A crypto exchange’s security posture often comes down to a simple asymmetry: defenders need to find every meaningful flaw, while an attacker only needs one viable path. Payward, the parent company of Kraken, is adding a different kind of defender to that effort by joining Anthropic’s Project Glasswing, according to the original report . The company intends to use Anthropic’s cybersecurity model to hunt for vulnerabilities and share open-source findings.
That is a meaningful shift in how exchange operators approach the top of the security stack. Traditional reviews still depend on human red teams, third-party auditors, and bug bounty submissions. Each has natural limits: auditors are periodic, red teams are scheduled, and bounty programs depend on outside researchers deciding the target is worth their time. A cybersecurity model can probe code, dependencies, and configuration surfaces continuously, which changes the economics of finding issues before they are exploited.
For Kraken, the stakes are not abstract. The exchange operates custody infrastructure, trading systems, and a retail front end, all of which represent distinct attack surfaces. Engineering attention remains concentrated in a relatively small number of ecosystems, as shown by recent developer activity data . That concentration makes automated security coverage more useful for a major operator that cannot staff every review manually.
Why shared findings matter more than model choice
The open-source part of Project Glasswing may matter as much as the model itself. If findings are shared beyond Payward, they can speed remediation for other firms that rely on similar components. But the disclosure channel is not specified. Most exchange operators have preferred quiet fixes or narrow responsible-disclosure programs over public releases, so a broader sharing approach would imply a different risk appetite.
That trade-off is especially relevant in crypto, where a large share of infrastructure is built from shared libraries, open-source clients, and composable protocols. A vulnerability found in one place often repeats across multiple venues. An open findings pipeline could shorten the window between discovery and broad fixes, assuming the information is framed well enough for other teams to act on it.
AI is moving from product layer to security layer
Many crypto firms first used AI for customer support, trading interfaces, or on-chain analytics. Payward’s move puts the technology into the operational layer, where failure has a different cost profile. The goal is not to generate content or make recommendations; it is to identify weakness before an external actor does.
That approach sits alongside wider efforts to pair AI with Web3 infrastructure. Projects such as UXLINK and Origins Network are focused on scalable AI-driven applications, often using decentralized compute. Payward is on the other side of the same trend: using a frontier model to protect centralized exchange infrastructure rather than building an AI product for users.
What the announcement does not answer
Project Glasswing’s practical coverage inside Payward remains unclear. It is not known which systems the cybersecurity model will test first, how its outputs will be triaged, or what the threshold will be for publishing a finding. All of that determines whether the initiative becomes a durable security improvement or a narrow pilot.
False positives are another underappreciated constraint in automated security work. A model can produce large volumes of suspected issues, but a human still has to decide which ones are reachable, exploitable, and worth disrupting production systems to fix. Without that triage layer, the output can create noise rather than reduce risk.
Regulatory pressure adds a separate variable. Exchange operators are already dealing with shifting market structure and compliance requirements, including last-minute political fights over major crypto legislation. A Senate battle over a key bill, reported by BlockchainReporter , shows how external constraints can change priorities quickly. Security automation may help on the technical side, but it does not reduce the policy exposure that affects how exchanges operate.
