Claude Security on Mythos 5: You Get the Findings, Not the Model

Anthropic put its most capable cyber model, Claude Mythos 5, behind a scanner instead of handing you the model. That is the product. Claude Security now runs scans for Enterprise customers in public beta. You get a finding list. You do not get a chat box with Mythos 5.

That split is the point, not a footnote.

What it actually does

On August 21, 2026, Anthropic announced Claude Security scans now run on Mythos 5 (announcement). An organization owner turns it on under Organization settings, then Claude Security (help center). From claude.ai/security you pick a GitHub repository. Official docs say GitHub.com or GitHub Enterprise Server only. Other hosts are not supported today.

You can narrow the scan to a directory or branch. Anthropic's getting-started guide says to pick a directory on a large repo so the scan is more likely to finish. A run can take minutes or hours depending on the repo (getting started).

The scanner traces data across files. In plain English: it follows how a value moves from an input to a database call, instead of grepping one file at a time. Each finding comes back with a CWE category (Common Weakness Enumeration—a shared ID for bug types like SQL injection or XSS), confidence and severity ratings, and a suggested fix. Severity is about exploitability in your codebase, not a generic score for the category.

You can open the fix in Claude Code on the web. That patching step uses whatever models your org already has in Claude Code. The Mythos scan does not unlock Mythos anywhere else. Every patch still needs a human to review and approve it before it lands. Anthropic is explicit about that.

Billing: scans are charged at direct token cost only, no extra platform fee. Extra Usage has to be on, costs scale with scan size and frequency, and you should set a spend limit. Users who run scans need a premium seat.

What this is not

This is not a generally available Mythos 5 API. Anthropic's stated reason is blunt. Direct model access is where someone can steer it toward building exploits. A scanner that only returns a patch or an alert is a smaller door. Treat that as a design choice, not a slogan.

It is also not a signed-off replacement for the SAST tool you already run (SAST meaning a scanner that looks at source without executing it). Anthropic says scans are stochastic: the agent can take a different path each run because it is reasoning over context instead of applying a fixed pattern list. They say that is how they catch logic-level issues traditional matchers miss. That is their claim. Treat a first run like a new signal. Dismissed findings will not come back on later scans.

If your source of truth is not GitHub.com or GHES, you cannot run this today. You also only scan code you own—not third-party or random open-source repos outside your company's codebase.

What to actually do

If you are on Claude Enterprise and the repo is on GitHub or GHES: enable it, pick one repo or one directory, run a Standard scan first, and read the findings with the same suspicion you would give any new scanner. There is an Extended effort option for a deeper pass. Export CSV or Markdown if you need a paper trail. Per-project webhooks exist if you want scan-complete events in your own tracker.

Then ask the question the settings page will not ask for you. Who owns the backlog, and what happens when the suggested patch is wrong.

Chris's take

I've worked with these scan results firsthand. I think this is great, ridiculously informative, and for the most part legit findings. Being able to add context is a big part of what makes it useful, but it's not perfect. Unlike SAST tools, you may not get the same result each time, and that can be frustrating.

• https://claude.com/blog/bringing-claude-mythos-5-to-more-defenders
• https://support.claude.com/en/articles/14661296-use-claude-security
• https://claude.com/resources/tutorials/getting-started-with-claude-security