Mythos 5 Goes to Work Inside Claude Security
Claude Mythos 5 — the cyber-capable model Anthropic has kept locked to vetted defenders since April — is now running vulnerability scans in Claude Security for Enterprise customers. Admins turn it on in the console; from claude.ai/security a user picks a repository and the model scans the codebase. Findings come back with a CWE category, confidence and severity ratings, and a suggested fix. Patching happens in Claude Code on the web, and every patch must be reviewed and approved by a human before it lands.
The billing detail is the one most teams will care about: scans are charged as standard token usage under existing plans, with no separate add-on SKU. Claude Security itself remains in public beta for Enterprise.
The scoping is the actual news. Running a Mythos 5 scan does not extend Mythos access anywhere else — interactive patching uses whatever models your org already has in Claude Code. Anthropic’s stated reasoning is that the risk concentrates where a user can prompt the model directly and steer it toward offensive work; when the user only receives a specific artifact — a patch, an alert — that risk drops sharply. So the expansion widens access to results while the model stays behind glass.
The Defender Advantage Fund Puts $35M Behind Open-Source Security
The same announcement created the Defender Advantage Fund (0xDAF), which will distribute $35 million in Claude credits to organizations securing open-source software. The stated criteria are specific rather than vague goodwill: patching live vulnerabilities in widely used projects, automating scanning and patching in ways other projects can copy, and approaches that make a project resistant to whole classes of attack rather than one bug at a time. It starts with a small number of larger pilot grants while Anthropic learns what scales; initial recipients get named in the coming weeks.
Stack it against what came before and the shape is clear. Project Glasswing, launched April 7 with AWS, Microsoft, Google, CrowdStrike and the Linux Foundation, carried up to $100 million in usage credits plus $4 million in direct donations — $2.5M to Alpha-Omega and OpenSSF via the Linux Foundation, $1.5M to the Apache Software Foundation. More than 40 additional organizations were added beyond the 12 launch partners. The new fund also backs coordinated fixing efforts like Akrites and the White House’s Gold Eagle initiative. Credits, not cash — which is both a real subsidy and a distribution strategy.
The Cyber Verification Program Is About to Get Wider
Third piece of the announcement, and the one with a date attached: over the coming weeks the Cyber Verification Program expands. Today it gives vetted organizations reduced safeguards on Claude Opus and Sonnet. Next: defensive capabilities like vulnerability triaging and validation move to Mythos-class models, and enrolled defenders see fewer blocks on Opus and Sonnet for broader dual-use work. Organizations already accepted need take no action — Anthropic says it will reach out.
Also queued: a partner integration track. Security vendors can build Mythos 5 into products defenders already run, under a strict pattern — the end user never prompts the model, a purpose-built interface runs it in the background for a defined task and returns only the intended artifact. Vendors can register interest now. And Anthropic says it is widening Mythos access through Glasswing with U.S. government partners, aimed at critical-infrastructure operators that meet strict security control requirements. One standing caveat for anyone joining: traffic on Mythos-class models carries a 30-day retention requirement, which Anthropic says is for safety purposes and not training.
2.1.240 and 2.1.241: Two Quiet Days in a Row
Claude Code shipped 2.1.240 on Saturday and 2.1.241 today, both with the same one-line changelog: bug fixes and reliability improvements. After 2.1.239 landed 59 changes on Thursday, two consecutive housekeeping releases is the normal shape of a weekend — and a reasonable moment to actually upgrade, since you are getting stabilization on top of a large drop rather than a new surface to learn.
If you skipped the big one, the two lines still worth your attention are the Bedrock streaming fix (proxies stripping Content-Type were silently doubling billed API calls by re-running every turn non-streaming) and cross-session messaging on Windows, which brings SendMessage and ListAgents to parity with macOS and Linux. Run claude --version to see where you actually are.
Scan in One Product, Patch in Another — On Purpose
Worth pulling out of the security news as a developer-workflow item, because it is a pattern you will see copied. The Mythos 5 scan runs in Claude Security and returns structured findings — CWE class, confidence, severity, suggested fix. The remediation then happens in Claude Code on the web, using whatever models your organization already has. Two products, two model tiers, one handoff, with a human approval gate in the middle.
That split is deliberate. The high-capability model produces an artifact and never touches your prompt loop; the model you already trust does the interactive work. If you are designing an agent pipeline around a capability you would rather not expose directly — internal data access, a privileged tool, an expensive model — this is a clean template: constrain the powerful step to a defined task with a defined output, then hand the output to the general-purpose surface. It also means your audit trail has a natural seam in it.
Anthropic Reportedly Hires the Founder of Google’s TPU Program
Bloomberg’s Dina Bass reported that Anthropic hired Amir Salek for its compute team as the company works toward custom AI silicon. Salek founded and led Custom Silicon at Google from 2013 to 2022, directing the design and deployment of TPUv1 through TPUv4 and Edge TPU — the first several generations of the program. Before that he spent roughly eight years at Nvidia, where he founded its SoC design organization. He was most recently a senior managing director at Cerberus Capital Management.
Read it against the rest of the summer and it is chapter three, not a one-off. August 5: TechCrunch reports Anthropic is hiring an in-house chip design team, quoting the company’s own line that relying on others “clearly isn’t enough” despite AWS, Google, Nvidia and AMD deals. Now: that team gets a leader who has already shipped this exact category of product, at the closest comparable scale that exists. Sourcing caveat: this is Bloomberg reporting with wire pickups — no Anthropic press release, no confirmed title or start date. And the practical timeline is long. First-generation custom accelerators run 18–24 months minimum from hire to racks; nothing about your token bill changes this quarter.
What the Defender Ecosystem Actually Looks Like in Production
The partner figures underneath the Mythos news are company-reported rather than independently measured, but they describe the shape of the market better than any benchmark. Wiz says its Opus-powered offensive-testing agent runs continuously across more than 150,000 production assets a week. Accenture says it moved security testing coverage from roughly 10% to over 80% across 1,600 applications, cutting scan turnaround from 3–5 days to under an hour. Palo Alto Networks and CrowdStrike are building on the same stack.
The Glasswing bug haul is the more visceral number. Anthropic said Mythos Preview found thousands of high-severity vulnerabilities, including a 27-year-old remotely triggerable flaw in OpenBSD, a 16-year-old bug in an FFmpeg line that automated testing had hit five million times without catching, and a chained Linux kernel privilege escalation. All three were reported to maintainers and patched before disclosure. On CyberGym vulnerability reproduction, Anthropic measured Mythos Preview at 83.1% against Opus 4.6’s 66.6% — its own benchmark, its own scoring, but a wide enough gap to explain why the model was gated in the first place.
The S-1 Math, Now That the Bank Lineup Is Set
With the underwriter news out of the way, the numbers are the story. Anthropic confidentially filed its draft S-1 with the SEC on June 1. Reporting points to a public filing as soon as the end of this month, an October Nasdaq debut, and an offering expected to raise more than $60 billion — which would put it at or above SpaceX’s record June raise. The last private mark was $965 billion from the May Series H-1.
Two things to hold onto. First, no public prospectus has appeared in EDGAR yet, so the detailed financials remain unavailable — everything circulating is reporting, not filing. Second, the revenue figures being quoted have moved fast: roughly $30 billion annualized in April, with run-rate reported to have crossed $47 billion during May. When the S-1 does go public, that curve is the number the market will price, and it will be the first time anyone outside the company can check it.
Anthropic Just Published Its Playbook for Shipping a Dangerous Capability
Strip the security announcement of its specifics and what is left is a method. A model too capable to hand out gets released anyway — not by loosening the safeguards, but by removing the user’s ability to prompt it. You do not get Mythos 5. You get a scan result. The interface is the safeguard.
Four stages, each one widening the blast radius by a measured amount. April: Glasswing, twelve partners, direct access, $100M in credits, a coalition that includes the Linux Foundation so the findings have somewhere to land. June: split the model — Fable 5 routes cyber queries to a weaker model for everyone, Mythos 5 keeps the safeguards off for the vetted, and the price drops by more than half. August: productize it, so any Enterprise customer gets the outputs through a fixed workflow with a human approval gate. Next: partners embed it invisibly, and government critical-infrastructure operators get in. At no point does the population with direct model access grow much. The population benefiting from it grows enormously.
Whether that is genuine safety engineering or a well-narrated go-to-market is the interesting question, and the honest answer is that it does not have to be one or the other. The commercial logic is excellent: a capability nobody else will ship becomes a product only you can sell, the gating is the moat, and the $35 million in credits seeds an ecosystem of maintainers who will be running your scans on the packages everyone else depends on. The safety logic is also real — the 27-year-old OpenBSD bug is exactly the argument for putting this class of model in defenders’ hands before it reaches anyone else’s.
The part worth watching is the asymmetry nobody has resolved. Anthropic can gate its own model. It cannot gate the capability. A staged rollout buys defenders a head start measured in months, on a class of tooling that will not stay exclusive. Everything announced yesterday — the fund, the partner track, the government push — reads like a company that knows exactly how long that head start is and is spending it as fast as it can.