Anthropic Brings Claude Mythos 5 to Security Scanning for Claude Enterprise

Mythos 5 Enters the Public Beta of Claude Security

As of August 21, 2026, Claude Security scans for Claude Enterprise customers use Claude Mythos 5, a model from the Mythos family previously reserved for selected defenders through Project Glasswing.

Access is available in public beta and does not require a separate add-on. Usage counts as standard token consumption included in the Enterprise plan. However, an administrator must enable the feature through the management console.

Once enabled, users can start analyses at claude.ai/security by connecting a repository hosted on GitHub. The integration is not available for every development environment: the Mythos 5 workflow is limited to Enterprise organizations whose code is hosted on GitHub.

Claude Pro, Max, and Team plans do not receive these scans. A separate Claude Security for Claude Code plugin is also available in beta to all Claude Code users. That component uses the models already included with the respective account, not Mythos 5.

Analysis Across Code, History, and Data Flows

Claude Security does more than search for strings associated with known vulnerabilities or run rule-based checks. Mythos 5 analyzes multiple related files, reconstructs data flows, and examines Git history to determine how a section of code has evolved.

This approach focuses primarily on flaws that emerge from interactions between different components. The issue classes identified by Anthropic include memory corruption, injection vulnerabilities, authentication bypasses, and logic errors distributed across multiple files.

Each result undergoes adversarial verification. During this phase, the model challenges its own conclusion before presenting it to the user, with the aim of reducing false positives and distinguishing suspicious behavior from an actually exploitable vulnerability.

The output is not an open-ended conversation but a structured artifact. Each finding includes:

• CWE category;
• confidence level;
• severity level;
• proposed patch.

No CVEs, CVSS scores, CVSS vectors, software versions, or specific builds have been disclosed. Severity is therefore described through the fields returned by the scan and references to high-impact defect categories, rather than through an independent classification already assigned to specific vulnerabilities.

From Scanning to Operational Triage

Organizations can limit analysis to a specific directory or service, schedule recurring scans, and use the system during pre-release audits. Other use cases include legacy code review, regression scanning, and classifying known vulnerability backlogs.

Teams can focus activity on services considered higher risk. Results can also be sent to Slack or Jira via webhook, or exported in CSV and Markdown formats. This makes it possible to connect findings with standard incident management, remediation, and code review workflows.

The main operational benefit lies in triage. An organization can obtain an initial classification of issues, prioritize them, and distribute evidence to the responsible teams without turning the model into an interactive assistant available to everyone.

The scanner does not apply fixes automatically. To implement a change, users must open Claude Code on the web and use the models already available in their account. Every patch must be reviewed and approved by a person.

Why Mythos 5 Is Not an Interactive Chatbot

Anthropic keeps Mythos 5 separate from the conversational interface. Users cannot open a prompt box and directly ask the model to develop an exploit or alter the analysis behavior.

The model works in the background on code belonging to the organization and returns only a predefined output. According to Anthropic, this separation reduces the risk that advanced vulnerability research capabilities could be used to generate offensive code on demand.

The rationale is inherent to the technology. The skills needed to identify a complex flaw can be closely related to those required to build an exploit. Anthropic says Mythos 5 has the company’s most advanced cybersecurity capabilities and therefore considers direct, general-purpose access riskier.

Claude Fable 5 is reportedly based on the same underlying model but includes classifiers designed to route requests involving cybersecurity, biology, chemistry, and distillation away from Mythos. Mythos 5, by contrast, remains confined to the scanning function.

Who Can Benefit

The service is intended for Enterprise organizations that need to examine large or complex codebases, particularly those already using SAST tools in their CI pipelines.

The intended users include hospitals, essential-service providers, financial institutions, healthcare organizations, fintech companies, government contractors, critical infrastructure operators, software supply chains, and regulated organizations.

The model may help identify flaws that span multiple files or depend on change history—areas where rigid, pattern-based checks may have limited visibility. It does not replace existing tests, developer review, or risk management procedures.

Anthropic is also working with cybersecurity vendors to integrate Mythos 5 into their products. The partners have not been identified, and no technical details or timelines for these integrations have been provided.

Available Controls and Related Initiatives

Access is subject to several restrictions: an Enterprise plan, administrator enablement, connected GitHub repositories, and results presented in a structured format. Mythos 5 is not made available in other areas of the product.

Organizations can also reduce the scan scope, limit it to selected directories or services, and retain human control throughout the remediation cycle. Adopters should review findings, test proposed patches in controlled environments, and manually approve every change before deployment.

The same announcement introduces the Defender Advantage Fund, which provides $35 million in Claude credits to organizations working to protect open-source software.

Anthropic also plans to expand the Cyber Verification Program to Opus and Sonnet’s broader dual-use capabilities, with possible subsequent access to the Mythos class.

The CWE categories associated with the results refer to MITRE’s catalog of software and hardware weaknesses. The catalog contains 944 weaknesses and is available in version 4.20; however, the main CWE page does not confirm any specific integration with Claude Security or provide information about versions, workarounds, or indicators related to Mythos 5.

There is no indication that this initiative concerns a specific vulnerability, and no associated CVE identifiers have been reported. It is therefore not a flaw to patch or mitigate, but an analysis tool whose value will depend on the quality of its findings, human verification, and integration into existing security processes.