Bringing the cybersecurity capabilities of Claude Mythos 5 to more defenders

Anthropic put Mythos 5 inside Claude Security scans and opened a $35M credit fund

Security or backend developers on Claude Enterprise who want to scan internal codebases for vulnerabilities and automate patching

Mythos 5 is delivered as outputs, not a model
- Users do not prompt Mythos 5 directly; they get only the specific artifact a product provides.
- A tool can return suggested patches, but users cannot ask it to build an exploit.
Claude Security scans now run on Mythos 5
- Claude Enterprise customers can pick a repository and scan it for vulnerabilities with Mythos 5.
- Each finding has a CWE category, confidence and severity ratings, and a suggested fix.
- Billing is standard token usage under the existing plan, with no separate add-on.
Every patch needs human approval
- Fixes are implemented in Claude Code on the web using models your organization already has.
- The Mythos scan does not extend Mythos access to other surfaces.
- A human must review and approve each patch before it is implemented.
Partner security tools get Mythos 5 too
- Partners that built cyber products on Opus are working on Mythos 5 integrations.

Experience of safeguards blocking security work
- A maintainer said Fable and Opus 5 refuse regression tests for CVEs because they are technically PoCs, so they hide files like cve_test.c.
- Another commenter was refused a PoC in one session but got the same help in a new tab.
Experience switching to other models
- One commenter said ChatGPT and Claude were useless in a security incident, so they used grok.
- Another said Claude and Sol were useless for CTFs, while local Qwen and DeepSeek and GLM via OpenRouter worked.
Opinions on fund size and approval process
- One commenter argued $35M is small since the HAWK attack cost $100k for one vulnerability.
- Another said the approval process looks like OpenAI Cyber Trusted Access and seems intimidating.
Question about partner contract structure
- One commenter asked whether the OEM-style offer is usage-based or traditional licensing.

Apply to the Cyber Verification Program
- If your team does legitimate security work, submit the application today to request reduced safeguards on Opus and Sonnet.
- If you are already accepted, no action is needed and Anthropic will reach out.
Ask your Enterprise admin to enable Claude Security
- Enable it in the admin console and scan one small repository with Mythos 5 at claude.ai/security.
- Compare the CWE, severity and confidence results against your existing scanner.
Wire scan findings into patch review
- Generate a fix per finding in Claude Code on the web and have a human approve it in PR review.
Register interest if you build security products
- If you already have Claude Opus-based security features, submit the Mythos interest form.

CWECommon Weakness Enumeration, a standard numbering for vulnerability types. Think of it as a library catalog number for bug categories.

Dual-useCapabilities useful for both defense and attack. Like lockpicking lessons that help locksmiths and burglars alike.

PoCProof of Concept, minimal code showing that a vulnerability really works.

Project GlasswingAnthropic's program giving Mythos-class models first to a small group of organizations securing critical software.

LPELocal Privilege Escalation, a vulnerability that raises privileges on a local machine.