Anthropic has put Mythos 5 — the model it restricts most tightly — to work scanning customer code, without letting anyone talk to it.

That sentence is the whole design, and it is worth taking seriously rather than reading as marketing.

What was announced

Claude Security, in public beta for Claude Enterprise customers, now runs its scans on Mythos 5. The scan connects to a GitHub repository, traces data flows across files, and returns each finding with a CWE category, confidence and severity ratings, and a suggested patch. A human approves before anything is deployed. It is billed as ordinary token usage rather than a separate product.

Customers do not interact with Mythos 5. Access runs through purpose-built security interfaces that return defined outputs — patches, alerts — and nothing else.

Alongside it: the Defender Advantage Fund, $35 million in Claude credits for organisations helping open-source maintainers secure their projects. Grants target patching live vulnerabilities, building scanning and patching processes other projects can reuse, and approaches that make a project resistant to whole classes of attack. Anthropic says it is beginning with selected pilot grants and will name recipients later.

The company has previously put $4 million into direct donations and support through Project Glasswing.

The disclosure

This piece was researched and written with an Anthropic model, about an Anthropic announcement. That is a conflict and we handle it the way we handled the Claude outage in this same week: every fact here comes from published material, there is no inside knowledge in it, and the questions we would ask any other vendor are asked below.

The asymmetry bet

The interesting claim is structural. If a model is good enough at finding vulnerabilities to be genuinely dangerous released, but its findings can be handed to defenders safely, then you can give away the output of a capability you will not give away.

That is a real distinction, and it may well hold. A CWE-tagged finding with a suggested patch tells an attacker nothing they could not learn by reading the patch once it ships. The model that produced it, in an attacker's hands, is a general-purpose discovery engine pointed at everyone else's code.

It is also a bet on one thing being true: that Anthropic reaches each codebase first. Broadcom pointed AI at Spring and took the count from 16 disclosed vulnerabilities in 2025 to over 200 this year. Anthropic's own agent swarm surfaced 266 vulnerabilities across 15 open-source projects. Every one of those is a bug now fixed rather than available — but only because a defender got there first.

The advantage is not in the model existing. It is in the order of arrival. And a command-and-control framework with a natural-language front end already sells for $99.99, which is the other side of the same race.

Why credits and not money

$35 million in Claude credits is not $35 million.

That is not an accusation — credits are the natural unit when the thing you are funding is model usage, and a maintainer who needs scanning needs tokens more than they need a cheque. It is also, plainly, a structure where the cost to the provider is marginal compute and the benefit is adoption. Both readings are true at once, and the honest position is to say so rather than pick one.

The harder question for open-source maintainers is what happens when credits run out. A project that has restructured its security process around a scanning tool it did not pay for has a dependency, and the fund's own framing — build processes other projects can reuse — suggests Anthropic knows it. Whether the grants produce portable practice or vendor lock-in will not be visible for a year.

The other half: fewer safeguards for vetted defenders

Less discussed and arguably more consequential: the Cyber Verification Program is expanding. Vetted organisations already operating with reduced safeguards on Claude Opus and Sonnet get broader dual-use capabilities, including vulnerability triaging and validation, with Mythos-class access to follow.

So there is a path to the model itself. It runs through a vetting process, and the question that decides whether this is a defender advantage or a new gatekeeper is who passes it. A national CERT will. A two-person team maintaining a library that half the internet imports may not.

What is not established

  • How many vulnerabilities Claude Security has found. No figures released.
  • Who receives the fund's grants. Recipients are to be named later.
  • The rollout timeline for Mythos-class access under the verification programme.
  • The false-positive rate. Findings carry a confidence rating; no accuracy data has been published, and at scan volume that number decides whether this saves maintainers time or costs it.
  • What vetting requires. The criteria for the Cyber Verification Program are not public.