Anthropic just shipped its most restricted model to more customers — by taking away the prompt box

The constraint is the product

The easy way to read this announcement is as a version bump: a scanner that ran on Claude Opus 4.7 since its public beta in early May now runs on something better. That reading misses what is actually novel.

Mythos 5 is the model tier Anthropic has been most reluctant to hand out. It carries 30-day retention that removes it from zero-data-retention workspaces and HIPAA BAAs entirely — a restriction strict enough that OpenAI built a competing privacy story around it. Anthropic did not relax any of that. Instead it found a delivery mechanism where the restriction stops mattering: if the customer never gets a prompt box, the customer cannot steer the model toward the capability Anthropic is worried about.

Anthropic states the logic plainly — the risk concentrates where a user has direct access and can push the model toward offensive work, and when users can only receive specific outputs such as a patch or an alert, that risk drops considerably. Claude Security is that principle turned into a product surface. It scans, it traces data flows across files and modules, it reasons about how components interact, and it hands back findings. There is no conversational channel to jailbreak.

This is a meaningfully different answer to the dual-use problem than the industry has been giving. The prevailing approach has been to make the model refuse more reliably — training-time alignment, request-level classifiers, and, as both labs conceded this month, cross-session monitoring because single-request checks are not enough. Anthropic’s move here sidesteps that arms race by changing the interface rather than the model. You cannot jailbreak a scan button.

What you actually get

Claude Security returns vulnerability findings tagged with CWE categories, each carrying a severity rating, a confidence score, and reproduction detail explaining how the flaw can be triggered. It suggests patches. It does not merge them — human review before implementation is required by design, not by convention.

Two details matter more than the feature list.

First, the false-positive design. Anthropic says every finding goes through an adversarial verification pass in which the model challenges its own result before surfacing it, on top of the explicit confidence rating. Anyone who has watched a team quietly stop reading static-analysis output knows this is the actual product problem in application security. A scanner that surfaces forty findings of which three are real is worse than no scanner, because it consumes the attention that would have found the three. Whether the adversarial pass works at scale is the thing to measure in your own pilot — but it is at least aimed at the right target.

Second, the billing. Claude Security bills as standard token usage with no separate add-on, enabled from the admin console. That is refreshingly simple next to the per-seat and per-scan pricing that dominates the AppSec market. It also means your costs scale with code volume and scan cadence rather than headcount, which cuts both ways. A weekly scheduled scan across a large monorepo is a very different line item from on-demand scans of individual services, and nothing in the interface will stop you from configuring the expensive one. This is the same budgeting shift that arrived with cloud agents that wake themselves up: spend detached from a human pressing enter.

The retention question nobody answered

Here is the gap that should shape whether you enable this next week.

Anthropic’s covered-models policy is unambiguous about scope: prompts submitted to and outputs generated by covered models are retained for 30 days “on every platform where these models are offered.” Mythos 5 is a covered model. Claude Security now offers Mythos 5. The syllogism is not subtle.

But the privacy documentation enumerating affected surfaces — Claude Console workspaces, Claude Code under Enterprise, Bedrock, Google Cloud Agent Platform, Microsoft Foundry — does not currently name Claude Security. So the policy language and the documentation point in slightly different directions, and the announcement addresses retention not at all.

For most workloads that ambiguity would be a footnote. For this one it is not, because of what you are feeding the thing. A vulnerability scan submits your source code, and the output is a catalogue of your unpatched exploitable weaknesses with reproduction steps. If that pair sits in 30-day retention, it is a materially different risk conversation than a retained chat transcript — and it is exactly the conversation your security team will want to have before, not after, the first scheduled scan.

None of this is an accusation that Anthropic is hiding something. The controls around covered-model retention are genuinely strong: no default human access, review only by approved personnel when automated systems flag potential harm, tamper-proof audit logs of every access event, automatic deletion at 30 days. The problem is simply that the announcement left a question open that buyers need closed. Ask your account team, in writing, whether Claude Security scans fall under covered-model retention and whether a ZDR workspace can use the feature at all.

The Cyber Verification Program is the bigger signal

Buried under the product news is the structural change. Anthropic is expanding its Cyber Verification Program — the vetting path through which legitimate defenders get reduced safeguards for dual-use security work — beyond Opus and Sonnet, with Mythos-class access to follow in the coming weeks.

That is Anthropic building a second tier of access governed by who you are rather than what product you bought. Combined with Claude Security, the shape of frontier cyber capability distribution becomes clear: unvetted customers get artefacts, vetted defenders get steering, and nobody gets an unrestricted Mythos prompt box off the shelf.

This is the mirror image of the argument that surfaced when OpenAI shipped an explicitly offensive-capable model tier. Both labs have concluded that frontier cyber capability cannot simply be listed on a pricing page. They have chosen different gates — OpenAI leaning on customer vetting for an offensive product, Anthropic leaning on interface restriction for a defensive one — but the era of “sign up and get the best model” is over for this capability class, and buyers should plan procurement accordingly.

What to do about it

If you are a Claude Enterprise customer, this is worth piloting on a non-critical repository, for free in the sense that no new contract is required — but resolve the retention question first if you operate under ZDR or any regulated-data commitment. Run it alongside your existing SAST tooling and diff the findings rather than swapping anything out. Beta software that reasons about code is a detection layer, not a compliance artefact.

If you are on Team or Max, access is expected to follow but has not landed. Do not restructure a security roadmap around an unshipped tier.

If you maintain critical open-source infrastructure, the Defender Advantage Fund is $35M in Claude credits explicitly earmarked for remediating live vulnerabilities and automating scan-and-patch work, starting with pilot grants. That is applicable compute for exactly the backlog most projects cannot fund. It also, unavoidably, seeds the ecosystem with Claude-based tooling — worth naming, not disqualifying.

If you are evaluating agentic coding tools more broadly, note what just happened to the competitive picture. Security scanning was a category buyers assembled from specialist vendors. Anthropic just bundled a frontier-model version of it into an existing enterprise subscription at token cost. GitHub Copilot and Cursor both sell into the same budget, and neither has an equivalent answer that runs on a restricted frontier tier.

The verdict

The headline capability is real but ordinary — better model, better scanner. The durable story is the delivery mechanism. Anthropic has demonstrated that the way to ship a model too dangerous to hand out is to stop handing it out and start handing out its conclusions, and that a product boundary can do work that a training objective could not. Expect this pattern to spread to every capability class that is valuable and dual-use.

Two caveats keep this from being an unqualified recommendation. It is public beta, on a tier restricted enough that Anthropic will not let you talk to it. And the retention question is unresolved in a context — your full source tree plus its exploitable weaknesses — where the answer genuinely changes the calculus. Pilot it. Ask the question. Do not schedule a monorepo-wide scan until you have the answer in writing.

Questions or corrections? Email Pick Right. Want the full list? See all news.