Anthropic expands Claude Mythos 5 for cyber defense

Anthropic is walking a tightrope with frontier AI: the smarter models get at finding bugs, the better they are at writing exploits.

The company laid out its playbook to give defenders the upper hand. Anthropic announced it is opening up Claude Mythos 5—its high-end frontier model—to more defensive teams, rolling it directly into enterprise security scans, and setting up a $35 million grant fund for open-source software security.

Lock the model in the trunk, ship only the patches

The dual-use problem in cybersecurity is simple: direct model access can be easily hijacked to generate weaponized exploits. Anthropic’s solution is to turn Mythos into an invisible backend engine.

Instead of letting users chat directly with Mythos 5, the model is now piped into specialized interfaces. In Claude Security—now in public beta for Claude Enterprise customers—admins can point Mythos 5 at their private code repositories. The model scans the codebase, labels issues with CWE categories, assigns severity ratings, and spits out concrete remediation patches.

Every fix still requires a human engineer to review and approve it before implementation in Claude Code. Customers are billed at standard token rates on their existing enterprise plans without paying for a separate add-on. Anthropic is also working with cybersecurity partners to embed Mythos 5 into third-party security operations and incident response tools.

$35M in credits for vulnerable open-source projects

Critical infrastructure rarely breaks at the enterprise layer; it usually snaps at an unmaintained open-source library maintained by a couple of burnt-out volunteers.

Anthropic is launching the Defender Advantage Fund (0xDAF), a $35 million credit pool for organizations securing open-source software. Grants focus on three specific tasks: patching active flaws in widely used projects, automating reproducible scan-and-patch pipelines, and building architectural defenses against entire vulnerability classes.

On top of that, Anthropic is expanding its Cyber Verification Program. The program already gives vetted, legitimate defensive teams reduced safety guardrails on Opus and Sonnet models. Over the coming weeks, Anthropic will expand those permissions and begin rolling out Mythos-level access for verified defenders.

Why it matters

Cybersecurity in the AI era is fundamentally an asymmetric race: defenders have to patch every hole, while attackers only need to find one.

For enterprise engineering teams, bringing Mythos 5 into automated vulnerability scanning is an immediate operational win. Having frontier-level models identify code flaws and draft patches drastically cuts down triage overhead, provided companies keep experienced engineers in the loop to review the output.

We think Anthropic’s delivery mechanism is particularly clever. By restricting Mythos 5 to structured, single-purpose pipelines—outputting remediation patches rather than raw interactive completions—Anthropic effectively blunts the offensive risk while delivering the defensive value.

The $35 million open-source fund also doubles as a smart strategic move. It strengthens fragile digital infrastructure while anchoring the next generation of automated open-source security workflows directly around the Claude ecosystem.