Security scans powered by Mythos 5, not Mythos access
Claude says Enterprise teams can run Mythos 5-powered code scans while receiving bounded findings and suggested fixes instead of direct model access.
Claude is widening access to its Mythos 5 cyber-defence capability, but the release is deliberately narrower than a new model picker. Claude says its Security scans are now in public beta for Claude Enterprise customers, with Mythos 5 operating behind the scan.
What emerges is a structured vulnerability finding: a standard weakness category, confidence, severity and a suggested fix. We can act on the result, but Claude says we do not get a general prompt surface for Mythos 5.
Why the guardrail matters
Claude’s safety argument rests on limiting the output, rather than handing over direct access to the model.
Claude’s argument is practical rather than abstract. Its article says the risk is lower when people receive specific defensive outputs, such as an alert or a patch for a vulnerability, instead of direct access to the underlying model.
That boundary matters because a capable security model can help inspect code without turning the beta into a general-purpose Mythos 5 release. The claim is Claude’s own safety rationale, not independent validation.
Available now, with more planned
The public beta is live for Enterprise customers; the wider programme remains a set of stated next steps.
The immediate availability claim is specific: Claude says Mythos 5-powered Security scans are in public beta for Claude Enterprise customers. Claude also says scans are billed as standard token usage under an existing plan, with no separate add-on.
The broader announcement should stay in its proper tense. Claude says it is working with partners on integrations, has announced a $35 million Defender Advantage Fund in Claude credits, and is expanding its Cyber Verification Program. Those are not evidence of a completed rollout or measured outcomes.
Structured findings, not direct access
The scan is designed to return a bounded security record rather than expose Mythos 5 itself.
The useful unit here is the finding. Claude says each result includes a CWE category—a standard label for a class of software weakness—alongside confidence, severity and a suggested fix.
That gives us something concrete to inspect and prioritise. It does not establish that every vulnerability will be found, nor does it turn a suggested fix into an approved change.
“The Mythos scan itself does not extend Mythos access to other surfaces. Every patch must be reviewed and approved by a human.”
Claude
The proof has limits
The available evidence is Claude-published material, so its capability and safety claims remain first-party statements.
Claude’s published material is clear about the intended workflow: Mythos 5 runs behind the scan, findings are returned, and patching continues in Claude Code using models the team already has available there.
What the announcement does not provide is independent testing, comparative security performance, adoption data or proof of patch outcomes. The release is evidence of a product boundary and a stated operating model; it is not a completed scorecard.
A scan with a human gate
Claude describes a flow that keeps the model in the background and the final decision with a person.
A team selects code for Claude Security to inspect. Mythos 5 runs in the background, then Claude says the scan returns structured findings rather than direct access to the model.
A suggested patch can open in Claude Code on the web, using models already available to the team there. Claude’s stated rule remains the critical final step: every patch needs human review and approval before implementation.
What we get from the scan
The first practical experience is a bounded security workflow, with standard-token billing and a human decision at the end.
Scan
We select code for a Mythos 5-powered Claude Security scan.
Review
We receive a CWE-tagged finding with confidence, severity and a suggested fix.
Approve
We decide whether a proposed patch should be implemented.
For an Enterprise team, the release is a way to bring Mythos 5 into vulnerability discovery without changing who owns the decision. Claude says scan usage is billed through the existing plan as standard tokens, rather than through a separate add-on.
The important distinction is between assistance and execution. We can use the finding and inspect a suggested patch, but Claude says the patch cannot proceed without human review and approval.
The model stays behind the result
Claude is offering access to a security outcome while withholding direct access to the model that produces it.
The release is less about opening Mythos 5 than about deciding which defensive results can safely leave the scan.
Altior analysis of Claude-published material
Claude’s release makes the access model the story. Enterprise teams can use a Mythos 5-powered security scan, but the model remains behind a constrained path that returns findings and suggested fixes.
That design preserves a useful human checkpoint. It also keeps the claims proportionate: Claude has described the workflow and its safeguards, while independent evidence of performance and real-world patch outcomes has not been supplied here.
Review a proposed security patch
Act as a senior application-security reviewer. Review this proposed patch for an SQL injection risk in a Node.js endpoint:
const query = `SELECT * FROM users WHERE email = '${req.query.email}'`;
author-proposed change:
const query = 'SELECT * FROM users WHERE email = ?';
db.query(query, [req.query.email]);
Return: 1) the CWE category, 2) a severity and confidence rating with one-sentence reasoning each, 3) any remaining attack path, and 4) a revised patch only if the proposed change is incomplete. Do not assume the patch is safe without explaining why.Ready to copyWatch the boundary hold
Track whether the Enterprise beta remains bounded as Claude develops partner integrations and its wider cyber-defence programme; the practical test is whether evidence keeps pace with the expansion.
Try the promptSignals worth watching
- Beta scope
- Partner rollout
- Programme expansion
- Outcome evidence