Anthropic opens Mythos 5 to enterprise scans without direct model access

Anthropic has expanded access to its most capable cyber model without opening a new API for talking to it. Since August 21, Claude Enterprise customers can have Claude Mythos 5 review their repositories inside Claude Security. They receive classified vulnerabilities, confidence and severity estimates, and a suggested fix; they do not receive an open-ended conversation with Mythos or access to the model elsewhere in Claude.

The model is not new, and the scanner already existed. The novelty lies in the combination. Claude Security entered public beta in April with Opus 4.7, while Mythos 5 was reserved for a small group of vetted Project Glasswing organizations. Now any organization on the Enterprise plan can put Mythos's capability on its own code, but only through a predefined task and output.

That architecture deserves more attention than the parallel announcement of $35 million in credits or the security-product integrations that have yet to arrive. It is a concrete attempt to separate access to a capability from access to the model that produces it. If it works, it offers a middle path between blocking useful work and distributing a dual-use tool without limits.

The boundary moves from the user to the product

Anthropic had already built two ways to distribute the same family. Fable 5 uses the same underlying model as Mythos 5, but its classifiers route certain cybersecurity, biology, and chemistry requests to Opus 4.8. Selected Glasswing partners, by contrast, get Mythos with fewer restrictions for defensive work. The joint system card and the June announcement explain the difference as a safeguard layer, not two independently trained models.

Claude Security adds a third surface. The organization selects a repository or directory and the system runs the analysis. Each finding includes a CWE category, confidence, severity, and a proposed fix. If the user opens the fix in Claude Code, that interaction uses models the organization already has access to, not Mythos by extension. Anthropic also says no change is integrated without human review and approval.

The restriction is real: arbitrary dialogue and the immediate ability to ask Mythos to change its goal disappear. It is also partial. An explanation detailed enough for someone to reproduce a vulnerability and assess a patch contains some of the knowledge needed to exploit it. A repository is also user-chosen input and can contain hostile text, deliberately misleading code, or a collection built to provoke an output beyond the intended scope.

This does not invalidate the design. It changes what needs evaluating. It is no longer enough to ask whether a classifier refuses an offensive request. Tests need to establish whether the scanner holds its objective against instructions buried in code, how much detail leaves the system, whether repeated queries can reconstruct restricted capabilities, how repository scope is constrained, and which signals trigger review. The announcement mentions abuse-prevention measures, but publishes neither results from those specific tests nor the mechanism used to verify that submitted code belongs to the sender.

Model evidence is not service evidence

There are good reasons to broaden defensive access. In May, Anthropic reported that Mythos Preview had scanned more than 1,000 open-source projects and labeled 6,202 findings high or critical. Six security firms or Anthropic itself had assessed 1,752 of them: 90.6% proved to be real vulnerabilities and 62.4% retained a high or critical rating. External institutes and companies also reported strong results in their own environments and codebases.

That is unusually concrete operational evidence, but it does not yet validate the product announced this week. It comes from Mythos Preview, a Glasswing harness, and an intensive process involving outside researchers. We do not know whether Claude Security uses the same compute budget, parallel exploration, tools, validators, or stopping criteria. Anthropic also provides no Mythos 5 figures for recall on known flaws, false-alert rate, cost per repository, or a paired comparison with Opus 4.7.

The distinction matters because scanner quality cannot be summarized by how many alerts it produces. A false positive consumes the team that must verify it; a false negative can create apparent safety; a plausible fix can introduce a regression. The current product guide says every finding goes through multistage verification, but does not describe its evaluators or provide an independent measurement. “Uses Mythos 5” identifies the engine; it does not prove end-to-end performance.

The bottleneck begins after discovery

Glasswing's own figures show the problem this expansion must solve. At the May cutoff, Anthropic estimated that it had disclosed 530 high- or critical-severity flaws and only 75 were recorded as patched. Part of the gap reflected disclosure timelines and patches not yet observed, but maintainers had also asked it to slow reports because they could not absorb them. Finding more vulnerabilities can increase risk during the interval between notification and update unless verification and deployment capacity grow at the same time.

Claude Security tries to shorten that chain by delivering a proposed fix with the finding. Requiring human approval is sensible, but it does not by itself create the hours or accountability needed to reproduce the flaw, review the change, coordinate disclosure, and distribute it. The new credits pay for inference; they do not automatically pay for maintainer work. Announced integrations with other tools may bring the result closer to teams that already manage that process, but Anthropic still describes them in the future tense.

My reading is that the release points in a valuable direction: for dual-use capabilities, the unit of distribution can be a bounded, auditable job rather than always a chatbot. A system that returns only a structured finding and a reviewable patch offers fewer degrees of freedom than the general model and can put a better tool in front of many defenders.

But a narrow interface is not proof of safety. It is a new trust boundary that includes the model, harness, input code, output filters, customer identity, and downstream human process. Knowing whether this middle path deserves to expand will require evaluations of the system customers actually use: attacks on its scope, quality on a blind set of repositories, review burden, accepted patches, and defects observed after integration. Anthropic has opened a door to Mythos without handing over the model's key; it now needs to measure publicly whether that door leads to repairs rather than merely more reports.

Sources

• Anthropic, Bringing the cybersecurity capabilities of Claude Mythos 5 to more defenders, August 21, 2026.
• Anthropic, Claude Security is now in public beta, April 30, 2026.
• Anthropic, Claude Fable 5 and Claude Mythos 5 and joint system card, June 9, 2026.
• Anthropic, Project Glasswing: An initial update, May 22, 2026.
• Anthropic Help Center, Use Claude Security, updated August 22, 2026.