Anthropic is putting $35 million behind open-source vulnerability work and, in the same breath, retiring one of its stricter access policies. Mythos 5 — the frontier model the company held back from public release on the grounds that it was too capable in high-risk domains — reached Claude Enterprise subscribers on Friday through Claude Security, its vulnerability scanner, which stays in public beta. A third announcement widens the vetting programme that strips safety blocks from professional defenders.
Mythos 5 has spent its life behind a velvet rope. Anthropic never released it. June's Fable 5 served as the public stand-in, built on the same capability but fenced off from dual-use cyber work. Mythos stayed inside Project Glasswing, which launched in April. Roughly 150 organisations were admitted. The premise was timing — give defenders a window to find and fix flaws before models of comparable strength became widely available.
The interface, not the model, is what changed
The reasoning behind Friday's expansion has nothing to do with the model becoming safer. It has to do with what sits between the model and the person using it. Anthropic argues that danger concentrates at the prompt, where a determined user can push a system toward writing an exploit. Strip out the prompt and hand back only a finished artifact — a patch, an alert — and there is very little left to steer.
That principle also shapes the partner programme. Security vendors are being lined up to run Mythos 5 underneath triage, threat intelligence and remediation products, where the customer never touches the model.
How a scan runs
The workflow itself is unremarkable. An administrator switches Claude Security on in the admin console. A developer opens claude.ai/security and picks a repository. Findings come back with a CWE classification, confidence and severity ratings, and a proposed fix attached to each one.
Patching happens elsewhere, in Claude Code on the web, using whatever models the organisation already pays for. A human has to approve every change. There is no separate add-on charge; scans draw on existing token budgets at $10 per million input tokens and $50 per million output.
Three words doing a lot of work
One phrase in Anthropic's description carries an enormous load: code you own. The New Stack flagged how quickly that boundary dissolves. Enterprise repositories are stuffed with open-source dependencies. Clone a popular library into a company repo, scan it, and the resulting report describes weaknesses that exist wherever that library ships. It is, functionally, the document an attacker would pay for. Anthropic says abuse-prevention measures keep the model within its intended scope.
Credits for maintainers
The Defender Advantage Fund, written 0xDAF, succeeds a smaller effort. Glasswing produced $4 million in direct donations plus support for coordinated fixing campaigns. The new $35 million is denominated in Claude credits rather than cash. Grants target three areas: patching live vulnerabilities in heavily depended-upon projects, automating scan-and-patch pipelines that others can copy, and structural work that eliminates whole classes of bug. A few large pilots go first, with names expected within weeks.
The Cyber Verification Program is loosening in parallel. Vetted teams already hit fewer refusals on Opus and Sonnet. That will extend to broader dual-use tasks, with triage and validation reaching Mythos-class models and fuller Mythos access to follow. Glasswing carries on separately, working with US government partners on infrastructure operators that clear strict security controls. Whether a findings-only interface holds as a durable safety boundary is the question the next year will answer.
