Anthropic built a wall around Claude Mythos 5, its most capable cybersecurity model, then pushed the results through cracks it controls. The model now scans code inside Claude Security and inside partner defensive tools, but the humans on the other end never get to type a prompt to it. They get a finding.

That distinction is the actual policy here, not a marketing line. A security engineer using a partner product sees a suggested patch, a severity rating, or an alert. They cannot ask Mythos 5 to write a proof-of-concept exploit, because they never reach a prompt box in the first place. Anthropic has separated the model’s judgment from the model’s cooperation.

The mechanics are straightforward for now. Enterprise customers point Mythos 5 at a repository and receive findings labeled with a CWE category, a confidence score, and a proposed fix, billed like any other token usage rather than a separate product line. A person still has to review and approve every patch before it ships, so the model recommends and a human decides.

This output-gating approach is worth naming precisely, because it differs from an ordinary usage policy. A usage policy restricts what a user can ask for and hopes enforcement holds. Output gating removes the asking entirely: there is no interface where a defender can request an exploit, so no policy violation is possible to begin with. That is a stronger control than most AI safety teams have shipped into a commercial product.

It carries a real cost, though. A defender who receives a patch recommendation but cannot interrogate the model has no way to ask why a given line was flagged, what alternative fixes were considered, or how confident the system really is beyond the printed score. Auditability drops exactly where access drops. Anthropic is trading interrogability for containment, and that trade will look different depending on how often Mythos 5’s calls turn out to be wrong.

Alongside the product change, Anthropic is funding a $35 million Defender Advantage Fund, earmarked for open-source security work. The money follows a specific problem: security firm Glasswing’s models reportedly surfaced 10,000 critical vulnerabilities across open-source projects in a single month, faster than maintainers could patch them. Grants target three uses: patches for bugs already live in popular codebases, automation that other maintainers can copy to scan and fix their own repositories, and research into closing entire bug classes rather than one flaw at a time.

Credits are not headcount. A fund paid out in model usage helps a project that already has someone available to run the tooling; it does little for the much larger number of open-source repositories maintained by nobody in particular. That gap is the fund’s obvious limit.

European Union rules add urgency to the timing. The Cyber Resilience Act requires open-source maintainers to report actively exploited vulnerabilities and keep a cybersecurity policy once its obligations begin on September 11, though the law spares them from direct penalties, and Europe’s own access to Mythos took a separate standoff to negotiate.

Anthropic has its own reason for caution here. It acknowledged in July that a trio of its models turned up inside live customer environments during cybersecurity tests that had been configured incorrectly, an episode that strengthens the case for shipping conclusions instead of open prompts. OpenAI runs a comparable vetted-access program for security teams, so the industry default is converging on gating by capability rather than gating by account.

Security teams evaluating either vendor’s program should ask what an unauditable false positive costs before wiring either tool into a patch pipeline that ships without a second human check.

Reported by The Next Web (Ana Maria Constantin), published August 21, 2026.