What Is Claude Mythos? Anthropic's Restricted AI Model Explained

Claude Mythos is Anthropic's most capable AI model, and unlike every other model the company sells, you almost certainly can't use it. Mythos is the restricted, higher-capability sibling of the public Claude Fable line, built on the same underlying model but running with far fewer of the safety filters that block cybersecurity, biological, and chemical queries. Anthropic keeps it behind an application process called the Cyber Verification Program (CVP) because, by the company's own account, it is unusually good at finding software vulnerabilities — good enough that releasing it to everyone was judged too risky.

What is Claude Mythos?

Claude Mythos is the name Anthropic uses for the most capable tier of its Claude model family — models the company considers too strong in one specific area, offensive and defensive cybersecurity work, to hand to the general public without safeguards. Anthropic first disclosed the existence of a Mythos-class model on April 7, 2026, publishing a system card for "Claude Mythos Preview" and describing it as the company's most capable frontier model to date, with a sharp jump in benchmark scores over the prior flagship — you can read how the Claude Opus line has evolved since then for comparison.

Rather than release Mythos Preview broadly, Anthropic launched Project Glasswing, an early-access program that gave a small number of vetted organizations direct access so they could use the model to find and fix real vulnerabilities before the techniques became widely available. According to accounts of the rollout, more than 40 companies — including large cloud providers and enterprise software vendors — received Glasswing access in the days after the April disclosure, and the program expanded to roughly 150 additional organizations across more than 15 countries by early June. Governments took notice quickly too: reporting from that period describes briefings involving the US Treasury, the UK's AI Security Institute, and financial regulators in India and Japan, all focused on what a model this good at finding exploits could mean for banking and critical infrastructure security.

The program's name has stuck around as informal shorthand even after Anthropic folded it into a more formal structure. Today, "Project Glasswing" effectively describes the lineage of the access program, while the Cyber Verification Program is the current, applicable framework — see the access section below.

Claude Mythos vs. Claude Fable 5.1: what's actually different

Anthropic has been consistent on one point: Mythos and Fable are not two different models. They're the same underlying model with two different safety configurations sitting in front of it.

• Claude Fable 5.1 is the version anyone can use through the Claude API, Claude Platform, or a subscription plan. Its classifiers route sensitive requests — cybersecurity exploitation, biological or chemical synthesis, and attempts to distill the model's own weights — to a less capable fallback model instead of answering with Mythos-level capability.
• Claude Mythos 5.1 is the same model with those specific classifiers relaxed for verified users, so it can actually complete the cybersecurity-relevant work that Fable deflects.

In practice, that means a security researcher approved for the Cyber Verification Program and a developer on a standard Claude Fable 5.1 plan could be talking to the same weights — only one of them gets full-strength answers on exploit development and vulnerability research. Anthropic has described the gap in capability as deliberate rather than a side effect: Fable is tuned to be broadly useful without becoming a turnkey exploit generator, and Mythos exists specifically to remove that ceiling for people Anthropic has vetted to use it responsibly.

One detail that trips people up: Mythos and Fable aren't always available at the same moment. Fable 5 and Mythos 5 both shipped on June 9, 2026, but reporting at the time described a brief window in mid-June where US export-control questions led to both being pulled back for non-US customers before access was restored later that month. Treat any specific suspension dates as secondhand reporting rather than confirmed fact — Anthropic's own system cards don't dwell on the incident — but it's a reminder that Mythos-class availability has moved around more than a typical Claude release.

Claude Mythos release timeline

Mythos has gone through three named releases since Anthropic first acknowledged it:

That October 6 Cyber Verification Program expansion is the most direct path to Mythos access today. It merged Project Glasswing — the original invite-only pilot — into a single structured program with defined tiers, rather than leaving Mythos access as a one-off allowlist. Anthropic's own system-cards index lists every Mythos and Fable release to date.

How to get access: the Cyber Verification Program

Anthropic's Cyber Verification Program is the only sanctioned way to reach Claude Mythos 5.1. It has three tiers, each covering Claude Opus 5.5, Claude Sonnet 5.5, and Claude Mythos 5.1, plus any future models Anthropic adds:

• Defense Access — for defensive work: SOC and incident-response teams, malware reverse-engineering, vulnerability analysis. Open to companies, universities, government bodies, critical-infrastructure operators, smaller security firms, open-source maintainers, and individual researchers with a track record of reported vulnerabilities. Anthropic says applications are typically reviewed within a few days.
• Red Team Access — adds authorized penetration testing and red-teaming on systems the applicant is cleared to test. Limited to organizations, not individuals. Reviews take a few weeks, and applicants get Defense Access in the meantime.
• Specialized Access — the fewest safety restrictions, reserved for a small set of organizations testing safety-critical systems such as power grids or flight systems. Every applicant is reviewed jointly with the US government. Organizations already in Project Glasswing were carried over to this tier automatically for existing models.

Every tier requires data retention — Anthropic monitors sessions for signs of cyber misuse — and admins have to assign the program to specific workspaces rather than an entire account. Anthropic has said an Enterprise Frontier Safeguards option, letting qualifying organizations keep that data in infrastructure they control, was expected later in the fall.

Mechanically, applying means going to Anthropic's Cyber Verification Program page, picking the tier that matches your work, and submitting an attestation describing your organization's security controls and what you intend to use the access for. Anthropic reviews each application against that tier's criteria rather than granting access automatically, and existing Claude Enterprise or API customers don't get Mythos access by default just because they're already paying customers — the verification step applies regardless of account size or spend. The program is currently available through the Claude Platform, Google Cloud's Vertex AI, and Microsoft Foundry; on Amazon Bedrock, it's limited to organizations that already qualify for Enterprise Frontier Safeguards.

How much does Claude Mythos cost?

According to Anthropic's own pricing documentation, Claude Mythos 5.1 is billed at exactly the same rate as the public Claude Fable 5.1:

There's no premium for the relaxed safeguards — the cost is identical per token. The real price of entry isn't money, it's the verification process itself.

What Claude Mythos has actually found

Anthropic's pitch for keeping Mythos restricted rests on specific, citable results rather than a general claim of being "smarter." Glasswing partners have reported using the model to surface real vulnerabilities in widely deployed software — one commonly cited example is Mozilla crediting Mythos-assisted testing with helping fix over 270 Firefox bugs in the weeks after early access began. Anthropic has also said that across the first wave of Glasswing partners, the model helped surface more than 10,000 high- or critical-severity vulnerabilities, and that in evaluations by the UK's AI Security Institute, Mythos ranked ahead of Claude Opus 4.6 on a dedicated cyber-range benchmark.

Those numbers are the core of Anthropic's case for restricting access in the first place: a model this effective at finding exploitable bugs is just as effective in the hands of someone trying to cause harm, so Anthropic ties access to identity verification instead of leaving it open to anyone with an API key.

Why Anthropic restricts Claude Mythos

Anthropic's justification, laid out in its system card for Fable 5.1 and Mythos 5.1, centers on that offensive-cybersecurity capability. The company frames the restriction as a dual-use problem rather than a quality issue: Mythos isn't being held back for lack of polish, it's held back because the same ability that helps a defender patch a browser before attackers find the bug also helps an attacker who gets unsupervised access to the model.

It's worth noting the capability claims aren't universally accepted. Independent researchers have questioned specific figures Anthropic and its partners have cited — including how much credit Mythos specifically deserves for bugs that other, already-public models could plausibly have found on their own — and security researchers tracking disclosure rates have said that only a fraction of vulnerabilities Mythos has surfaced had actually been patched months later, which complicates the "model fixes the internet" framing. See the disputes documented on Claude Mythos's Wikipedia entry for a rundown of the counter-claims. Treat the most dramatic numbers as the company's own framing rather than an independently audited result.

What to do next

If you're a security professional who wants hands-on access, start at Anthropic's Cyber Verification Program page and apply for the tier that matches your work — Defense Access is the fastest path and the most widely available, and it's open to individual researchers with a track record, not just large organizations. If you run a security team doing authorized offensive testing, Red Team Access is the relevant tier, with the understanding that review takes longer and the scope is limited to systems you're cleared to test.

If you just want Mythos-class capability for ordinary development work and don't need the relaxed cybersecurity safeguards, Claude Fable 5.1 is the model to use: same underlying system, standard guardrails, available today through the Claude API, Claude Platform, or a Claude subscription, at the same per-token price as Mythos. And if Anthropic expands access further, adjusts pricing, or ships a Mythos 6 generation down the line, the fastest place to confirm it is Anthropic's own system-cards index, which has logged every release in the Mythos and Fable line to date, alongside the Cyber Verification Program page for the current tier structure and eligibility rules.

Written byTheo Park

Theo Park runs the AI desk at Pandromeda. He follows model launches from the frontier labs and the open-weight community, tracks the assistants and developer tools built on them, and explains what each release changes on pricing, capability and safety. His reporting leans on primary sources: model cards, technical reports, API documentation and the companies' own announcements.

More from Theo ParkAll AI coverage