Anthropic is putting its most capable model to work on the defensive side of cybersecurity, running its Claude Security tool on Claude Mythos 5 to scan codebases for vulnerabilities and suggest patches. The feature is in public beta for Enterprise customers, and every scan counts as normal token usage — no premium pricing, just standard consumption. Each finding comes with a CWE category, severity ratings, and a proposed fix. But the human element isn’t going anywhere: developers still have to approve every patch before it lands.
That manual sign-off matters. Anthropic has been explicit that Mythos 5 is its strongest model for cyber tasks, and that’s precisely why it hasn’t been broadly released. Throwing the same capability at attackers would be a gift. Instead, the company is channeling it toward defenders — customers protecting hospitals, utilities, and banks through partner security products. End users of those tools never touch the model directly; they just see suggested patches and other outputs. Several partners already run Claude Opus for security work and are expected to migrate to Mythos 5.
The restraint is notable. Most AI vendors race to ship their flagship models everywhere, but Anthropic is effectively saying: this one is too good at offense to hand out freely. It’s a calculated bet that defensive security tooling can justify the compute cost of a frontier model without creating a new attack surface. Whether that calculus holds will depend on how well Claude Security actually performs in production codebases — not demos, not benchmarks, but messy, real-world repos where vulnerabilities hide in legacy code and undocumented dependencies.
For security vendors, Anthropic has opened a partnership pipeline to integrate Mythos 5 into their products. That’s where the scale play is: rather than selling to every SOC team directly, Anthropic rides the distribution of established security platforms. The question nobody can answer yet is whether a model genuinely better at finding and exploiting vulnerabilities will also prove better at fixing them — or whether defenders will simply get faster, more confident suggestions that still require human judgment to act on.
