Anthropic’s advanced AI model has signaled a seismic shift for the cybersecurity community. Here’s what to know about the technology and its perceived impact on security strategies.
What is Claude Mythos?
Claude Mythos is an advanced AI model developed by Anthropic and is optimized for cybersecurity and healthcare applications.
Mythos 5 was originally released in April to a small group of vetted technology partners ahead of a planned wider rollout.
Anthropic established Project Glasswing, a consortium that gives limited, controlled access to Mythos to infrastructure providers, open-source developers, and major technology companies. The scheme was designed to enable defenders to find and resolve vulnerabilities faster than they could be identified by attackers, many of which are also beginning to rely heavily on AI tools.
What are the capabilities of Claude Mythos?
The 50 initial partners of Project Glasswing were able to use Mythos to find more than 10,000 high- or critical-severity vulnerabilities in every major operating system and every major web browser.
The model is identifying security flaws that had evaded even the most capable security researchers for years, such as a 27-year-old bug in OpenBSD. It has also proved capable of chaining multiple vulnerabilities together.
How is Anthropic restricting access to Claude Mythos?
Anthropic said it was restricting the more widespread availability of the frontier AI model because its capabilities might easily be misused by attackers.
In June the technology was released to an additional 150 organizations. All Mythos partners are required to accept a 30-day data retention policy for safety monitoring.
After the availability of Mythos forced the Trump administration to reconsider its “hands off” approach to AI oversight, the US government applied export controls to Claude Fable 5 and Claude Mythos 5 on June 15. The restrictions — which were supposed to block access to foreign nationals both inside and outside the US — were lifted on June 30.
What is Claude Fable?
For broader use, Anthropic is offering Claude Fable 5, which is based on the same underlying technology but comes with strict guardrails that limit operations in “risky” cybersecurity domains. Flagged queries are automatically routed to the earlier and less capable Opus 4.8 large language model (LLM) instead.
How are Anthropic’s security vendor partners using access to Mythos?
Cisco, one of Anthropic’s Project Glasswing partners, open-sourced its Foundry Security Spec, a model-agnostic “harness” for security testing, so that other vendors and enterprise security defenders could build similar workflows without starting from scratch.
During a recent web conference, representatives from Cisco argued that defenders can use AI to identify, confirm, and resolve security issues at much greater speed and scale. Older vulnerability remediation models based on “find one issue, patch one issue” are no longer adequate because attackers are using AI moving to accelerate the path from vulnerability discovery to exploitation.
Cisco has been using AI internally to scan 1.8 billion lines of code across its whole product portfolio.
Smaller businesses do not need access to restricted AI models to improve security and more can be achieved in smaller shops by improving security fundamentals such as authentication, segmentation, zero trust, and prioritizing the remediation of actively exploited vulnerabilities, according to Cisco.
Do other AI vendors offer anything comparable to Claude Mythos?
Mythos is the most prominent example of frontier AI models that can automate zero-day discovery at a scale and speed far beyond the capability of human teams.
Several other vendors have frontier AI models aimed towards high-capability, security-oriented operations while others have capable open models that might easily be applied to cybersecurity research.
As a result, Claude Mythos is far from the only game in town.
For example, OpenAI’s GPT-5.4-Cyber (and GPT-5.5) has applications in vulnerability analysis and discovery as well as malware analysis and threat modelling. Security vendors, enterprises, and researchers can gain access to the technology through OpenAI’s Trusted Access for Cyber (TAC) scheme.
Chinese cybersecurity firm 360 Security Technology has developed Tulongfeng, described as a domestic answer to Anthropic’s Mythos.
High performance open models — including DeepSeek V3.2 and Llama 4 — can be run privately on GPU infrastructure and applied to cybersecurity research. Fugu from Japanese vendor Sakana AI offers another option in this category.
What do cybersecurity critics say about Claude Mythos?
Infosecurity critics note that while Claude Mythos is unquestionably advanced, marketing claims that it is reliably breaking production systems overstate its capabilities.
Security professionals are complaining through podcasts and elsewhere about the overly sensitive guardrails in Claude Fable that downgrade to Opus 4.8 upon requests to summarize a security-related blog post or even spell the word “exploit” much less tackle any everyday information security task.
Other experts warn that false positives are likely to be an issue for cybersecurity research using frontier AI models.
The wider criticism is that finding more vulnerabilities faster fails to address the bigger problem of reliability fixing security bugs or non-technical attack paths such as social engineering.
How should enterprise CISOs respond to the development of Mythos?
Western intelligence agencies that form the Fives Eyes alliance issued a statement warning that frontier AI models such as Claude Mythos are “fundamentally transforming both offensive and defensive cyber capabilities” in a scale of months rather than years.
“While Al will help us improve cyber defence over time, it also accelerates the speed, scale, and sophistication of cyber threats,” the group, which includes the US National Security Agency and the UK’s National Cyber Security Centre, warns.
Enterprises need to be using AI to strengthen defenses as part of broader plans to improve cybersecurity resilience.
AI-based systems capable of mapping realistic attack paths faster than any human adversary are fast becoming a pervasive threat, while most organizations are nowhere near ready for what that means for their threat models, one expert warns.
“We now have AI systems that can map realistic attack paths across software, vendors, and critical infrastructure faster than human adversaries can catalog them,” says Joe Hubback, partner and CISO at consultancy Elixirr and former McKinsey Partner. “And as Mythos-class capabilities are prepared for broad commercial release, that’s no longer a niche research problem, it’s something every organization will have to factor into its threat model.”
An AI safety paper from the Cloud Security Alliance warns that AI has significantly compressed the time between vulnerability discovery and exploitation, outpacing traditional patch-and-react security models. Organizations should brace for ongoing waves of AI-discovered vulnerabilities from Project Glasswing and other sources.
“The capabilities seen in Mythos will quickly become more widely available, dramatically increasing the number and frequency of complex, novel attacks organizations will face,” it warns.
Enterprise security defenders need to shift to a “Mythos-ready” approach built around continuous vulnerability operations, faster prioritization, and improved incident response.
See also: