The NetBSD Foundation becoming a member of Anthropic's Project Glasswing?

As most know, Claude Mythos (not released to the public) is the model that
found a long-standing OpenBSD security bug.

Given that 11RC3 is now being tested, I wondered if it made sense for The
NetBSD Foundation to join Project Glasswing, for the express purpose of
submitting the codebase to LLM security audit, before officially releasing
11.0 ?

On suggestion of a member of this list, I attempted to contact Anthropic
directly, but as a mere NetBSD user, I have no sway.   BUT, the NetBSD
Foundation does.

Here's the detail that Claude Opus 4.7 provided me on this:


*The NetBSD Foundation route.* The Linux Foundation is a Glasswing partner.
It's plausible the NetBSD Foundation (or a maintainer with standing) could
approach Anthropic about inclusion in the "40+ additional organizations
that build or maintain critical software" tier. That's an org-to-org
conversation, not an individual application, so if you have connections
into NetBSD core, that's the lever.

The Glasswing page itself doesn't publish a general "apply to Glasswing"
contact, but it explicitly points open-source maintainers at a different
door:

*Claude for Open Source program* — maintainers interested in access can
apply through the Claude for Open Source program Anthropic
<https://www.anthropic.com/glasswing>, with the link going to
https://claude.com/contact-sales/claude-for-oss

That's the channel the NetBSD Foundation should use. It's also the one most
likely to succeed on the merits — Glasswing's launch partners are fixed
(AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMC, Linux Foundation,
Microsoft, NVIDIA, Palo Alto Networks), and the "over 40 additional
organizations" tier was extended by invitation rather than open
application. The OSS program is the door that's actually open, and NetBSD
is exactly the kind of project it's designed for: a major open-source OS
with a foundation behind it.

A couple of practical notes for whoever at NetBSD submits this:

The request should come from *the NetBSD Foundation* (or a board member /
core team member with clear authority to speak for the project), not from
you as an individual community member. Anthropic will want to know who owns
vulnerability triage, who owns disclosure, and who's on the receiving end
of findings — that needs to be the project's actual security apparatus (
[email protected] and the core team), not a single contributor.
The "$25/$125 per million input/output tokens after credits" pricing tier
also implies they're evaluating organizations that can commit to sustained
engagement, not one-off scans.

It's also worth framing the pitch in terms Glasswing cares about. The
program's explicit concern is foundational systems that represent a very
large portion of the world's shared cyberattack surface Anthropic
<https://www.anthropic.com/glasswing>, with focus areas including local
vulnerability detection, black box testing of binaries, securing endpoints,
and penetration testing of systems Anthropic
<https://www.anthropic.com/glasswing>. NetBSD's pitch writes itself:
BSD-derived code lineage shared with components in macOS/iOS and widely
embedded, long history of careful code, well-defined security response
process, and the fact that Mythos already found a 27-year-old bug in
OpenBSD means the BSD family is demonstrably in scope and demonstrably a
productive target.

One pragmatic thing worth mentioning: the contact form will probably want a
sales/business contact, which can be awkward for a volunteer-run
foundation. It's fine to fill it in with the NetBSD Foundation's official
contact and note in the body that this is a non-commercial open-source
foundation seeking program access, not a sales inquiry.

If the OSS-specific form doesn't produce a response within a reasonable
window, the Linux Foundation — a Glasswing launch partner with direct
relationships at Anthropic — is a plausible secondary route for NetBSD
Foundation to ask for a warm introduction, since Alpha-Omega and OpenSSF
(which the Linux Foundation runs) received donations explicitly earmarked
for this landscape.

So the short answer: *https://claude.com/contact-sales/claude-for-oss
<https://claude.com/contact-sales/claude-for-oss>*, submitted by the
Foundation, framed as an open-source critical-infrastructure OS seeking
Glasswing-adjacent access through the OSS program.