Editorial illustration for Anthropic deploys Claude Mythos 5 for cybersecurity, with humans approving fixes
Claude Mythos 5 Finds Code Vulnerabilities in Beta
Anthropic deploys Claude Mythos 5 for cybersecurity, with humans approving fixes
Anthropic is putting Claude Mythos 5, its most capable model to date, to work finding security holes rather than just answering prompts. The company has moved its Claude Security scanner onto Mythos 5, and the tool is now in public beta for Enterprise customers. It reads through codebases, flags vulnerabilities, and proposes fixes, with every scan billed as standard token usage rather than some separate service tier.
Each result comes tagged with a CWE category, the industry's standard shorthand for classifying software flaws, along with a severity score and a suggested patch. No fix goes live without a human checking it first. Anthropic is also licensing Mythos 5 to partner companies building security products for hospitals, utilities, and banks, though those end users never talk to the model directly. They just see the output: a flagged bug, a proposed fix, nothing more.
Mythos 5 hasn't had a wide release before now, largely because of how strong it is at cyber-related tasks. That's the tension Anthropic is trying to manage with this rollout, and it's the part worth paying attention to.
Claude Mythos is Anthropic's most capable model, especially for cyber tasks, which is why it's not broadly available. This rollout is meant to boost defenders without giving attackers new AI-powered options.
Why this matters
For developers and security teams, Claude Security on Mythos 5 is worth testing precisely because Anthropic kept the human sign-off step. Scans running as normal token usage means cost tracking gets murkier as codebases grow, something founders should model before rolling this out beyond a pilot repo. The CWE tagging and severity ratings give teams a familiar structure to slot into existing triage workflows, rather than forcing a new taxonomy on already-stretched security staff.
The more interesting move is Mythos 5 showing up inside partner products at hospitals, utilities, and banks, where end users never see the model directly. That's the pattern to watch: AI infrastructure disappearing into critical systems through vendor integrations rather than branded chatbots. Researchers studying AI deployment risk should pay attention to how much visibility hospital IT staff or bank compliance officers actually have into what the underlying model flagged, changed, or missed.
Anthropic hasn't said whether findings get audited independently of the humans approving fixes. That gap, not the scanner itself, is where this story gets tested.
Related Reading
Browse all Anthropic news →
LLMs & Generative AI ChatGPT's 'Nerdy' tweak rewards goblin metaphors in answers, study finds
LLMs & Generative AI Google tests visual 'magazine-style' UI for Gemini 3 Pro users
LLMs & Generative AI AI Engineers Face Rising Costs, Need New Strategies for Efficiency
Related Topic Trump cracks down on Anthropic after Amazon tip; staff largely foreign
Open Source
Related Topic Claude Mythos highlights EU AI safety gaps, says researcher Caroli
Policy & Regulation
From Archives Nvidia's Linear Math Simplifies Costly AI Model Handoffs
From Archives Insilico Medicine's AI Drug Raises Question of Credit
From Archives Anthropic keeps 30-day data rule but stores it in customer clouds after criticism
Business & Startups
From Archives OpenAI Outpaces Anthropic in Q3 API Growth, Astra Model Launch Imminent
Business & Startups
Common Questions Answered
What is Claude Mythos 5 and why is it being deployed for cybersecurity?
Claude Mythos 5 is Anthropic's most capable model to date, specifically optimized for cybersecurity tasks. It has been deployed to power the Claude Security scanner, which reads through codebases to identify vulnerabilities and propose fixes while maintaining human approval for each fix recommendation.
How does the human approval process work in Claude Security on Mythos 5?
Every security scan result and proposed fix generated by Claude Mythos 5 requires human sign-off before implementation. This approval step ensures that security teams maintain control over vulnerability remediation rather than allowing fully automated fixes to be applied to their codebases.
Why is Claude Mythos 5 not broadly available to all users?
Anthropic has restricted Claude Mythos 5 access to Enterprise customers only because the model is so capable at cybersecurity tasks that broader availability could give attackers new AI-powered options. This limited rollout strategy prioritizes boosting defenders without inadvertently empowering malicious actors.
What billing model does Claude Security use on Mythos 5?
Claude Security scans are billed as standard token usage rather than a separate premium service tier. This means costs scale with codebase size, and developers should model token usage carefully before rolling out the tool beyond pilot repositories to understand the financial impact.
How does Claude Mythos 5 categorize and report vulnerabilities?
Each security scan result is tagged with a CWE category, which is the industry's standard shorthand for classifying vulnerabilities, along with severity ratings. This familiar structure allows security teams to integrate the findings directly into existing triage workflows without requiring them to learn a new taxonomy.
Further Reading
- Making frontier cybersecurity capabilities available to defenders - Anthropic
- Claude Mythos 5 Now Available in Claude Security for Vulnerability Scanning - Cybersecurity News
- Anthropic puts Claude Security's GitHub scanner behind an Enterprise login - RuntimeWire
- Anthropic Claude Security available to all Enterprise customers - Techzine
- Anthropic is turning Claude Code's auto mode on by default - TechCrunch
