidence to existing security stacks. The LLM Security Leaderboard allows users to evaluate how models perform under single and multi-turn attacks before deployment.
Cisco's "Shields Up" guidance for customers emphasizes strengthening fundamental security practices, such as phishing-resistant multi-factor authentication and least privilege access, including for AI agents. It also advises retiring end-of-life systems, automating detection, triage, and containment, and deploying runtime protections closer to workloads. The guidance stresses using AI for defensive purposes, not solely for discovery, with Cisco IQ serving as a platform for continuous visibility, prioritized exposure, adaptive assessments, and resilient infrastructure services.
The current environment necessitates a shift in mindset from aiming for 100% prevention to designing for resilience and rapid detection and response, assuming potential breaches to build stronger defensive outcomes. The tools and playbooks for this new approach are available, underscoring the need for organizations to adapt at the speed demanded by the evolving threat landscape.
