Skip to navigation

Threat reportVulnerabilityTL-2026-5056

Structural Patch Gap from AI-Driven Vulnerability Discovery (Project Glasswing) - SOC Implications

mediumMONITORING

Halcyon (Jordan Jeffer, 2026-06-03) argues that AI-driven vulnerability discovery under Anthropic's Project Glasswing has surfaced thousands of previously unknown vulnerabilities far faster than they can be patched, with fewer than 1% patched at announcement. Defenders should expect exploitation before patches arrive and monitor unpatched assets continuously. First disclosed .

Key facts for Glasswing AI patch gap

IdentifiersTL-2026-5056
Also known asProject Glasswing patch gap, AI discovery-to-remediation gap
SeverityMEDIUM
First disclosed
Exploitation statusNo exploitation observed (theoretical)
Affected productsMultiple (open-source maintainers) Operating systems, browsers and open-source projects covered by Project Glasswing disclosures (281 projects disclosed as of 2026-05-22)
ToolsClaude Mythos Preview
MITRE ATT&CK techniquesT1190 Exploit Public-Facing Application, T1203 Exploitation for Client Execution, T1587.004 Exploits, T1588.006 Vulnerabilities, T1595.002 Vulnerability Scanning
MotivationUNKNOWN
Target sectorstechnology, government administration, finance, health, critical infrastructure
Target regionsGlobal
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage for Glasswing AI patch gap

As of 2026-11-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5056 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-5056 Media Library Exploitation - ffmpeg/ffprobe Spawning Shell or Downloader

Detects ffmpeg, ffprobe or ffplay (ffmpeg was cited by CSA as having a 16-year-old Glasswing-found flaw) spawning a shell, interpreter or download/netcat tool. Media pipelines process untrusted input, so a child process of these binaries is a strong exploitation-for-execution signal (T1203) with possible ingress tool transfer (T1105).

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1203, T1059.004, T1105
  • Data sources: sysmon_linux, linux_auditd, mde_linux
  • Severity: high
  • Confidence: medium

Splunk SPL

index=linux sourcetype="sysmon:linux" EventCode=1 earliest=-24h
```TL-2026-5056: ffmpeg family spawning shell or downloader (T1203, T1059.004, T1105)```
| where match(lower(ParentImage), "/(ffmpeg|ffprobe|ffplay)$")
| where match(lower(Image), "/(sh|bash|dash|zsh|python[0-9.]*|perl|curl|wget|nc|ncat)$")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(User) as users by host, ParentImage, Image
| table first_seen last_seen host ParentImage Image users command_lines count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("ffmpeg","ffprobe","ffplay")
| where FileName in~ ("sh","bash","dash","zsh","python","python3","perl","curl","wget","nc","ncat")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc

Sigma

title: ffmpeg Family Process Spawning Shell or Download Tool
id: 3c1f6d7a-5a0e-4b8e-9d5c-5056a1000002
status: experimental
description: Detects ffmpeg, ffprobe or ffplay spawning a shell, interpreter or download tool, indicating possible exploitation of an unpatched media-library flaw.
references:
    - https://www.halcyon.ai/blog/patch-gap-structural-reality-soc-glasswing
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/02
tags:
    - attack.execution
    - attack.t1203
    - attack.t1059.004
    - attack.command-and-control
    - attack.t1105
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent:
        ParentImage|endswith:
            - '/ffmpeg'
            - '/ffprobe'
            - '/ffplay'
    selection_child:
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/dash'
            - '/zsh'
            - '/perl'
            - '/python'
            - '/python3'
            - '/curl'
            - '/wget'
            - '/nc'
            - '/ncat'
    condition: selection_parent and selection_child
falsepositives:
    - Transcoding wrappers that call helper scripts
level: high

Known false positives:

  • Custom media pipelines where ffmpeg legitimately invokes helper scripts

Tuning notes: Restrict to hosts that process untrusted media (upload servers, transcoders). Allowlist known helper script paths in CommandLine.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • TL-2026-5056 Vulnerability Scanning Against Exposed Web Services Preceding Exploitation · unlock with TL Creds
  • TL-2026-5056 Exploitation for Client Execution - Media/Document Viewer Spawning Script Host · unlock with TL Creds
  • TL-2026-5056 Ransomware Precursor - Volume Shadow Copy Deletion · unlock with TL Creds
  • TL-2026-5056 Reverse Shell Command Lines from Service Accounts on Exposed Linux Hosts · unlock with TL Creds
  • TL-2026-5056 Cron Persistence Created by Service Account After Exploitation · unlock with TL Creds
  • TL-2026-5056 Inhibit System Recovery - bcdedit and wbadmin Tampering · unlock with TL Creds
  • TL-2026-5056 Exploitation of Unpatched Network Service - Daemon Spawning Shell (CVE-2026-4747 / [indicator] class) · unlock with TL Creds
  • TL-2026-5056 Ransomware Impact After Unpatched-Asset Compromise - Mass File Writes with Ransom Note · unlock with TL Creds

Indicators of compromise for Glasswing AI patch gap

As of 2026-11-02, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-5056.

11 indicators of compromise · unlock with TL Creds. Compare plans

How Glasswing AI patch gap works

This is a strategic exposure-management record, not a single exploited vulnerability. No CVE, threat actor, malware family or network IOC is named in the primary source, and no active exploitation, CISA KEV listing or public PoC of the Glasswing findings is confirmed by any source reviewed. Severity (MEDIUM) and status (MONITORING) are analyst-assigned.

Project Glasswing was launched by Anthropic on 2026-04-07 with partners including Amazon, Microsoft and the Linux Foundation. It uses the unreleased Claude Mythos Preview model to find vulnerabilities in critical software. Anthropic reported more than 10,000 high- or critical-severity findings in the first month. As of 2026-05-22, 1,596 findings had been disclosed to maintainers across 281 open-source projects and 97 were confirmed patched, about 6% of disclosed findings and under 1% of total discovery volume. For findings not yet disclosed, Anthropic publishes only a SHA-3 cryptographic commitment of the details and withholds specifics until a patch exists. Examples cited by secondary sources include CVE-2026-5194 (wolfSSL certificate forgery, CVSS 9.1) and CVE-2026-4747 (FreeBSD RPCSEC_GSS remote code execution).

Halcyon's analysis frames the resulting patch gap as structural. Mean time to patch for critical vulnerabilities is described as weeks to months, while the exploitation window after disclosure is expected to be about 48 hours. Halcyon's illustration is that with 10,000 vulnerable assets and a 48-hour window, analysts get roughly 17 seconds per asset for investigation. The article also claims AI has made ransomware 13x faster than most defenses can detect (a vendor claim, not independently verified). Its core recommendation is continuous behavioral monitoring of unpatched assets as a complement to patching, and containment when an attacker gets in before a patch arrives.

Independent commentary adds caveats. Cloud Security Alliance (2026-06-07) calls the discovery-to-remediation gap a systemic risk. It cites 28.3% of CVEs exploited within 24 hours of disclosure and notes that volunteer open-source maintainers cannot triage at machine speed. VulnCheck (2026-09-08) found that Glasswing's public ledgers do not reconcile: 26,153 claimed findings, 2,736 on the disclosure ledger, 202 marked fixed, and maintainer severity ratings (51.3% critical/high) well below Claude's (91.5%). Human triage is identified as the rate-limiting step. Defenders should treat the gap as a planning assumption, prioritize compensating controls (segmentation, MFA, logging, behavioral detection) for unpatched assets, and shorten patch testing and deployment timelines.

MITRE ATT&CK techniques by tactic:

Initial Access

T1190 Exploit Public-Facing Application

Execution

T1203 Exploitation for Client Execution

Resource Development

T1587.004 Exploits; T1588.006 Vulnerabilities

Reconnaissance

T1595.002 Vulnerability Scanning

Remediation for Glasswing AI patch gap

Patches

  • Apply upstream fixes as Glasswing-sourced advisories and CVEs are published, for example wolfSSL for CVE-2026-5194 and FreeBSD for CVE-2026-4747

Immediate actions

  • Inventory internet-facing and unpatched assets and rank them by exposure and criticality
  • Place continuous behavioral monitoring and EDR coverage on assets that cannot be patched immediately
  • Audit dependencies against the open-source projects named in Glasswing disclosures and advisories
  • Enforce multi-factor authentication and comprehensive logging on exposed services

Workarounds

  • Apply network segmentation and access restrictions to unpatched systems
  • Disable or restrict exposed services that have no available patch

Longer-term hardening

  • Shorten patch testing and deployment timelines, for example by moving to a monthly or faster patch cadence
  • Establish direct communication channels with upstream open-source maintainers
  • Deploy AI-assisted patch validation tooling
  • Plan SOC triage capacity around the assumption of exploitation before patch availability

Affected and fixed versions

  • Multiple (open-source maintainers) — Operating systems, browsers and open-source projects covered by Project Glasswing disclosures (281 projects disclosed as of 2026-05-22)
    Vulnerable versions: Unpatched versions of affected projects; specific versions not stated in sources
    Fixed in: Per-project upstream fixes as released

Timeline of Glasswing AI patch gap

  • locked-ioc-5 launches locked-ioc-3 with partners including Amazon, Microsoft and the Linux Foundation, using the unreleased locked-ioc-2 model to find vulnerabilities in critical software.
  • locked-ioc-5 had disclosed 1,596 findings to maintainers across 281 open-source projects; 97 were confirmed patched (about 6% of disclosed, under 1% of total discovery volume).
  • The Hacker News and an oss-security post report 10,000+ high/critical findings, including CVE-2026-5194 (locked-ioc-8, CVSS 9.1); 97 patched upstream and 88 advisories issued.
  • locked-ioc-7 (locked-ioc-4) publishes 'The Patch Gap Is Structural', arguing exploitation before patch is expected and unpatched assets need continuous monitoring.
  • locked-ioc-1 publishes a research note on AI discovery outpacing open-source patching capacity, citing 28.3% of CVEs exploited within 24 hours of disclosure.
  • locked-ioc-6 reports Glasswing ledgers do not reconcile: 26,153 claimed findings, 2,736 on the disclosure ledger, 202 fixed, and maintainer severity ratings lower than Claude's.

Sources cited for Glasswing AI patch gap

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats