What happens when the same AI that helps security teams uncover software flaws can also autonomously validate vulnerabilities and complete multi-stage attack workflows?
Claude Mythos is Anthropic’s restricted frontier model for advanced coding, cybersecurity, and scientific research.
Its capabilities drew attention after Anthropic reported that Mythos Preview and roughly 50 Project Glasswing partners had identified more than 10,000 high- or critical-severity vulnerabilities (Source).
By May 22, 2026, 1,596 findings across 281 open-source projects had entered coordinated disclosure, with 97 already patched (Source).
Independent testing reinforced those concerns.
The UK AI Security Institute found that Mythos Preview completed a 32-step simulated corporate-network attack in 3 of 10 attempts and averaged 22 completed steps, well ahead of the next-best model in that evaluation (Source).
Anthropic has since introduced Claude Mythos 5, but access remains limited to vetted partners because the same capabilities that strengthen cyber defense could also accelerate misuse. This guide explains what Claude Mythos can do, how it compares with other Claude models, and the risks organizations must evaluate before adoption.
Claude Mythos is Anthropic’s restricted model family for advanced cybersecurity, coding, and scientific research. The current version, Claude Mythos 5, launched on June 9, 2026, as the successor to the invitation-only Claude Mythos Preview.
The model combines:
Mythos 5 shares its underlying capabilities, specifications, and pricing with the more broadly available Claude Fable 5. The main difference is how the models handle sensitive requests:
Because of this distinction, Claude Mythos is not designed as a general-purpose chatbot or everyday coding assistant. It is intended for approved organizations operating within controlled research and security environments.
Project Glasswing is Anthropic’s trusted-access program for applying frontier AI to the security of critical software and infrastructure. It provides qualified organizations with controlled access to Claude Mythos for defensive research.
The program initially included organizations such as AWS, Apple, Cisco, CrowdStrike, Google, Microsoft, NVIDIA, and the Linux Foundation. Organizations cannot access Claude Mythos 5 through a public signup or self-service portal. Access must be requested through an Anthropic, AWS, or Google Cloud account team and is granted only to organizations that meet Anthropic’s security requirements.
Claude Mythos can combine code analysis, reasoning, tool use, and execution to investigate complex software and security problems. Instead of only suggesting possible weaknesses, it can test its findings and produce evidence for expert review.
Claude Mythos can inspect source code for previously unknown vulnerabilities, including flaws that require contextual reasoning and active testing to confirm.
A vulnerability investigation may involve:
This process helps separate valid vulnerabilities from speculative observations. In Anthropic’s initial open-source review, independent security firms assessed 1,752 high- or critical-rated findings from Mythos Preview and confirmed 90.6% as valid vulnerabilities (Source).
Mythos can maintain context across files, components, tools, and repeated testing cycles. This allows it to investigate software systems that cannot be understood through a single prompt or isolated code snippet.
Its workflow may include:
These capabilities support investigations that require multiple rounds of analysis, experimentation, and validation.
After confirming a vulnerability, Mythos can create a controlled proof of concept for authorized testing. It can also analyze security patches, suggest code changes, and generate tests for verifying whether a fix works.
Anthropic reported that Mythos Preview autonomously produced eight working code-execution exploits from 18 recent Firefox security patches. Project Glasswing participants have also used the model to develop patches and perform pre-release security checks (Source).
Its outputs may include:
Generated exploits, patches, and remediation advice still require review by qualified security professionals before use or deployment.
Claude Mythos can investigate weaknesses in mathematical algorithms as well as software implementations.
In July 2026, Anthropic reported that Mythos Preview:
Neither finding affects currently deployed production systems. HAWK is not yet deployed, while the AES result applies to a reduced-round version rather than the full cipher. However, the research indicates that Mythos can contribute to cryptanalysis in addition to conventional vulnerability discovery (Source).
Claude Mythos 5 uses the API model ID claude-mythos-5. Its technical specifications and token pricing match Claude Fable 5, but access is limited to organizations approved through Project Glasswing.
The 30-day data-retention requirement is an important consideration for organizations handling proprietary code, internal architecture, regulated information, or other sensitive data. Claude Mythos 5 is not eligible for zero-data-retention arrangements, so security, privacy, and legal teams should review the applicable data-handling terms before adoption.
There is no public signup or standard API activation process. Eligible organizations must request access through their Anthropic, AWS, or Google Cloud account team and satisfy Project Glasswing’s approval requirements.
Claude Mythos 5 and Claude Fable 5 share the same underlying model, technical specifications, and pricing. The main difference is that Fable 5 applies additional classifiers to sensitive cybersecurity and biology requests, while Mythos 5 provides approved Project Glasswing researchers with access to capabilities those classifiers may block.
Note on Fable 5 availability: Fable 5 and Mythos 5 were temporarily suspended on June 12, 2026, after U.S. export controls were introduced following concerns about bypassing Fable’s safeguards. The controls were lifted on June 30, and Fable 5 was redeployed globally on July 1 with an updated classifier. Mythos 5 was also restored, but access remained limited to approved Project Glasswing organizations (Source).
The right model depends on the workload, access requirements, and level of security control needed:
For most development teams, Claude Opus 5 is the most practical option because it is generally available and costs less per token than Fable 5 or Mythos 5.
Claude Mythos can accelerate defensive security research, but its autonomy and access to sensitive tools pose risks that organizations must manage before deployment.
Mythos can identify vulnerabilities, validate exploitability, generate proofs of concept, and support multi-stage investigations. These capabilities can help defenders secure software, but they could also be misused to discover or exploit weaknesses.
Anthropic restricts Mythos access because current safeguards may not reliably distinguish every legitimate defensive request from a harmful one. Organizations must therefore ensure that the model is used only by authorized teams for approved purposes.
The risk increases when Mythos can execute code, access networks, use credentials, or modify repositories without continuous human review.
Organizations should apply controls such as:
These safeguards help limit the impact of incorrect decisions, unintended actions, or compromised workflows.
Anthropic reported that Project Glasswing’s main bottleneck shifted from discovering vulnerabilities to processing the volume of findings produced by AI systems.
Security teams still need to:
Without an effective triage process, faster discovery can create a larger remediation backlog rather than immediately improving security.
Claude Mythos does not support zero-data-retention arrangements, making data handling an important enterprise concern. Organizations should assess whether workflows may expose:
Long-running investigations can also create substantial token costs and require secure infrastructure for code execution, monitoring, and expert review. Organizations should examine the platform's retention and processing terms through which Mythos is accessed.
The UK AI Security Institute reported that Mythos Preview completed a 32-step simulated corporate-network attack in three of ten attempts and averaged 22 completed steps. However, the evaluation did not include several protections commonly found in secured production environments, such as active defenders, endpoint controls, and monitoring systems.
The results demonstrate advanced autonomous capability, but they do not prove that Mythos can compromise every hardened enterprise network. Organizations should treat benchmark results as evidence of potential capability, not as a direct prediction of real-world attack success.
Claude Mythos should be deployed as a supervised security-research system, not as an autonomous replacement for security engineers.
Claude Mythos shows how frontier AI can move cybersecurity beyond static code review toward continuous vulnerability discovery, validation, and remediation. Its ability to investigate large codebases and carry out long-running workflows could help defenders identify weaknesses faster, but the same capabilities also create serious misuse, privacy, and governance risks.
Restricted access through Project Glasswing reflects the difficulty of balancing defensive value with potential harm. For enterprises, the key issue is not only whether Claude Mythos is capable, but whether it can be used within secure infrastructure, clear permission boundaries, and reliable human oversight.
Mythos is unlikely to replace security professionals. Instead, it signals a future where human experts supervise increasingly autonomous AI systems while remaining responsible for validation, prioritization, and final security decisions.
No. Claude Mythos 5 is available only to organizations approved through Project Glasswing. Individual developers and standard API customers cannot access it through a public signup or self-service console.
Claude Mythos can discover vulnerabilities, validate exploits, execute code, and complete multi-stage cybersecurity workflows. These capabilities can support defenders, but they could also be misused to identify and exploit weaknesses.
Organizations must request access through their Anthropic, AWS, or Google Cloud account team. Anthropic then evaluates whether the organization and proposed use case meet Project Glasswing’s security requirements.
You can use Claude Mythos only if your organization has been approved for Project Glasswing. Most developers cannot access it directly and may use Claude Fable 5 or Claude Opus 5 instead.
Enterprises can reduce risk by using isolated environments, restricting network and tool permissions, logging agent activity, and requiring human approval for sensitive actions. They must also assess the model’s data-retention requirements before submitting sensitive information.
Claude Mythos 5 costs $10 per million input tokens and $50 per million output tokens. Prompt-cache hits cost $1 per million tokens. Paying the usage fees does not guarantee access because organizations must first receive Project Glasswing approval.
