Anthropic says Glasswing found 10,000+ serious software flaws, and the week in Claude

PLUS: KPMG is giving Claude to its 276,000+ staff, Claude Code's auto mode comes to Pro, and Anthropic buys Stainless

By SamMay 24, 2026

Hi, builders. Here's your week in Claude, from May 17 to May 23.

This week, Anthropic said Glasswing found over 10,000 serious flaws. Claude Code's auto mode came to the Pro plan. And KPMG is giving Claude to all its staff.

Plus 9 quick hits. Every claim has a link.

Anthropic says Glasswing found over 10,000 serious flaws

Anthropic says finding bugs is no longer the slow part. Fixing them is.

On May 22, Anthropic shared its first update on Project Glasswing. It and about 50 partners used Claude Mythos Preview to hunt for flaws. Anthropic says they found more than 10,000 high- or critical-severity ones.

Per Anthropic, Cloudflare found 2,000 bugs. Of those, 400 were high- or critical-severity. Mozilla found and fixed 271 flaws in Firefox 150 while testing Mythos Preview.

Anthropic also scanned over 1,000 open-source projects. Mythos Preview estimates it found 6,202 high- or critical-severity flaws there.

Outside firms, and in a few cases Anthropic, checked 1,752 of them. Of those, 90.6% were real. And 62.4% were confirmed high- or critical-severity.

Anthropic estimates it has reported 530 serious bugs. Some of those severity ratings are Claude's own.

So far, 75 are patched. It says it's still early in the 90-day disclosure window, and it's likely undercounting patches.

Some maintainers asked Anthropic to slow down its reports.

Security teams at qualifying customers can now ask for the tools used with Mythos Preview, for use with public models. They include skills, a scanning harness and a threat model builder.

Anthropic says no company, itself included, yet has safeguards strong enough to stop Mythos-class models from being misused. So it hasn't released them to the public. It plans a general release once it has far stronger safeguards.

WSJ: Anthropic told investors it will turn its first operating profit

Anthropic told investors it will make an operating profit for the first time, per the Wall Street Journal.

TechCrunch reported the WSJ story on May 20. Per the WSJ, Anthropic told investors it will more than double revenue in its second quarter. That's to around $10.9 billion.

The WSJ reports Anthropic may not stay profitable all year. That's due to large compute costs it's scheduled to take on.

Anthropic shared the numbers with investors as part of a funding round. It declined to comment further, per TechCrunch.

Claude Code's auto mode comes to the Pro plan

Auto mode swaps permission prompts for safety checks. It now works on the Pro plan.

On May 22, Anthropic's ClaudeDevs account shared the news. Auto mode now supports Sonnet 4.6, alongside Opus 4.7.

Per Claude Code's weekly digest, routine actions run without stopping you. Destructive or suspicious ones are blocked and shown to you. Auto mode shows up once your account meets the requirements.

Other changes, per the changelog:

/usage now shows what's driving your plan limits. It breaks usage down by skills, subagents, plugins and each MCP server (2.1.149, May 22).
/code-review reports correctness bugs at an effort level you pick. With --comment, it posts findings as inline GitHub PR comments (2.1.147, May 21).
"Extra usage" is now "usage credits." /extra-usage is now /usage-credits, and the old name still works (2.1.144, May 19). Per the digest, it needs a claude.ai sign-in, not an API key.

KPMG is giving Claude to all of its 276,000+ people

KPMG, the audit, tax, legal and advisory firm, announced a global alliance with Anthropic.

Per Anthropic's May 19 post, all 276,000+ KPMG employees will get access to Claude. KPMG is also building Claude into Digital Gateway, its main platform for client work. It starts with new tools for tax and legal clients.

Claude Cowork and Managed Agents run inside that platform. Rema Serafi, KPMG US's Vice Chair of Tax, says building an agent for changing tax rules "used to take weeks." Now, per Serafi, it "takes minutes."

Anthropic named KPMG a preferred partner for private equity. The two firms' teams will also use Claude to find and fix flaws in critical systems. KPMG's Trusted AI framework guides that work.

Claude Managed Agents can now run tools on your own servers

Managed agents can now run their tools in a sandbox you control.

On May 19, Anthropic launched self-hosted sandboxes in public beta. An agent runs its tools on machines you control. Or it can use providers like Cloudflare, Daytona, Modal or Vercel.

The agent loop stays on Anthropic's side. Your files and repos don't leave.

MCP tunnels, in research preview, link agents to MCP servers inside your private network. Those servers aren't exposed to the public internet. Tunnels work in Managed Agents and the Messages API, and you request access.

Org admins manage tunnels in the Claude Console.

Per the release notes, you can now change an agent's MCP servers and tools mid-session. Tool outputs over 100k characters (about 25k tokens) now spill to a file in the sandbox.

Anthropic buys Stainless, the company behind its SDKs

Anthropic is buying the company behind every official Anthropic SDK.

Per Anthropic's May 18 post, Stainless was founded in 2022. It turns an API spec into SDKs in TypeScript, Python, Go, Java and more. Hundreds of companies use it to make SDKs, CLIs and MCP servers.

"Agents are only as useful as what they can connect to," said Katelyn Lesse. Lesse is Anthropic's Head of Platform Engineering. Lesse said the Stainless team is joining to advance Claude's ability to connect to data and tools.

Quick hits

Claude had elevated errors on May 22, from 04:16 to 08:50 UTC (11:16 pm May 21 to 3:50 am Central). Per the status page, it hit multiple models, Opus 4.7 and Sonnet 4.6 most. It covered claude.ai, the Console, the Claude API, Claude Code and Cowork.
Security firms shared early results from tools built on Opus (May 21). Per Anthropic, Palo Alto Networks says it did a year's worth of pen testing in under three weeks. That was in internal testing.
The Claude Compliance API gained 28 integrations with security and compliance tools (May 21). Enterprise IT and security teams can now govern Claude the way they govern other apps. An update on the page says it now has over 100.
The web search tool now returns richer SEC filing data (May 18). Anthropic says it helps ground financial research agents in primary sources, with citations.
MCP's maintainers released a release candidate for the next spec (May 21). It makes the protocol stateless at its core. The final spec ships July 28, and it contains breaking changes.
Claude Code 2.1.149 fixed a PowerShell permission bypass (May 22). Built-in cd functions could change the working folder unseen. That let a later command read outside the workspace.
Claude Code 2.1.145 fixed a permission-prompt bypass (May 19). Bash commands that set environment variables not on the allowlist were approved without asking.
Claude Code background sessions now show up in /resume (2.1.144, May 19). They're marked "bg," next to your regular sessions.
Claude Code 2.1.148 fixed a bug from 2.1.147 (May 22). For some users, every Bash command returned exit code 127.

Worth your time

How an Anthropic sales leader uses Cowork (May 20): Anthropic's US mid-market sales lead runs a book of 4,000 accounts. Cowork scored every account overnight. The author says work like this took hundreds of hours in past roles.
How Anthropic's finance team uses Claude (May 22): a finance team member hands the board deck to Cowork. They ask it to confirm every number and claim matches one source of truth.

That's the week. The next issue lands Sunday, May 31.

Reply and tell me what you're building. I read every reply.

— Sam