Bringing the cybersecurity capabilities of Claude Mythos 5 to more defenders

8/21/2026 at 9:20:37 PM

The problem is that "cybersecurity" isn't some special task that only your security team does.

In the project I maintain, I find bugs and fix bugs. Some of those bugs might result in an LPE. I generate a regression test, then I fix the bug.

The problem is that generating a regression test for that type of bug is technically a PoC. I can almost never get Fable to create one. Sometimes Opus 5 punts as well. Same with Sol and Luna.

That is, unless I socially engineer the model. I can't talk about security. I make sure they don't read the file call cve_test.c (literal regression tests for CVEs). I have to hide part of my project from the models for them to work.

Anthropic and OpenAI are driving me to use other models.

by jnwatson

8/21/2026 at 10:34:17 PM

I’m a web performance engineer — I help clients find and fix site speed issues — but recently I spotted what I thought might be a security/privacy issue. Security not being my specialism, I asked Fable to help me triage and, if necessary, raise the issue with my client.

It refused. It’s so so so adjacent to the work we’d already been doing, but the moment I asked it to help me understand what I thought I’d found, it left me high and dry!

by csswizardry

8/21/2026 at 11:22:42 PM

I run into this several times per week.

Sometimes the context where Fable drops to Opus 4.8 is enough for Opus 4.8 to do a first pass on everything, then I start a new session and Fable will happily refactor/improve it.

Super annoying.

by SparkyMcUnicorn

8/21/2026 at 11:19:56 PM

Every one of their models has become absolutely useless, for validation of bugs and the remediations. Unless I’m doing straight forward dev work, I’ve turned to alternate models and harnesses I’ve started building on my own. The frontier models have apparently become so good at security that they can’t be bothered to discuss it with laymen…

by igetspam

8/21/2026 at 9:31:48 PM

Agree 100%. This is just another level of obscurity. Security through obscurity... Its annoying, very annoying.

by sscaryterry

8/21/2026 at 10:26:56 PM

How does security through obscurity apply here?

by MeetingsBrowser

8/21/2026 at 10:29:41 PM

If you've worked with Codex/CC, you'd have seen it degrade from Fable to Opus, or just not done what you've asked it for.

There are techniques and ways around it. For example, I've found that disabling auto mode in CC sometimes helps (anecdotal, YMMV).

This is all for "security". You can always make it do what you want, it just gets really, really laborious.

by sscaryterry

8/23/2026 at 7:23:24 AM

Sometimes you can't get Fable to create one? Most of the time I can't even get Fable to investigate why a unit test is crashing because a segfault is a cyber security risk so it changes the model automatically. Drives me hp the wall how hard they clutch their pearls here, Codex has given me no such trouble.

by zamadatix

8/21/2026 at 8:07:57 PM

This week I found two issues in my company codebase. After finding them I told a claude session about one and asked for a quick proof of concept demo of the exploit. It refused, including refusing simple things in the same session afterwards.

Meanwhile same model in a new tab, say I need help creating a page that hits an endpoint with a special payload and it does the same things that were too dangerous in the previous tab...

by vasco

8/21/2026 at 8:38:26 PM

I had that when opus 4.8 was first out. It repeated refused to make a PoC for an issue it suspected.

I eventually gave up and just asked it to fix the issue. The first thing it did? Write a PoC to verify the issue was still valid...

by eterm

8/21/2026 at 8:19:05 PM

Just use an EU- or US-hosted Asian Opensource model. They will spit out everything.

by BlackRabbit1

8/21/2026 at 10:01:50 PM

What a bunch of wankery from Anthropic. I already use Sol 5.6 for security auditing and it works great, and as a bonus doesn't give verbal vomit every time.

by zeafoamrun

8/21/2026 at 10:17:37 PM

I suspect this will be seen as a mistep by Anthropic in the long run. Including how their own hyperbole led to the US gov adding export controls.

by dmix

8/21/2026 at 7:57:48 PM

Seems like a whole lot of nothing for the average user. They have really lost the plot.

by FL410

8/21/2026 at 8:08:04 PM

I dont understand. Not everything has to be for everyone.

by nonethewiser

8/21/2026 at 10:12:36 PM

$35M in credits (!) for the Defender Advantage Fund (0xDAF) doesn't sound that much given that e.g. the HAWK attack [1] cost $100k for 1 (albeit very advanced) vulnerability.

As a side note, that Golden Eagle wording "bringing a wartime footing to the cyber domain to relentlessly patch vulnerabilities" sounds so AI-written maybe that's what the credits are needed for.

(1) https://www.anthropic.com/research/discovering-cryptographic...

by janpeuker

8/21/2026 at 10:40:28 PM

The HAWK attack was on a 3rd round PQC candidate that had been under adversarial review by experts for 3 years. It is an outlier and most vulnerabilities are easier to find.

by sweis

8/21/2026 at 8:17:20 PM

For those who had access, how does it compare IRL with GLM 5.3 ? iirc both models are similar in terms of benchmarks ?

by gorgmah

8/21/2026 at 9:09:12 PM

From a cost perspective Mythos is too expensive right now. With the right Harness and a few layers of models you can get close or better in some circumstances. Kimi / GLM, Qwen etc. And that's before ablation / Abliteration...

For those in Mythos.. if you ask how much it cost to assess their repos, your jaw would drop. We're talking the price of buying a couple machines to run Kimi / GLM full weight outright.. for one Scan.

Right now I wouldn't say GLM 5.3 is the same, but it's not far off. For the cost benefit it's the better of the two.

by ganoushoreilly

8/21/2026 at 8:32:06 PM

I’ve been working on a decompilation project that fable was choking on and GLM 5.3 has been chunking away at it for 72 hours now? I think it’s my favorite agentic/implementer model right now.

by conception

8/21/2026 at 8:52:54 PM

My big fear is that they are busy nerfing the weights for "safety" before releasing them. In fact, they've more-or-less said as much.

I have a feeling what we are about to see on HuggingFace is not the GLM 5.3 that you're using now.

by CamperBob2

8/22/2026 at 1:41:53 AM

You mean when they said they are doing safety evaluation and hardening? I'm having the same fear as you.

by osti

8/22/2026 at 4:11:02 AM

Yes, exactly.

by CamperBob2

8/21/2026 at 8:38:13 PM

Oh? Can you share any details on the decompilation project?

by ChickeNES

8/21/2026 at 10:13:20 PM

The GLM series is GOATed.

by teaearlgraycold

8/21/2026 at 9:23:23 PM

Screw you Anthropic and screw your gatekeeping, Opus 5 refuses even basic reverse engineering / patching tasks, even BPF is apparently too dangerous, you lost your minds..

by zb3

8/21/2026 at 8:19:43 PM

> Bringing the cybersecurity capabilities of Claude Mythos 5 to more defenders

This dance is quite annoying. When Anthropic releases a paid model, the user should control what it does and doesn't do. The other day I had a security incident that required urgent response. ChatGPT and Claude were utterly useless (I quickly attempted to get access to the former's advanced security capabilities but was met with a form I could complete - far too slow for a time-sensitive problem like a security incident!). So I used grok and it helped! I am told Kimi also helps in such cases although haven't tried it yet.

by nomilk

8/21/2026 at 8:33:43 PM

Voting matters. Remember these companies are trying not to get shut down overnight.

by conception

8/21/2026 at 10:41:18 PM

On the other hand, people are using Grok to do things like “nudify” images of random people they find online, including minors.

I’m not a fan of limiting access to models, but the other extreme (no limits or guardrails) is at least as bad if not worse.

by MeetingsBrowser

8/21/2026 at 8:30:23 PM

[dead]

by trial3

8/21/2026 at 8:06:33 PM

may have been rushed by hugging face being unable to use claude to debug or fix their breach, because there isnt detail on new guardrails put into place to protect against anthropic's initial concerns of wide distribution?

separately, it is interesting they are adding an oem type offer:

>We’re working with our cybersecurity technology and services partners to integrate Claude Mythos 5 into the products and services defenders already use to secure their software.

anyone know the shape of those contracts, e.g. pure tokens/usage or more of a traditional licensing or oem type structure?

by gz5

8/21/2026 at 8:24:24 PM

Hugging Face was able to sign up for Glasswing but they just didn't.

by wmf

8/21/2026 at 10:23:01 PM

What are the SOTA harnesses for scanning a repo for vulnerabilities?

by antiloper

8/21/2026 at 10:23:51 PM

The Claude Security program looks similar to OpenAI Cyber Trusted Access.

The approval process seems quite intimidating, has anyone managed to implement these compliance standards?

by TZubiri

8/21/2026 at 10:32:55 PM

I found that Claude / Sol were basically useless when approaching various CTFs that allowed AI tools, but running Qwen and DeepSeek locally and GLM via OpenRouter worked fine. It's blatantly obvious to anyone that even does tangentially cybersecurity related work that Anthropic's position here is stupid and detrimental to security.

by tristor

8/21/2026 at 8:28:58 PM

In a world where things such as GLM-5.3, DeepSeek-V4-Pro-0813, and Kimi-K3 exists, this is a bit laughable.

Anthropic needs some model with a fancy name so they can pretend for another while that their model is so powerful it will destroy the world if released. I propose Claude Legend 6.

by surgical_fire

8/21/2026 at 8:52:07 PM

Do they still think they occupy the commanding heights or do they just see the need to act like it until the IPO in a few weeks?

by delichon

8/21/2026 at 9:52:25 PM

For their IPO they better fast forward to Claude Apocalypse 7.

With how unsustainable they are they really need to hype up those bagholders.

by surgical_fire

8/21/2026 at 10:05:08 PM

>In a world where things such as GLM-5.3, DeepSeek-V4-Pro-0813, and Kimi-K3 exists, this is a bit laughable.

This is not just for security, too. Using Fable for anything that could be remotely construed as being connect to chemistry or biology was impossible until a few weeks ago. Now it is slightly better, but still fails on many completely innocuous projects.

So as other models advance, Anthropic's sole frontier offering to entire academic fields remains an Opus that seems to get worse in capability each release. They're starting to become a joke in my field: at a conference a few weeks ago, one presenter laughed when I asked about his use of Fable and pointed out that it would downgrade if the letters 'd', 'n', and 'a' were anywhere near each other, which is not that far from my experience.

by cge

8/21/2026 at 8:58:45 PM

>> In a world where things such as GLM-5.3, DeepSeek-V4-Pro-0813, and Kimi-K3 exists, this is a bit laughable.

Is it, though?

We don't know what Mythos is really capable of, beyond what Anthropic has told us, and some second-hand accounts from orgs that have been whitelisted.

What we do know is that their withholding it from the masses is causing a lot of harm to their reputation and general annoyance. And probably a lot of money as well, as those people cancel their subscriptions in favor of other models. They are about to IPO, and you don't want people to have a bad taste in their mouth during this critical period.

As such, I think it is reasonable conclude that there must in fact be very valid reasons for them to keep going down this path of gradual access-widening. I'm never going to blindly trust a corporation, but in this case I'm not going to hate on them either because, at the risk of repeating myself, we just don't have all the facts.

by enraged_camel

8/21/2026 at 9:29:45 PM

> Is it, though?

Yes, it truly is.

Open models are extremely capable, as benchmark after benchmark has indicated.

Beyond that, for the vast majority of software development (including cybersecurity), the open models are there already. All that without having to pay the hefty Anthropic premium, not to mention all their bullshit with pretending their model is some sort of WMD and their awful uptime (although, to their credit, they seem more stable than Github).

I cannot fathom why anyone uses their service.

by surgical_fire

8/21/2026 at 10:28:33 PM

As basically every subject matter expert has stated again and again, benchmarks do not tell reveal anything meaningful and have effectively no relation to the model's actual capabilities.

by select1

8/21/2026 at 11:19:18 PM

Which is why I actually used all those models.

At work I am stuck with Claude because it is what the employer provides.

In my home setup I use a combination of different models; mostly GLM-5.3, DS-V4-Flash, and MiMo-2.5-pro.

I vastly prefer my home setup.

by surgical_fire

8/22/2026 at 12:06:41 AM

That says more about your tasks than anything else.

by select1

8/22/2026 at 2:20:29 AM

You're free to speculate and pretend you had some insight.

by surgical_fire

8/21/2026 at 11:18:53 PM

You didn't really address my point. You just... stated your own.

by enraged_camel

8/21/2026 at 11:22:06 PM

I definitely did. I was talking about how in a world where open models exist and are very much capable, Anthropic is sort of a joke.

You asked if that is true, and speculated about mythos.

Uninterested in speculating about mythos, I explained why it is irrelevant anyway.

This was a successul conversation.

by surgical_fire

8/21/2026 at 11:57:30 PM

Glad you think so.

by enraged_camel

8/21/2026 at 9:14:42 PM

Is this the same model that failed to detect the attack from their environment against Hugging Face?

by egoacid

8/21/2026 at 10:16:15 PM

You are mixing Anthropic and OpenAI...

by flaburgan

8/21/2026 at 8:09:04 PM

China will beat them to general availability.

Anthropic is overconfident, and it's going to bite them in the ass.

Dario deserves it for being so hypocritical, fear mongering, and ladder pulling. Fastest hero to villain arc in recent memory.

by echelon

8/21/2026 at 10:22:53 PM

Running asan? We are too afraid to be dangerously

by delduca

8/21/2026 at 9:25:13 PM

Nothing has made me want a downvote option for HN posts more than the endless AI advertisement slop that has flooded the site.

by jknoepfler