Power utilities including Duke Energy are testing Anthropic’s advanced AI models to look for software vulnerabilities and are building them into their cyber defences, Bloomberg reported on 11 November. Duke’s chief security and information security officer, Martin Strasburger, said Anthropic enabled utilities to use the tools late this summer, according to the report.
Bloomberg’s summary does not say which programme gave utilities access. Until October, Anthropic offered trusted cyber access through two programmes; Project Glasswing was the one that gave selected organisations its Claude Mythos models. Under Glasswing, Anthropic said on 2 June that it was extending the partnership to approximately 150 new organisations from industries such as “power, water, healthcare, communications, and hardware”. With the roughly 50 initial partners, that is about 200, or about four times the launch group, by our arithmetic. On 6 October it folded Glasswing into a three-tier Cyber Verification Program, which lists municipal utilities among its examples.
Business Pill · ATTACKING YOUR OWN SYSTEM
A one-minute explainer of red teaming: a team is given permission to attack a system the way an adversary would, so its owner can find the weak points first. It teaches the general idea only and says nothing about any company in this story.
The key insight: As we read it, the utility story fits the access model Anthropic has described: its most capable cyber models reach critical infrastructure through vetted programmes and tiers, not a public release, and Anthropic named power among the sectors it wanted in.
Bloomberg reported that some power companies are using Anthropic’s cybersecurity technology, testing the models for vulnerabilities in their software and integrating them into their defences. We could read only the article’s summary, not its full text, so the programme figures below come from Anthropic’s own posts.
Organisations with access to Claude Mythos Preview under Project Glasswing, approximate. Source: Anthropic, 2 June 2026. The June total is our arithmetic (about 50 initial plus about 150 new).
What Anthropic Has Said About Utilities
Anthropic’s June post said the new group is based in more than 15 countries and that “most provide critical infrastructure to many more”. It said each organisation must meet its security requirements before it gains access, and that for most partners “a major attack could affect more than 100 million people”.
The same post said initial partners had found more than 10,000 high- or critical-severity security flaws. It said the bottleneck “is now verifying, disclosing, and patching” the large numbers of vulnerabilities such models surface, and that many partners now use the model to write patches.
The expanded Cyber Verification Program has three tiers. It lists “operators of critical infrastructure of any size, such as regional hospitals or municipal utilities” as examples for Defense Access, and reserves Specialized Access, with the fewest cyber blocks, for organisations authorised to test systems such as “power grids”. Existing Glasswing members move to that tier. We covered the tiers in Anthropic Opens Mythos 5.1 to Defenders in 3 Cyber Tiers.
Claude Opus 5.5 on CyScenarioBench, challenges completed out of 50 trials by access level. Source: Anthropic, 6 October 2026.
Our Numbers
In the same post, Anthropic tested Claude Opus 5.5 on 50 trials of its CyScenarioBench. Without program access, every task was blocked on the first prompt; with Defense Access, four of 50 succeeded; with Red Team Access, 34 of 50 did. That is 8% against 68%, by our arithmetic.
Anthropic said Glasswing partners uncovered at least 129,000 verified software vulnerabilities between April and July 2026, and that more than 33,000 of its verified findings had been rated critical- or high-severity. The newest model, Mythos 5.2, scored 73.5 on Cognition’s vulnerability-discovery test, as we reported in Cognition: Mythos 5.2 Scores 73.5 on Cyber Test.
The Structural Read
As we read Anthropic’s June post, utilities were a stated target of the expansion rather than a side effect: power and water head its list of industries that were not well represented in the first cohort.
As we read the October tiers, a utility’s access depends on its verification level: Defense Access for operators of any size, and Specialized Access, reviewed with the US government, for systems such as power grids.
Anthropic, Expanding Project Glasswing, 2 June 2026
“What each partner has in common is that a successful attack on their codebase could be catastrophic.”
Three Implications
FOR UTILITIES Anthropic lists municipal utilities as examples for Defense Access and power grids for Specialized Access, which has the fewest cyber blocks.
FOR ANTHROPIC Its June post said it plans to expand Glasswing further, prioritising additional essential infrastructure providers.
FOR SECURITY TEAMS Anthropic said the bottleneck is now verifying, disclosing and patching the vulnerabilities such models surface.
The framework reads: “It is where decisions are made about who gets access to frontier intelligence, under what conditions, and for which purposes.”
As we read it, utilities testing Mythos are that layer at work: access to the model is granted organisation by organisation, against security requirements, rather than sold to anyone. The framework predates this report and does not discuss Duke Energy.
What Is Not Established
We could not read Bloomberg’s full article, which is paywalled, so we do not know which other utilities it names or what they found. Anthropic has not named its June partners in the posts we read, and none of them names Duke Energy. We found no Duke Energy statement on its own site. We did not contact Anthropic or Duke Energy.
This Week In The AI Supercycle
The Great Convergence of Capital, Power, and Geopolitics
This week’s issue: for two years the AI build-out was priced as a supply story, and last week as a credit story. This week it was priced as a permission story, and the answer arrived as a cost, not a ban.
Utilities including Duke Energy are testing Anthropic’s models for software flaws, Bloomberg reported. Separately, Anthropic widened Project Glasswing to about 200 organisations in June, by our arithmetic, with power named among the new sectors, and its access tiers list municipal utilities and power grids as examples.
A note on sourcing. Bloomberg’s 11 November article is paywalled; we read its summary, and every claim from it is attributed to Bloomberg. We read in full Anthropic’s Project Glasswing page, its 2 June expansion post and its 6 October Cyber Verification Program post. The partner total, the multiple and the percentages are our arithmetic. We did not contact Anthropic or Duke Energy.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
