Claude Security now runs vulnerability scans on Claude Mythos 5

Anthropic has moved Claude Mythos 5 — its most cybersecurity-capable and most tightly restricted model — into Claude Security, the product that scans enterprise codebases for vulnerabilities and suggests fixes. As Anthropic's own product page describes the workflow: "Claude scans your codebase with Claude Mythos 5, validates findings, and suggests patches you can review and approve."

What's new

Claude Security's scan-and-patch pipeline now runs on Mythos 5 rather than a general-purpose Claude model. The product finds issues in a customer's codebase, validates that the finding is real rather than a false positive, and proposes a patch that a human reviews and approves before it ships — the model doesn't get direct, open-ended access to write arbitrary code; it returns structured scan results.

That distinction matters because of what Mythos 5 is. Mythos is Anthropic's line of models built with cybersecurity safeguards deliberately relaxed relative to Claude's consumer and general-enterprise models, precisely so it can reason effectively about exploits and vulnerabilities — capability that would be dangerous to expose broadly. Since April 2026, Mythos access had been restricted to vetted partners inside Project Glasswing, Anthropic's consortium effort (with AWS, Apple, Cisco, Google, Microsoft, NVIDIA, and other launch partners) to help critical-infrastructure and software organizations find and fix vulnerabilities before attackers do. Putting Mythos 5 behind Claude Security's scan-only interface is Anthropic's way of extending that capability to its broader Claude Enterprise customer base without handing out raw model access — the product hands back a scan result, not a prompt box, so the same model that finds a vulnerability can't be steered by a user into writing an exploit.

Industry reporting around the same announcement — including coverage from Unite.AI and CyberScoop — describes Anthropic pairing this rollout with a new Defender Advantage Fund, said to commit roughly $35 million in Claude credits to organizations working on open-source software security, with grants aimed at patching live vulnerabilities in widely used projects and helping projects adopt more resilient security practices. Anthropic's own product materials confirm the Mythos 5 integration into Claude Security directly; the fund details above are as reported by that press coverage.

Context

Project Glasswing's public numbers as of its most recent expansion: roughly 200 partner organizations across more than 15 countries, with partners collectively surfacing over 10,000 high- or critical-severity vulnerabilities since the program's April debut. Claude Security's move to Mythos 5 is a step beyond that consortium model — instead of vetting individual organizations one at a time for direct model access, Anthropic is packaging the same underlying capability into a bounded, productized workflow available to any Claude Enterprise customer.

Why it matters

The core tension in offensive-capable security models has always been access control: a model good enough to find real vulnerabilities is also good enough to help someone exploit them. Claude Security's scan-only interface is Anthropic's attempt to resolve that tension at product level rather than purely through vetting — broadening who benefits from Mythos-class capability while keeping the raw model itself gated. Whether that containment holds as more enterprise customers get access, and how much the reported open-source funding actually moves the needle on vulnerability backlogs in widely used dependencies, are the questions worth tracking as Anthropic shares more detail on fund recipients in the coming weeks.