Anthropic Expands Project Glasswing: AI Security Is Moving from Finding Bugs to Fixing Workflows

# Anthropic Expands Project Glasswing: AI Security Is Moving from Finding Bugs to Fixing Workflows

Anthropic has expanded Project Glasswing to about 150 new organizations across more than 15 countries. Project Glasswing is Anthropic’s cybersecurity collaboration focused on helping important software, open-source maintainers and critical infrastructure providers find and fix vulnerabilities faster.

This update matters for Toket AI because it shows a larger shift in AI: the value of AI is moving from answering questions to executing multi-step tasks.

In cybersecurity, the model does not only need to say where a problem might be. It needs to help scan a codebase, suggest a patch, support human review and move the vulnerability toward resolution.

From a product and operations perspective, this is not just a cybersecurity story. It is a signal that AI agents and AI workspaces will increasingly be judged by how well they manage complex workflows.

AI security is moving from discovery to repair

Many early AI security tools focused on finding vulnerabilities.

But Anthropic’s update makes a key point: the bottleneck is now verifying, disclosing and patching the large number of vulnerabilities that advanced models can surface.

Finding a bug is only the first step. A real security workflow may include:

• checking whether the vulnerability is real
• evaluating severity
• explaining the risk
• generating a patch
• asking a human team to review it
• merging and deploying the fix
• recording the result

That is a workflow, not a one-turn answer.

A single model response cannot manage the whole process. The real value comes from connecting the model, tools, context, human review and task history.

Claude Security shows AI is becoming a professional workspace

Anthropic also highlighted Claude Security, a product that uses public frontier models such as Claude Opus 4.8 to scan codebases and suggest patches.

This shows that AI security tools are moving from chat-style help to professional workspaces.

Users are not simply asking:

Is this code safe?

They want AI to help with:

• scanning a codebase
• identifying possible vulnerabilities
• explaining the risk
• suggesting patches
• marking uncertainty
• supporting human review
• creating an actionable remediation plan

This is very different from a normal chat task. It needs longer context, more stable output, clearer boundaries and stronger review controls.

Token cost becomes a hidden cost in security workflows

AI security tasks can consume a large number of tokens.

Codebases, dependency files, logs, vulnerability reports, patch content and previous context may all enter the model input. One task may involve several rounds of analysis and review.

A vulnerability repair workflow may include:

1. reading relevant code 2. analyzing risk 3. explaining the attack path 4. generating a fix 5. comparing possible fixes 6. producing a patch 7. writing a review checklist or commit summary

Each step creates input and output tokens.

If every step uses a premium model, the cost can grow quickly. If every step uses a weak model, the output may be unreliable and require retries.

That is why a Token Calculator matters. Users should estimate the cost before the workflow starts, not only after the task is finished.

Prompt Optimizer can reduce wasted security calls

Security tasks require precise prompts.

If a user only writes:

Check whether this code has vulnerabilities.

The model may produce a generic answer, miss the right context or suggest fixes that are not actionable.

A better prompt should define:

• the code area to inspect
• the vulnerability types to focus on
• whether external assumptions are allowed
• whether the output should be a risk list or a patch plan
• whether confidence levels are required
• what must be reviewed by humans
• whether tests or patch suggestions are needed

Prompt Optimizer helps turn vague requests into executable tasks. Clearer prompts reduce wrong directions, repeated calls and wasted tokens.

AI Workspace should manage task state, not only chat history

Project Glasswing shows that AI in high-value scenarios is not just a chat box. It is a task workspace.

A useful AI Workspace should help users see:

• current task stage
• current model
• context length
• token or credit usage
• which findings came from the model
• which findings need human review
• which steps are complete
• which outputs should be saved for later

This matters not only for cybersecurity. It also matters for code review, enterprise operations, legal documents, financial analysis and other complex tasks.

Users do not only need an answer. They need to understand where the answer came from, how much it cost, whether it needs review and what should happen next.

What Toket AI users should take away

Anthropic’s Project Glasswing expansion shows that AI is entering more complex professional workflows.

For Toket AI users, the practical takeaways are:

1. Do not choose a model only because it is the strongest. Choose based on task risk and cost. 2. Before long tasks, use Token Calculator to estimate input, output and multi-turn cost. 3. For complex tasks, use Prompt Optimizer to define the goal, boundaries and output format before working in AI Workspace.

AI security is only one example. More professional tasks will follow the same pattern: the model analyzes and generates, the user reviews and decides, and the workspace manages context, cost and process.

That is the problem Toket AI is built to solve: helping users use models more clearly, complete tasks more reliably and control token costs more effectively.