Anthropic is putting Claude Mythos 5 to work in cyber defense, but not by making the model broadly available. The company is using it inside security products where users see practical outputs such as vulnerability findings and suggested patches, rather than interacting with the model directly.
Claude Security now runs on Claude Mythos 5
The most direct change is inside Claude Security, Anthropic's security scanner. The tool scans codebases for vulnerabilities and suggests patches, and it is available in public beta for Enterprise customers.
Each scan is treated as normal token usage. That matters for teams evaluating the tool because security review becomes part of the same usage model they already need to track when working with Anthropic systems.
The scanner does not simply produce a vague warning. Each finding includes a CWE category, a severity rating, and a suggested fix. CWE is described in the source as a standard way to classify software flaws, which helps turn a model-generated finding into something closer to a conventional security review item.
Humans remain in the approval loop
Claude Security can suggest patches, but it does not remove human responsibility from the process. Every patch still requires human sign-off.
That boundary is important because the tool is operating in an area where mistakes can affect production systems, sensitive code, and operational risk. A suggested fix can speed up review, but the final decision remains with the people responsible for the codebase.
In practical terms, the workflow described by the source gives security and engineering teams a structured starting point:
- Scan a codebase for possible vulnerabilities.
- Review findings organized by CWE category.
- Consider the severity rating attached to each issue.
- Evaluate the suggested fix before approving any patch.
This makes Claude Security less like a fully autonomous repair system and more like an AI-assisted scanner that packages likely problems with remediation guidance.
Partner products are also getting Mythos 5
Anthropic is also connecting Claude Mythos 5 to partner security products. The source says those products protect hospitals, utilities, and banks.
In those deployments, end users do not work with Claude Mythos 5 directly. They see the security output, such as suggested patches, through the partner products they already use.
Several partners already use Claude Opus for security tools and are expected to move to Mythos 5. Security vendors can sign up for partnership access, which points to a controlled rollout rather than a general release.
That approach gives Anthropic a way to apply a more capable model to defensive tasks while keeping the interface mediated by security vendors and enterprise workflows.
Why access is limited
Claude Mythos is described as Anthropic's most capable model, especially for cyber tasks. That capability is also the reason it is not broadly available.
The rollout is framed around a specific goal: improving defenders' tools without handing attackers new AI-powered options. Instead of offering Claude Mythos 5 as a general-purpose system, Anthropic is placing it behind products designed for security scanning and remediation.
That creates a narrower path for deployment. Enterprise customers can use Claude Security in public beta, and security vendors can pursue partnership access. In both cases, the model is applied to cyber defense through controlled product surfaces.
What this means for security teams
For teams responsible for software security, the significance is not just that a stronger model is involved. It is that the model is being used to produce familiar review artifacts: vulnerability categories, severity ratings, and patch suggestions.
Those outputs fit into the way many teams already discuss and triage risk. A CWE category gives a shared label for the flaw. A severity rating helps prioritize attention. A suggested fix gives engineers a concrete proposal to inspect.
The key constraint remains the same across the rollout: people still approve the actual patches. Claude Mythos 5 may change how quickly issues are surfaced and how clearly fixes are proposed, but the source makes clear that final authority stays with human reviewers.