For a long time Mythos was the model people only mentioned in a whisper. Too strong, too touchy, accidentally leaked back in spring, and a fixture in the headlines about AI and cybersecurity ever since. Now Anthropic takes the next step and lets defenders in — but only to the output, not to the model itself.
The trick: access the result, not the model
The heart of the announcement is a simple distinction. Things get dangerous when someone can talk to the model directly and steer it toward an attack. If a user only receives a finished result — a patch, a security alert — the risk drops sharply.
That’s exactly what the new setup is built on. Claude Security now runs on Claude Mythos 5. Enterprise customers can use it to scan their codebase: Claude finds vulnerabilities, assigns each one a CWE category, gives a confidence and severity rating, and suggests a fix. Mythos does the scan itself, but nobody can ask the model on the side to whip up an exploit. Every patch has to be reviewed and approved by a human.
It’s billed as standard token usage under your existing plan, no separate add-on. If you want to implement the fix, you open Claude Code on the web and work there with the models your organization already has.
35 million for open source
The second part is a fund. The Defender Advantage Fund — 0xDAF internally — provides 35 million dollars in Claude credits for organizations working to secure open-source software. The money is meant to flow in three directions: patching live holes in widely used projects, automating scanning and patching, and hardening projects against whole classes of attack.
The backdrop is well known and uncomfortable. A large share of the software the world runs on is maintained by volunteers who have neither the time nor the people for a serious defense. Anthropic starts with a few larger pilot grants to see what scales.
On top of that comes an expansion of the Cyber Verification Program: vetted defenders should see fewer blocks on Opus and Sonnet, with Mythos access to follow.
My take
What I like here is the honesty about the dilemma. A model that finds vulnerabilities finds them for both sides. Anthropic doesn’t pretend that’s solved — the answer is a detour: you get the patch, but not the keyboard to the model. Whether that detour holds up over time remains to be seen. But it’s a thought-through compromise rather than a blanket no or a careless yes.
The fund is the second half of the story, and to me almost the more important one. Putting frontier models in the hands of big companies is one thing. Helping the understaffed open-source maintainers whose code ends up running inside those very companies is another — and that’s been the real weak spot for years.
Sources: