AI 安全與開發工具
Claude Security Integrates Mythos 5, Replacing Direct Model Access With Restricted Scan Results
Enterprise customers can now use Mythos 5 to scan code repositories and receive CWE classifications, severity levels, confidence ratings, and recommended fixes. The model remains behind a controlled service, and fixes require human review, but Anthropic has not disclosed detection accuracy.
Anthropic has integrated the cybersecurity-focused Claude Mythos 5 into the Claude Security public beta, allowing Claude Enterprise customers to scan connected code repositories. After an administrator enables the feature, users can select a repository, and the system returns a CWE category, severity level, confidence rating, and recommended fix for each finding. Scans are billed as standard token usage under the existing plan, with no separate add-on fee.
The key aspect of this update is not the release of a general-purpose Mythos 5 API, but the separation of “model access” from “access to defensive results.” Users can receive vulnerability reports, alerts, and remediation recommendations, but cannot freely prompt Mythos 5 to generate exploit code. To implement a fix, the workflow moves to Claude Code on the web and uses models already available to the organization. All changes still require human review and approval, and scan permissions do not extend Mythos 5 access to other Claude interfaces.
Engineering teams must also distinguish the hosted service from the local Claude Security plugin for Claude Code. The latter uses a multi-agent workflow to build architecture diagrams and threat models, cross-validate findings, and generate patches in a temporary copy, but it relies on models already approved for the account in Claude Code. The official documentation explicitly categorizes Mythos 5 scanning as an Enterprise hosted product. Patches generated by the plugin are not applied automatically, and reports record the commit and configuration associated with each scan.
Anthropic is also preparing to embed Mythos 5 in partners’ security products and has announced $35 million in Claude credits to support open-source vulnerability remediation and automation; these are service credits, not cash. The announcement provides no precision, recall, false-positive rate, supported-language data, or benchmark comparisons with SAST tools, so the service should not yet be treated as a deterministic security gate. Partner integrations and the Mythos-tier expansion of the Cyber Verification Program also remain planned for a later date.