Project Butterfly of Damocles
From fairy dust to Glasswing: a decade of being right about the wrong thing
In 2014 the internet’s foundational software was held together by wishful thinking and volunteer labor. In 2026, Anthropic's unreleased frontier model validated that at industrial scale, and two nation-state actors proved the security tooling itself is now the attack surface. This 10-part series explores Project Glasswing, the ML dependency graph, and the most consequential AI security policy decisions of the decade.
Companion Materials
-
Whitepaper
Full research paper — coming soon.
-
Infographics
Architecture diagrams and threat models — coming soon.
Episode Guide
-
Ep 1
Introduction: From fairy dust to Glasswing
A decade of being right about the wrong thing. An overview of the Glasswing paradigm shift.
-
Ep 2
The original quantitative case: internet infrastructure is not OK
Revisiting the 2014 DEF CON data showing almost nothing critical lived in the safe quadrant.
-
Ep 3
Third-party libraries: the vulnerability layer nobody counted
The transitive dependency graph, structural vulnerabilities, and how Node.js services became 847 applications.
-
Ep 4
When the security scanner became the weapon: Trivy → LiteLLM → Axios
The March 2026 cascade: Two nation-state actors striking developer toolchains within 12 days.
-
Ep 5
Silicon Valley's new attack surface: the machine learning dependency graph
Examining PyTorch, TensorFlow, HuggingFace, LiteLLM, and how the AI gateway became the credential vault.
-
Ep 6
From "I have a toolbox" to "the scanner has a backdoor"
The timeline mapping the progression from 2014 to the release of Project Glasswing.
-
Ep 7
What Project Glasswing actually changes for every open source actor on earth
The Glasswing Doctrine, capability withholding as governance, and the impact across maintainers and regulators.
-
Ep 8
Pros, cons, and tensions that don't resolve
The honest accounting of Project Glasswing. Does withholding Mythos actually buy us time?
-
Ep 9
What this means if you work in security, build OSS, or set policy
The scarcity of finding capability is over. The crisis of fixing it is just beginning. Key takeaways for the ecosystem.
-
Ep 10 ★
Conclusion: What it looks like when you hold the whole picture at once
Season finale — The questions nobody is asking loudly enough, structural paradoxes, and the uncomfortable truth.