Claude Security Brings Mythos 5 Scans to Enterprise Customers
Anthropic says Claude Security scans now run on Claude Mythos 5 for Claude Enterprise customers. The public-beta product scans connected codebases, returns CWE, confidence, severity, and suggested-fix details, and opens approved fixes in Claude Code on the web without exposing the Mythos model directly.
Anthropic says Claude Security scans now run on Claude Mythos 5 for Claude Enterprise customers. Claude Security is in public beta: it scans a connected codebase for vulnerabilities, returns structured findings, and lets teams open suggested fixes in Claude Code on the web. (Claude on X; Anthropic)
The update is a controlled way to apply Mythos 5's cybersecurity capability. Anthropic says the scan runs the model behind the product and returns findings, rather than giving users direct access to Mythos 5 for general prompting. (Anthropic)
What changed on August 21
Starting August 21, 2026, Claude Security scans run on Claude Mythos 5. Anthropic says Claude Enterprise customers can scan their codebases for vulnerabilities and suggest patches, while Claude Security remains in public beta for Enterprise customers. Enterprise administrators can enable the product from the admin console. (Anthropic; Claude Security)
This is a new product integration, not a general Mythos 5 model-access change. Anthropic explicitly says the Mythos scan does not extend Mythos 5 access to other surfaces, and the model is not exposed directly through the scan. (Anthropic)
What a scan returns
Claude Security scans a connected GitHub repository and traces code context across files. The product page says it can understand data flows, Git history, and business logic, while the launch update describes the output for each finding:
- A CWE category.
- A confidence rating.
- A severity rating.
- A suggested fix.
Anthropic also describes an adversarial verification pass before findings are surfaced. The product page says validated findings can be opened in Claude Code on the web, exported as CSV or Markdown, or sent through webhooks to Slack, Jira, or another ticketing system. Those workflow details come from the product page and are not a promise that every Enterprise workspace has identical configuration or limits. (Claude Security)
Suggested patches stay human-approved
A suggested fix opens in Claude Code on the web using the models the organization already has access to. Anthropic says every patch must be reviewed and approved by a human before it can be implemented. That keeps the scan focused on producing a security finding and a reviewable remediation path, rather than silently changing a repository. (Claude on X; Anthropic)
The separate Claude Security Plugin for Claude Code is in beta and follows a different model-access boundary. Anthropic's product page says the plugin uses the models available in the user's Claude Code account; it does not use Mythos 5 unless that model is available to the account. The plugin keeps code inside the user's environment when scanning, validating, and patching. (Claude Security; Claude Code documentation)
Cost and access boundary
Anthropic says Claude Security scans using Mythos 5 are billed as standard token usage under the customer's existing plan, with no separate add-on. The scan provides Mythos-quality vulnerability findings without granting direct access to the model. (Anthropic)
The practical boundary is therefore:
| Surface | What Anthropic says is available |
|---|---|
| Claude Security on Claude.ai | Mythos 5 scans for Claude Enterprise customers; public beta; Enterprise admin enablement |
| Claude Code on the web | Suggested fixes can be opened using the models the organization already uses |
| Claude Security Plugin for Claude Code | Beta for Claude Code users; uses models available in that user's Claude Code account |
| Direct Mythos 5 prompting | Not granted by running a Claude Security scan |
What to try first
For an eligible Enterprise workspace, start with a repository the team owns and inspect the finding details before opening any patch. Review the CWE category, severity, confidence, and suggested fix, then use Claude Code on the web to draft the remediation and have a human approve it. Anthropic's workflow keeps patch application under team control. (Anthropic)
If you are using Claude Code rather than the hosted Enterprise product, check the plugin prerequisites and model availability separately. The official documentation requires Claude Code v2.1.154 or later and a paid plan for the plugin, while the managed Claude Security product is stated as an Enterprise offering. (Claude Code documentation)
Sources
- Claude on X, "Claude Security scans now run on Claude Mythos 5," August 21, 2026: https://x.com/claudeai/status/2090852314319880425
- Claude on X, "Point Claude Security at a GitHub repo," August 21, 2026: https://x.com/claudeai/status/2090852316328902930
- Claude on X, "Suggested patches open in Claude Code on the web," August 21, 2026: https://x.com/claudeai/status/2090852318527033804
- Anthropic, "Bringing the cybersecurity capabilities of Claude Mythos 5 to more defenders," August 21, 2026: https://claude.com/blog/bringing-claude-mythos-5-to-more-defenders
- Claude Security product page: https://claude.com/product/claude-security
- Claude Code documentation, "Scan your codebase for vulnerabilities": https://code.claude.com/docs/en/claude-security
Read next
Keep building the workspace playbookClaude Fable 5 and Mythos 5: Mythos-Class Capability Goes General, With Caveats
Anthropic launched Claude Fable 5, a Mythos-class model made safe for general use and available today as claude-fable-5, plus Claude Mythos 5 for vetted cyberdefenders via Project Glasswing. Pricing is $10 per million input and $50 per million output tokens, with free subscription access ending June 23 and a mandatory 30-day data-retention policy on all Mythos-class traffic.
OpenAI Releases Codex Security CLI for Repository Scans and CI Checks
OpenAI says its open-source Codex Security CLI can scan repositories, track findings across runs, verify fixes, and add security checks to CI/CD. The beta CLI requires Codex Security access and is built for teams that want code-aware security review in the terminal.
Claude Managed Agents Add Memory Stores, Domain Controls, and a Redesigned Console
Anthropic's Claude Managed Agents updates let self-hosted sandbox sessions attach memory stores, restrict web_search and web_fetch with allowed_domains or blocked_domains, and inspect multi-agent sessions in a redesigned Claude Console viewer.
Frequently Asked Questions
Who can use Claude Security with Claude Mythos 5?
Anthropic says Claude Enterprise customers can run Claude Security scans with Claude Mythos 5. Claude Security is in public beta, and Enterprise administrators can enable it in the admin console.
What does a Claude Security scan return?
Anthropic says each finding includes a CWE category, confidence rating, severity rating, and suggested fix. Users can open a suggested fix in Claude Code on the web for implementation with the models their organization already uses.
Does Claude Security give users direct access to Mythos 5?
No. Anthropic says Mythos 5 runs behind the Claude Security scan and returns findings rather than exposing the model for general prompting. The Mythos scan itself does not extend Mythos 5 access to other surfaces.
Are Claude Security scans billed separately?
Anthropic says scans using Mythos 5 are billed as standard token usage under the customer's existing plan, with no separate add-on.