https://www.anthropic.com/glasswing

WordPress powers something like 40% of the web. It's arguably more "critical software infrastructure" than half the named partners. JPMorganChase is in there — a bank — but not the CMS that runs nearly half the internet? The Linux Foundation is a partner, and WordPress runs on Linux, but WordPress itself has its own massive attack surface: plugins, themes, the core PHP codebase, the REST API, xmlrpc, wp-admin — it's one of the most targeted pieces of software on earth.

And WordPress's security model is, to be blunt, a mess. The plugin ecosystem is the real vulnerability surface, and it's largely maintained by independent developers with wildly varying security practices. There are something like 60,000+ plugins. This is exactly the kind of sprawling, under-audited codebase where Mythos could be devastating — both offensively (finding exploitable vulns in popular plugins) and defensively (scanning the plugin repository systematically).

The Linux Foundation quote actually gestures at this: "Open source software constitutes the vast majority of code in modern systems... By giving the maintainers of these critical open source codebases access to a new generation of AI models... Project Glasswing offers a credible path to changing that equation."