Claude Security now scans on Mythos 5, and customers still cannot reach the model

Anthropic said on 21 August 2026 that scans in Claude Security now run on Claude Mythos 5, the version of its flagship that it does not sell to the general public. The capability is in public beta for customers on a Claude Enterprise plan, and the company’s own summary of the arrangement is that the model does the work and never comes out from behind the counter: “Claude Security uses Mythos 5 to scan code you own, and returns detailed findings rather than raw outputs without exposing the model itself.”

Until now, a company wanting Mythos-class capability applied to Project Glasswing and waited for an answer. From today it points a product at a repository it owns and reads what comes back.

The model that is not for sale

Mythos 5 and Claude Fable 5 are the same underlying model. What separates them is the safety layer and the door. Fable 5 is the edition anyone can use, shipped with extra measures on dual-use capability, meaning skills that serve legitimate work and would also serve an attacker: software exploitation, sensitive scientific procedure, the categories where the same expertise cuts both ways. Mythos 5 has several of those measures lifted, and Anthropic decides who is allowed to use it.

Until this announcement that decision was made one organisation at a time. Anthropic’s cybersecurity page carries a wall of twenty-two logos headed as organisations defending critical software with Claude Mythos, including AWS, Google, Apple, NVIDIA, Broadcom, Cisco, IBM, Oracle, Red Hat, Cloudflare, JPMorgan Chase, Morgan Stanley, Mastercard, Visa, Verizon, BNY and Goldman Sachs. Behind them sits $100 million in usage credits, which the company says goes to Glasswing partners defending critical infrastructure, and $4 million in direct donations to OpenSSF, Alpha-Omega and the Apache Software Foundation.

The programme has grown faster than that wall suggests. Anthropic said in early April that roughly 50 initial partners had access to the earlier Claude Mythos Preview, and on 2 June it announced it was extending the partnership to approximately 150 more organisations, putting the total near two hundred. In the same post it said those partners had by then found “more than 10,000 high- or critical-severity security flaws”. A separate figure on the cybersecurity page, 500 or more high-severity vulnerabilities “found that survived decades of scrutiny and automated analysis”, is filed under Claude Opus rather than under Mythos, and belongs to that model.

The most specific result Anthropic publishes belongs to Mozilla, which built a pipeline around the earlier Claude Mythos Preview and shipped 271 Firefox security fixes in April 2026, a figure Anthropic describes as more than twenty times Mozilla’s monthly average. The number is Anthropic’s, on Anthropic’s page, and the attribution rests on the vendor’s account rather than on an independent count.

What a scan gives you

Claude Security is a code scanner with a language model where the pattern matcher would normally sit. Anthropic describes the model as reasoning through code the way a security researcher would, tracing data flows across files and identifying vulnerability patterns that span several components rather than sitting on one line.

Every finding then goes through what the company calls an adversarial verification pass, in which the model attacks its own result before the result reaches a person. What survives arrives as a record with four parts:

A scan can be scoped to one directory rather than a whole repository, and it can be put on a schedule so coverage continues without anyone starting it. Findings leave the product through webhooks into Slack, Jira or any ticketing system, or as CSV and Markdown.

Mythos 5 scans are charged as standard token usage under the plan a customer already has, with no separate add-on and nothing extra to license. Anthropic has not published what a scan of a given size consumes, which is the figure that decides whether scheduled scanning across a large estate is affordable or an experiment a team runs once.

One boundary limits what any of this can be built into. The Mythos scan does not extend Mythos access anywhere else. The Claude Security plugin for Claude Code, which is also in beta, uses only the models already available in that account, so a developer running a review at their desk is not running Mythos 5 by another route.

Why the door stays shut

Anthropic’s argument for the split is stated in the announcement, and it is narrower than a general claim about safety. The risk it names is not that a capable model exists. It is that a user with direct access can steer one, turn by turn, towards something harmful. Findings about code a customer already owns cannot be steered in that way, so the output can be released to a far wider group than the model can.

This is the same reasoning that produced the two editions in the first place, applied one step further out. Anthropic has now shipped three tiers of the same underlying system: the general edition with its safeguards on, an approved-organisation edition with several of them lifted, and a product surface that runs the second one for you and hands back only what it found.

What else went out the same day

The Claude Security change arrived alongside two other announcements, and both are about reach rather than capability.

Anthropic opened a Defender Advantage Fund, styled 0xDAF, holding $35 million in Claude credits for organisations patching vulnerabilities in open-source projects. It names three things it wants to fund: patching live vulnerabilities in widely used projects, automating scanning and patching in ways other projects can copy, and helping projects pursue approaches that make them resistant to whole classes of attack rather than to individual bugs. The company says it is starting with a small number of larger pilot grants and will publish details in the following weeks.

It is also expanding the Cyber Verification Program, which today gives vetted defenders reduced safeguards on Opus and Sonnet-class models. The expansion adds safeguarded access to Mythos, and defensive capabilities including vulnerability triaging and validation. Alongside that, Anthropic says partners are building cyber products on its models.

The customer and partner list it publishes for the wider cybersecurity offering runs to Cogent, Palo Alto Networks, Trellix and Mozilla, with Accenture, Boston Consulting Group, CrowdStrike, Deloitte, Infosys, Microsoft Security, PwC, SentinelOne and Wiz as service partners.

The reviewing still belongs to a person

Anthropic prints its own caveat on the product page, and it survives every claim above it: the model can be wrong, and a proposed patch should be reviewed before it is applied, particularly on a critical system. No benchmarked false-positive rate has been published for Mythos 5 in this role, so how often that caveat bites is a question each customer will answer from its own beta.

A scanner that writes its own fixes relocates the work rather than removing it. What a Claude Enterprise customer gains today is a frontier-grade reader for code nobody had time to read. What it still owes is a person who reads the patch.