Anthropic launched Claude Mythos 5.2 on November 9 as its latest AI model for cybersecurity engineering, and it is designed to help security teams find, reproduce, and fix software vulnerabilities. The release also shows a controlled-access approach, because the same abilities could assist attackers.
CyScenarioBench results and comparison limits
Mythos 5.2 scored 76.3% on CyScenarioBench. That is 14.6 percentage points above Mythos 5.1, which scored 61.7%, but Anthropic says each laboratory uses different tasks for CyScenarioBench scoring. That makes direct comparisons with other models less reliable, so the improvement is more useful as a comparison with Anthropic’s earlier release than as a simple vendor ranking.
Internal vulnerability rediscovery testing
The model also reached 89.6% on Anthropic’s internal CVE Rediscovery evaluation. Mythos 5.1 scored 78.3% on the same evaluation, while Opus 5.5 scored 81.3% without safeguards. The October 2026 test covered 1,829 published vulnerabilities. In that setup, models received project code from before each security fix and had to identify the underlying flaw on their own.
That result has a limit built into the benchmark itself. Rediscovering a known vulnerability is different from finding a new zero-day flaw that software developers do not know about yet. Anthropic says the launch shows better vulnerability discovery, reproduction, and repair, but it does not establish a 76.3% zero-day detection rate.
Earlier work and rollout boundaries
The release follows earlier Mythos work on vulnerability research and code scanning. Cybersecurity News previously covered Mythos 5’s integration into Claude Security, where enterprise customers could see model-generated findings and suggested fixes without unrestricted access to the model. That separation remains part of Anthropic’s rollout.
Anthropic also says one security company found other tested frontier models missed one in six confirmed bugs identified by Mythos 5.2. Another tester reported fewer exaggerated severity ratings. Those were individual testing results, not proof that the model will avoid false alarms across every codebase.
Shared model, different safeguards
Fable 5.2 and Mythos 5.2 use the same underlying model, but their safeguards differ. Fable has stronger restrictions for cybersecurity and biology work, while Mythos supports approved research through verification programs. Both models generate output up to 30% faster than their predecessors, and Anthropic lists standard pricing at $8 per million input tokens and $40 per million output tokens.
Access tiers and security workflow
The Cyber Verification Program includes Defense, Red Team, and Specialized Access tiers. Individuals can apply for Defense Access, while higher tiers need organizational approval. Authorized penetration testing and exploit development fall under Red Team Access, and customer work needs separate approval. Anthropic’s usage restrictions remain in force at every tier.
Enterprise customers can use Mythos 5.2 through Claude Security without joining the verification program. The service checks repository changes, tracks fixes, and reopens findings when flaws return. API and MCP connections move findings into existing development and security workflows, while Claude Security documentation keeps human review central. Teams must review and approve proposed patches, especially for critical systems.
Security validation still required
Faster discovery can shorten investigations, but finding a flaw is only the beginning. Security teams still need to validate its impact and test the fix.
Licensed under CC BY-ND 4.0 International