Anthropic made Claude Mythos 5, its most capable cybersecurity model, available to Enterprise customers on August 21, 2026, through the Claude Security product rather than as a model anyone can prompt. Customers get scan results, weakness classifications, confidence and severity ratings, and suggested patches. They do not get the model. The company also said it is expanding its Cyber Verification Program toward broader dual-use access and launching a $35 million Defender Advantage Fund for open-source security.
Key facts
- Claude Security switched from Opus 4.7 to Mythos 5 for Enterprise customers on August 21, 2026.
- Users receive findings and patches through a product interface, not direct model access.
- Anthropic announced a $35 million Defender Advantage Fund for open-source security alongside the change.
- Primary source: Anthropic's announcement.
The headline that spread was some version of "Anthropic released its hacking model." That is not what happened, and the actual shape of the change is more interesting than the headline.
Background. Mythos 5 and Fable 5 were announced together in June 2026 as the same underlying model with different deployments, and Mythos was initially restricted to a small group of trusted partners doing defensive security work under a program Anthropic calls Glasswing. The reason for the restriction is the oldest problem in security tooling: a system good enough to find vulnerabilities in your code is good enough to find them in someone else's. Capability does not know which side it is on.
Anthropic's answer is an access-control design rather than a capability decision. The company's argument, in its own framing, is that the dangerous case is a user with an open channel to the model, and that a much narrower risk surface exists when the user receives only a specific artifact the product was built to produce. A vulnerability report with a suggested patch is useful to a defender and considerably less useful to an attacker than an unrestricted assistant would be.
The analogy is a hospital pharmacy. Widening access to a controlled drug does not mean unlocking the cabinet for everyone in the building. It means more clinicians can now get a prepared, labelled, dose-checked syringe. The molecule is exactly as dangerous as it was. The delivery path is what changed.
Underneath the product, the older gate is unchanged and worth reading carefully, because Anthropic publishes it. The cyber safeguards help center article says the safeguards "block two categories of activities." The first is prohibited use, defined as "Cybersecurity activities that are almost always used maliciously and have little to no legitimate defensive application such as mass data exfiltration or ransomware code development," which are blocked by default and, in Anthropic's words, "not subject to adjustment." The second is high-risk dual use, covering vulnerability exploitation and offensive security tooling, which is blocked by default but can be unlocked through the Cyber Verification Program. That program is free but application-based, requires identity verification, is tied to a specific organization, and is unavailable on zero-data-retention accounts. Today it covers Opus and Sonnet. Anthropic says Mythos-class access will follow.
The same week, Anthropic made the surrounding agent machinery generally available: computer use, the Skills API, and the Files API. Those are not a security story on their own, but they point the same direction. Skills are now managed objects with versioning and identifiers, attached through the request and executed in a sandbox, with up to twenty per call. Files are uploaded once and referenced by identifier. Anthropic is turning frontier capability into governed, auditable surfaces with names and version numbers, which is what enterprise procurement actually buys.
The strongest counter-argument, and it is a fair one, is that this is a distribution decision dressed as a safety decision. A product wrapper is a control, but it is a control Anthropic operates, and its strength depends on classifier quality and on the wrapper not being talked around. This site has covered how models behave differently when they think a safety researcher is asking and how prompt injection propagates between agents. The wrapper is a real reduction in risk surface, not an elimination of it.
The honest caveat: Anthropic has not published the evaluations behind the decision to widen access, and the company still has not shipped the model that found ten thousand bugs as anything a security researcher can point at a target themselves. Judge this as a change to the customer list and the access path, which is what it is, not as a statement that the underlying capability got safer.
Originally published on Ground Truth, where every claim is checked against the primary source.
Top comments (0)