Introducing Claude Mythos: Anthropic’s Restricted Frontier Model

Claude Mythos is Anthropic’s restricted frontier model for advanced cybersecurity, coding, and scientific research. 

Through Project Glasswing, Anthropic and approximately 50 partners used Claude Mythos Preview to identify more than 10,000 high- or critical-severity vulnerabilities. The program was later expanded to approximately 150 additional organizations across more than 15 countries (Source).

These figures make Claude Mythos more than another high-performing AI model. It is also a test of how organizations should govern increasingly autonomous systems that can analyze code, execute tools, and pursue complex objectives.

This guide explains how Claude Mythos works, what current evidence shows, why access remains restricted, and what enterprises should consider before using Mythos-class AI.

What is Claude Mythos?

Claude Mythos is Anthropic’s restricted model for advanced cybersecurity, biology, and scientific research. It is designed for complex work involving long-horizon reasoning, tool use, code execution, and agentic workflows

Unlike standard Claude models, Mythos 5 is not available through consumer plans or self-service API access. Anthropic limits it to approved organizations because its sensitive cybersecurity and biology capabilities create substantial dual-use risks.

Claude Mythos Preview vs Claude Mythos 5: What Changed?

The Mythos model family has progressed through two principal releases:

• Claude Mythos Preview launched on April 7, 2026, as an invitation-only model for defensive cybersecurity research.

• Claude Mythos 5 launched on June 9, 2026, as its access-controlled successor.

Anthropic states that Mythos 5 performs comparably to or better than Mythos Preview across most evaluated tasks while operating at a lower token price. Mythos Preview has since been deprecated, and existing users are directed to migrate to Mythos 5.

What is Project Glasswing, and Why is Claude Mythos Access Restricted?

Project Glasswing is Anthropic’s trusted-access program for applying frontier AI to the security of critical software and infrastructure. It allows qualified organizations to use Claude Mythos 5 for approved defensive research through limited access.

Participants have included major technology, infrastructure, and cybersecurity organizations such as:

• AWS

• Apple

• Cisco

• CrowdStrike

• Google

• Microsoft

• NVIDIA

• The Linux Foundation

Access is granted only to organizations that satisfy Anthropic’s security and use-case requirements. Eligible applicants must work through an Anthropic, AWS, or Google Cloud account team rather than using a public signup process.

How Does Claude Mythos Work?

Claude Mythos operates as an agentic model that can pursue complex objectives across multiple stages. Its behavior depends not only on the model’s reasoning ability, but also on the tools, data, permissions, and execution environments connected to it.

Long-Horizon Reasoning and Multi-Step Task Execution

Claude Mythos 5 always has thinking enabled, and developers can use the effort parameter to control thinking depth. It is designed for long-horizon, multi-step work that may require repeated analysis, experimentation, and revision.

This may involve:

• Dividing a broad objective into smaller tasks

• Maintaining relevant context across several stages

• Comparing evidence from different files or tools

• Revising assumptions when an approach fails

• Continuing until it reaches a defined result or stopping condition

Its large context window allows the model to work with extensive source code, technical documentation, and accumulated tool results during the same investigation. However, the context window is not the same as permanent memory; information outside the active context may need to be supplied again.

Tool Use, Code Execution, and Connected-System Access

Approved implementations can connect Mythos 5 with tools such as source-code repositories, code execution, programmatic tool calling, and isolated software environments.

These connections allow the model to test ideas and use the results to determine its next action. However, the model can act only within the permissions and systems made available to it.

A read-only connection to a repository creates a much smaller risk than access to credentials, internal networks, code-modification tools, or production deployment systems. The surrounding permission structure therefore determines how much operational impact an autonomous workflow can have.

Cybersecurity, Cryptography, and Scientific Research Applications

Anthropic positions Mythos 5 for advanced cybersecurity, biology, and scientific research. Across these fields, the model follows a similar process:

• Process extensive technical information

• Develop possible explanations or solutions

• Use tools to test those possibilities

• Evaluate the resulting evidence

• Refine its approach when necessary

This combination of reasoning, tool use, and iterative testing enables Mythos to contribute to complex research tasks. Its reported results in vulnerability discovery, cyber evaluations, and cryptographic research are examined in the next section.

What Has Claude Mythos Demonstrated in Security Evaluations?

Claude Mythos has been evaluated through Project Glasswing, independent cybersecurity tests, and Anthropic’s internal research. The results indicate meaningful progress in AI-assisted vulnerability discovery and multi-stage security work, although their significance depends on how the evaluations were designed.

Project Glasswing Vulnerability-Discovery Results

Project Glasswing provides the largest published evidence base for Claude Mythos Preview’s defensive-security capabilities. Alongside investigations conducted by participating organizations, Anthropic used the model to examine more than 1,000 open-source projects.

As of May 22, 2026:

• Mythos Preview had identified more than 10,000 high- or critical-severity vulnerabilities across participating efforts.

• Anthropic’s coordinated disclosure dashboard recorded 1,596 findings across 281 open-source projects, with 97 patched upstream by that date (Source).

These results show that AI can increase the volume of potential discoveries, while verification, responsible disclosure, and remediation still depend on human security teams.

Independent Claude Mythos Cybersecurity Evaluation Results

The UK AI Security Institute evaluated Mythos Preview using capture-the-flag challenges and a 32-step simulated corporate-network attack called “The Last Ones.” 

The model completed expert-level cybersecurity tasks in 73% of attempts, finished the full simulation in three of ten trials, and averaged 22 completed steps compared with 16 for the next-best model evaluated. It became the first model tested by AISI to complete the simulation from beginning to end (Source).

What Current Claude Mythos Evaluations Do Not Prove

The published results do not prove that Claude Mythos can independently compromise any secured enterprise network. Several evaluations involved conditions that may not reflect hardened production systems, including:

• Explicit offensive-security instructions

• Deliberately vulnerable targets

• Broad tool or network permissions

• Environments without active defenders

• Limited endpoint protection and production monitoring

Anthropic has reported that some cybersecurity evaluation workflows interacted with real systems because testing environments were not fully isolated. These incidents highlight the importance of network containment and permission controls.

Model-generated findings also require independent review. Security teams must confirm exploitability, severity, business impact, disclosure requirements, and proposed fixes before taking action.

Claude Mythos therefore represents a substantial advance in AI-assisted cybersecurity, but benchmark performance should not be interpreted as a direct prediction of success against hardened real-world environments.

Claude Mythos 5 Specifications, Pricing, Access, and Data Retention

Claude Mythos 5 combines a large context window with extended output capacity, adaptive reasoning, and restricted access for approved Project Glasswing organizations.

Published token prices do not guarantee access. Organizations must contact their Anthropic, AWS, or Google Cloud account team and satisfy Project Glasswing’s eligibility and security requirements before using the model.

The mandatory 30-day retention period may affect whether Mythos is appropriate for workloads involving proprietary source code, confidential system architecture, regulated data, credentials, or undisclosed vulnerabilities. Organizations that require zero-data-retention terms should assess this limitation before submitting sensitive information.

Claude Mythos 5 vs Claude Fable 5: Key Differences

Claude Mythos 5 and Claude Fable 5 share the same specifications and pricing. Their main difference is how Anthropic manages sensitive requests and model access.

How Their Safeguards, Request Handling, and Access Differ

Fable 5’s classifiers are designed to restrict requests involving areas such as offensive cybersecurity, exploit development, malware, and sensitive biological methods. However, Anthropic acknowledges that legitimate coding, debugging, or defensive-security tasks may sometimes trigger these safeguards.

Mythos 5 provides approved researchers with greater flexibility for sensitive investigations. Anthropic manages the resulting risk through organizational vetting and controlled access rather than relying on Fable’s additional classifiers.

Claude Mythos Cybersecurity Risks and Enterprise Concerns

Claude Mythos introduces four primary enterprise concerns: misuse by authorized users, excessive system permissions, exposure of sensitive information, and the operational burden of processing AI-generated security findings.

Dual-Use Capabilities and Misuse Risks

Project Glasswing restricts access to vetted organizations, but controlled availability does not eliminate misuse risk.

Potential issues include:

• Authorized users operating outside the approved research scope

• Compromised accounts or stolen credentials

• Sensitive findings being shared with unauthorized parties

• Model outputs being reused for offensive purposes

• Poorly defined objectives causing investigations to exceed their intended boundaries

Organizations therefore need clear acceptable-use policies, named owners for each workflow, and defined limits on which systems or targets may be investigated.

Risks of Tool, Network, and System Access

The consequences of an error increase as Mythos receives broader permissions. Access inherited from users or connected tools may allow the model to view sensitive data, modify code, execute commands, or communicate with external systems.

Key risks include:

• Prompt injection through files, websites, or tool responses

• Unauthorized code or configuration changes

• Exposure of credentials or confidential data

• Actions performed through overly broad user permissions

• Approval fatigue caused by repeated confirmation requests

• A larger operational impact when multiple tools are connected

Human approval alone may not provide sufficient protection. High-risk workflows also require permission boundaries, isolated execution environments, restricted network access, and predefined stopping conditions.

Data Retention, Privacy, and Confidentiality Risks

Because Claude Mythos does not support zero-data-retention arrangements, organizations must determine which information is permitted to enter the model’s retained environment.

Restricted inputs may include:

• Proprietary source code

• Credentials and authentication tokens

• Customer or regulated information

• Internal infrastructure documentation

• Unpatched vulnerability details

• Confidential research or security findings

Security, legal, privacy, and engineering teams should agree on data-classification rules before deployment. Sensitive information should be minimized, redacted, or excluded when the retention policy conflicts with organizational or regulatory requirements.

False Positives, Triage Bottlenecks, and Remediation Backlogs

Claude Mythos can increase the number of potential vulnerabilities identified, but security teams may not have the capacity to process every result immediately.

The resulting operational burden may include:

• Duplicate or low-priority findings

• Incorrect or incomplete severity assessments

• More disclosures than maintainers can review

• Growing remediation backlogs

• Difficulty prioritizing findings by business impact

• AI-generated patches that require regression testing

Without a defined triage process, faster discovery may create more unresolved findings rather than reducing risk. Organizations need clear prioritization criteria, ownership, disclosure procedures, and remediation capacity before scaling AI-assisted vulnerability research.

How Should Enterprises Govern Claude Mythos?

Enterprises should govern Mythos-class AI according to the data it can access, the tools it can use, and the consequences of the actions it can perform. Controls should be defined before deployment rather than added only after an incident occurs.

Control Access to Sensitive Data and Source Code

Organizations should classify their data and establish which repositories, documents, and systems may be used in each approved workflow.

Effective access controls may include:

• Role-based access tied to job responsibilities

• Repository- and project-level permissions

• Separate workspaces for different teams or investigations

• Exclusion of unnecessary credentials and regulated data

• Time-limited access to confidential resources

Each workflow should receive only the information required to complete its defined objective. Broader access should require a documented business and security justification.

Restrict Tool, Network, and Production Access

Tools should be granted individually rather than bundled into unrestricted access. A security investigation may require a debugger, terminal, or testing framework without requiring production credentials or permission to communicate with external systems.

Enterprises should consider:

• Read-only permissions as the default

• Allowlisted tools, commands, and network destinations

• Isolated filesystems and test environments

• Temporary credentials with narrow scopes

• Separation between research, staging, and production systems

• Restrictions on modifying, deleting, or deploying resources

These boundaries reduce the potential impact of incorrect instructions, compromised workflows, or unintended model behavior. (Source)

Require Human Approval for High-Risk Actions

Human review should be required when an action could affect external systems, sensitive data, production software, or security controls.

Approval may be necessary before Mythos can:

• Use privileged credentials

• Run an exploit outside an isolated environment

• Contact an external network or organization

• Modify access controls or security configurations

• Submit a vulnerability disclosure

• Merge, deploy, or delete code

Approval requests should clearly describe the proposed action, affected system, expected result, and potential risk. This gives reviewers enough context to make an informed decision rather than approving a generic permission prompt.

Monitor, Audit, and Contain Autonomous Workflows

Organizations should monitor Mythos-class workflows while they are running, not only review logs after completion.

Records should capture:

• Prompts and model outputs

• Tool calls and executed commands

• Access and approval decisions

• Network activity

• Modified files or configurations

• Errors, policy violations, and stopping events

Each deployment should also define:

• Maximum task duration and resource use

• Approved targets and success criteria

• Automatic suspension conditions

• Alerts for unusual activity

• Immediate credential-revocation procedures

• A named owner for incident investigation

Governance cannot eliminate every risk associated with autonomous AI. It can, however, limit the potential impact of failures and ensure that sensitive actions remain traceable to accountable human decision-makers.

Conclusion: What Claude Mythos Means for Enterprise AI Governance

Claude Mythos demonstrates both the defensive value and the dual-use risks of highly autonomous AI. Its reported cybersecurity results suggest that frontier models can accelerate vulnerability discovery and complex technical research, but capability alone does not determine whether they can be used safely.

Anthropic’s restricted-access approach shows that model safeguards must be supported by organizational controls, qualified human oversight, and clear accountability. As similar capabilities become more widely available, enterprises will need to evaluate not only what an AI system can accomplish, but also whether its access, actions, and failures can be effectively governed.

FAQs

Is Claude Mythos Available to the Public?

No. Claude Mythos 5 is available only to approved organizations through Project Glasswing. It cannot be accessed through public consumer plans or standard self-service API accounts.

Why Is Claude Mythos Considered a Cybersecurity Risk?

Claude Mythos can discover vulnerabilities, execute code, and perform multi-stage security tasks. These capabilities support defenders but could also be misused to identify or exploit weaknesses.

How Can Organizations Get Access to Claude Mythos?

Organizations must request access through their Anthropic, AWS, or Google Cloud account team. Anthropic reviews the organization and proposed use case before approving.

Can Individuals or Developers Use Claude Mythos?

Individual developers cannot activate Claude Mythos independently. They can use it only through an organization approved for Project Glasswing or another eligible trusted-access program.

Can Enterprises Safely Use Claude Mythos?

Enterprises can reduce risk through isolated environments, limited permissions, activity monitoring, and human approval for sensitive actions. They must also consider its 30-day data-retention requirement.

How Much Does Claude Mythos 5 Cost?

Claude Mythos 5 costs $10 per million input tokens and $50 per million output tokens. Paying the usage fees does not guarantee access because prior approval is required.