Anthropic’s Project Glasswing AI helped vendors discover more than 1,000 security vulnerabilities this month — a number that dwarfs anything we’ve seen before. Here’s what’s being patched and why password security should be your first concern.

We’ve been tracking the May 2026 patch cycle across every major software vendor, and the numbers are staggering. Microsoft fixed 118 flaws. Apple patched 52. Google’s Chrome team addressed 127. Mozilla’s Firefox 150 release resolved a whopping 271 vulnerabilities. Oracle fixed more than 450.

The common thread? Project Glasswing — an AI vulnerability detection system developed by Anthropic that’s been quietly reshaping how the industry finds and fixes security bugs. Multiple vendors were given early access, and the results just dropped.

Here’s the short version: if you’re still running unpatched software, your passwords are at risk. We’ll walk through each vendor’s patches, explain what Project Glasswing is doing differently, and give you a priority patch order that protects your credentials first.

What Is Project Glasswing?

Project Glasswing is an AI system built by Anthropic specifically for finding security vulnerabilities in source code. It’s not a general-purpose chatbot — it’s a purpose-built code analysis engine that has been given to a handful of major software vendors as part of a controlled early-access program.

The results speak for themselves. Vendors who participated are shipping patches at rates 3x to 10x higher than their historical averages. Mozilla’s Firefox 150 release, for example, fixed 271 vulnerabilities — the single largest security update in the browser’s history. Google’s Chrome team went from fixing 30 flaws one month to 127 the next.

But here’s what keeps us up at night: every one of those vulnerabilities was exploitable before it was found. Glasswing doesn’t prevent attacks — it helps vendors find bugs they missed, sometimes for years.

Microsoft’s May 2026 Patch Tuesday: 118 Flaws

Microsoft’s May update addresses 118 security vulnerabilities across Windows, Office, and related products. Sixteen of these earned Microsoft’s “critical” label — meaning attackers can remotely execute code without any user interaction.

Three stand out for password security:

CVE-2026-41089 — A critical stack-based buffer overflow in Windows Netlogon that gives attackers SYSTEM privileges on the domain controller. No privileges or user interaction required. If an attacker controls your domain controller, they control every password hash in your organization.

CVE-2026-41096 — A critical remote code execution vulnerability in the Windows DNS client. DNS poisoning can redirect login pages and steal credentials without the user ever noticing.

CVE-2026-41103 — A critical elevation of privilege bug that lets attackers impersonate any user by presenting forged credentials, bypassing Entra ID (formerly Azure AD) authentication entirely.

Microsoft assessed CVE-2026-41103 as “more likely” to be exploited, and we agree. Credential bypass vulnerabilities are gold to attackers — they don’t need to steal your password if they can forge one that looks legitimate.

Remarkably, this Patch Tuesday is the first in nearly two years without any emergency zero-day fixes for actively exploited flaws. That’s the good news. The bad news is the sheer volume of vulnerabilities being disclosed suggests Glasswing is finding bugs attackers never knew about — and now they do.

Apple: 52 Fixes, Backported to iPhone 6s

Apple shipped updates addressing at least 52 vulnerabilities on May 11. The company backported security fixes all the way to the iPhone 6s and iOS 15 — devices released in 2015. That’s unusual. Apple typically drops security support for older hardware after major iOS versions.

Chris Goettl, vice president of product management at Ivanti, noted that Apple’s typical monthly release averages around 20 fixes. The May release more than doubled that, suggesting Project Glasswing identified a significant batch of long-standing issues in Apple’s codebase.

For iPhone users, this means your Keychain passwords, iCloud Keychain sync, and Safari autofill data could have been exposed through any of these vulnerabilities. Install the update immediately.

Mozilla Firefox 150: 271 Vulnerabilities

Firefox 150 is the biggest security update in Mozilla’s history, fixing 271 vulnerabilities discovered during the Glasswing evaluation. Since the 150.0.0 release, Mozilla has moved to a weekly security patch cadence — releasing 150.0.3 by May 12 with three to five CVEs in each incremental release.

If you use Firefox, check your browser version. Firefox 150+ with all point releases is critical. The browser stores saved passwords, manages session tokens, and handles form autofill — all of which could leak through unpatched vulnerabilities.

Google Chrome: 127 Flaws

On May 8, Google rolled out Chrome updates fixing 127 security flaws — up from just 30 the previous month. Chrome downloads security updates automatically, but they don’t take effect until you restart the browser. That “Update and restart” button has never been more important.

Chrome’s Password Manager stores credentials locally (or syncs them to your Google Account). A browser-level vulnerability can expose every saved password on your device. Restarting Chrome takes 15 seconds — it’s worth it.

Oracle and the Monthly Cadence Shift

Oracle addressed at least 450 flaws in its most recent quarterly patch update, including more than 300 remotely exploitable, unauthenticated vulnerabilities. In response to Glasswing’s findings, Oracle announced it’s switching to a monthly update cycle for critical security issues — up from the traditional quarterly schedule.

This is a significant change. Oracle databases often store authentication data, application credentials, and password hashes. The shift to monthly patches means vulnerabilities are being found and fixed faster — but it also means the attack surface was larger than Oracle previously realized.

What This Means for Your Passwords

We’ve tested more than 10,000 password combinations in our lab, and here’s what we’ve found: most breaches don’t start with password cracking. They start with a software vulnerability that leaks credentials, followed by lateral movement using those credentials.

The Project Glasswing disclosures changed the landscape in three ways:

1. Known attack surface expanded. Every CVE published this month is a vulnerability attackers didn’t know about two weeks ago. Now they have a shopping list of exactly where to look.
2. Patches are your only defense. For zero-day vulnerabilities (like CVE-2026-41089 in Netlogon), there’s no behavioral detection or workaround — you either install the patch or you’re vulnerable.
3. Credential theft is the endgame. Almost every vulnerability disclosed this month can be chained with social engineering or phishing to steal passwords. The bugs themselves aren’t the threat — what attackers do after exploiting them is.

Priority Patch List — Protect Your Passwords First

Based on our analysis of the CVEs and their relevance to password security, here’s your patching priority:

1. Windows Server (Netlogon CVE-2026-41089) — Domain controller compromise = all passwords at risk. Patch immediately.
2. Firefox 150+ — 271 vulnerabilities, weekly releases. Update to 150.0.3 or later right now.
3. Chrome restart — Already downloaded, just needs a restart. Do it now.
4. iOS/macOS updates — 52 fixes, backported to old devices. Update everything.
5. Oracle databases — 450+ flaws, monthly patch cycle coming. If you run Oracle, prioritize these.
6. Windows DNS (CVE-2026-41096) — Critical RCE credential interception risk.

After patching, rotate critical passwords — especially for domain admin accounts, database credentials, and any service accounts that don’t use multi-factor authentication.

FAQs

What is Project Glasswing?

Project Glasswing is an AI vulnerability detection system developed by Anthropic. It was given to select major software vendors who used it to analyze their codebases for security flaws. The May 2026 patch cycle is the first major disclosure wave from these analyses.

How does Project Glasswing find vulnerabilities?

Glasswing uses specialized AI models trained on known vulnerability patterns, memory safety issues, and logic bugs across large codebases. Unlike traditional static analysis tools, it can understand code semantics and find subtle logic flaws that automated scanners typically miss.

Should I be worried about my passwords?

If you’ve applied the latest patches for your operating system, browser, and critical software, your passwords are protected against the known vulnerabilities. The risk is for users who delay patching — attackers now have a detailed list of exactly which vulnerabilities to target.

Do I need to change all my passwords after patching?

We recommend changing passwords for critical accounts after patching — especially domain admin accounts, database credentials, and any accounts that don’t use MFA. For regular user accounts, patching is sufficient. Use our password generator to create strong replacement passwords.

Which browser is safest right now?

All major browsers have had significant patches this month. Firefox fixed the most vulnerabilities (271), but Chrome (127) and Safari (52) also addressed critical issues. The safest browser is whichever one you keep updated. No browser is secure if you ignore patch notifications.

How often should I check for software updates?

Enable automatic updates where possible and restart your devices when prompted. For critical infrastructure (servers, domain controllers), check for updates at least weekly. With vendors moving to faster patch cadences (Oracle monthly, Mozilla weekly), the old “patch once a quarter” approach is no longer safe.

Will AI-powered vulnerability discovery make software safer?

In the long term, yes. Project Glasswing finding 1,000+ vulnerabilities in a single month means those bugs are getting fixed instead of sitting undiscovered for years. The short-term risk is the disclosure wave — attackers now know about vulnerabilities that were previously unknown. This “disclosure spike” will settle as vendors integrate AI into their development pipelines.

To stay protected against evolving threats like infostealer malware and credential theft, consider a comprehensive security suite like Kaspersky Premium. It includes advanced malware protection, password monitoring, and breach alerts that help you detect compromised credentials early.