Claude Mythos 5 for Critical Infrastructure Defense

Access, governance, and compliance for OT and ICS security teams

Restricted as of July 1, 2026: Claude Mythos 5 is not generally available. Access is limited to vetted partners in Anthropic's Project Glasswing program, with a planned expansion to biomedical researchers (Anthropic). This guide explains Claude Mythos 5 for critical infrastructure teams who defend power, water, and industrial control systems.

Critical infrastructure runs on operational technology, or OT, and industrial control systems, or ICS. These systems were rarely built for modern threats. Defenders need help with threat hunting, detection engineering, and incident analysis.

Claude Mythos 5 is Anthropic's most capable model for high-stakes security work. It is the same base model as Claude Fable 5, but with safeguards lifted for authorized users. This page covers how it works, who can apply, and what to use if you cannot get access.

Reviewed by Jonathan West, Founder of Layer3 Labs, on July 1, 2026. We research using primary vendor and regulator sources.

What Claude Mythos 5 means for critical infrastructure

Claude Mythos 5 for critical infrastructure is a restricted version of Claude Fable 5 with cyber safeguards lifted for vetted defenders. Anthropic released it on June 9, 2026. It is meant for cyberdefenders, infrastructure providers, and biomedical researchers.

The public Claude Fable 5 model blocks high-risk cyber and bio requests. Mythos 5 removes those blocks for approved users only. This lets defenders study attacker techniques that public models refuse to discuss.

For infrastructure teams, this matters in defensive work. Analysts can reason about malware, protocol abuse, and control-system attack paths. The goal is faster detection, not building attacks.

  • Same underlying model as Claude Fable 5, with safeguards lifted for authorized users.
  • Built for high-stakes technical work, including offensive-security research that public Fable 5 blocks.
  • Strong on complex analysis and novel hypothesis generation.
  • Anthropic published a red-team assessment of its cybersecurity capabilities.
Layer3 Labs uses Mythos 5 only for defensive work: threat hunting, detection engineering, and incident analysis. We do not produce attack instructions.
Sources
Anthropic — Claude Fable 5 and Claude Mythos 5

Wondering whether Claude Mythos 5 or Claude Fable 5 fits your critical infrastructure defense program? Layer3 Labs can map it to your OT/ICS workflows, access options, and compliance limits.

Book a Consultation

Defensive use cases for OT and ICS teams

Claude Mythos 5 helps OT and ICS teams with defense-focused analysis, not attack execution. It supports the daily work of a security operations team. Every use case below stays on the defensive side.

Detection engineering is a strong fit. Analysts can turn threat reports into detection logic and test their coverage. The model can also explain why an alert fired.

Incident analysis is another fit. During a suspected intrusion, teams face pressure and limited time. The model can help summarize logs, map events to known techniques, and draft clear reports for leaders.

  • Threat hunting: form and test hypotheses about attacker behavior in OT networks.
  • Detection engineering: draft and refine detection rules from threat intelligence.
  • Incident analysis: reconstruct timelines and map activity to known attacker techniques.
  • Log triage: summarize large volumes of ICS and network telemetry.
  • Tabletop prep: build realistic defensive scenarios for exercises.
A non-obvious tradeoff: OT networks often cannot run modern endpoint agents, so detections lean on network and protocol telemetry. Feed the model your actual sensor coverage, or it will suggest detections you cannot deploy.

How to get access through Project Glasswing

Access to Claude Mythos 5 is only available through Anthropic's Project Glasswing, a restricted program for cyber-defense and infrastructure partners. There is no public sign-up. Infrastructure providers are eligible to apply, but they are not auto-approved.

Anthropic vets each applicant before granting access. A planned expansion will reach biomedical researchers through a trusted-access program. That expansion removes biology safeguards while keeping cyber safeguards.

US organizations' access was restored on June 26, 2026 after US government approval. This followed a brief June export-control review. Access status can change, so confirm current terms before you plan around it.

  • Access is limited to vetted partners in Project Glasswing.
  • Infrastructure providers are eligible to apply, not automatically approved.
  • Cyberdefenders and infrastructure providers are the current audience.
  • Biomedical researcher access is planned through a separate trusted-access program.
Sources
Anthropic — Assessing Claude Mythos Preview's cybersecurity capabilities

Compliance and data handling for regulated operators

Claude Mythos 5 business accounts carry a mandatory 30-day safety retention. That means data is kept for up to 30 days for safety review, then deleted. Full zero-data-retention is not available on this model.

Because Mythos 5 ships through a restricted program, its compliance terms are program-specific. The usual Enterprise BAA and zero-retention terms do not automatically apply. Confirm your exact terms inside the Glasswing agreement.

Critical infrastructure operators often face sector rules and safety requirements. Do not assume standard Enterprise coverage carries over. Review the program terms with your legal and compliance teams first.

  • Mandatory 30-day safety retention on business accounts.
  • Data is used only for safety, then deleted.
  • Full zero-data-retention is not available on Mythos 5.
  • Compliance terms are program-specific, not standard Enterprise terms.
A decision criterion for OT teams: never paste live control-system credentials, network diagrams, or asset inventories into a model with mandatory retention. Redact identifiers and work from sanitized data.
Sources
Anthropic — Claude Fable 5 and Claude Mythos 5

The Claude Fable 5 alternative if you cannot get Mythos 5

The deployable alternative for anyone who cannot get Mythos 5 is Claude Fable 5. It is the same base model with safeguards left on. It is generally available worldwide as of July 1, 2026.

Most defensive work does not need the lifted safeguards. Detection tuning, log triage, and report writing all work well on Fable 5. Anthropic reports more than 95% of Fable 5 sessions never trigger a safeguard fallback.

Fable 5 also offers broader compliance coverage. It inherits Anthropic SOC 2, ISO 27001, and ISO 42001, plus a HIPAA BAA on the API and Enterprise plans. Start here while your Glasswing application is under review.

  • Claude Fable 5: same base model, safeguards on, GA worldwide as of July 1, 2026.
  • Handles most defensive tasks without needing Mythos 5 access.
  • More than 95% of Fable 5 sessions never trigger a safeguard fallback.
  • Inherits SOC 2, ISO 27001, ISO 42001; HIPAA BAA on API and Enterprise plans.
Sources
Anthropic — Redeploying Claude Fable 5

Claude Mythos 5 vs Claude Fable 5 for infrastructure defense

Claude Mythos 5 and Claude Fable 5 share the same base model, so the choice comes down to access and safeguards. Mythos 5 lifts cyber safeguards but is restricted. Fable 5 keeps safeguards on but is available to everyone.

The table below compares the two for critical infrastructure defense. Use it to decide which one fits your team today. Most teams should start with Fable 5.

  • Access: Mythos 5 is restricted to Project Glasswing partners; Fable 5 is generally available.
  • Safeguards: Mythos 5 lifts cyber safeguards for vetted users; Fable 5 keeps them on.
  • Compliance: Mythos 5 terms are program-specific; Fable 5 carries standard Enterprise coverage.
  • Retention: both business accounts carry a mandatory 30-day safety retention.
  • Verdict: choose Mythos 5 only if your defensive research needs the lifted safeguards and you qualify; otherwise choose Fable 5.
When to choose Mythos 5: your team is a vetted infrastructure defender whose threat-hunting or detection research needs analysis that public Fable 5 blocks. Otherwise, Fable 5 covers the work.

Frequently Asked Questions

  • Not automatically. Infrastructure providers are eligible to apply through Anthropic's Project Glasswing, but they are not auto-approved. Anthropic vets each applicant before granting access, and there is no public sign-up.
  • Claude Mythos 5 is the same base model as Claude Fable 5, but with cyber safeguards lifted for authorized users. Public Fable 5 blocks high-risk cyber requests. Mythos 5 removes those blocks for vetted defenders only.
  • Yes, for defensive work. It can help form and test hypotheses about attacker behavior, draft detection logic, and analyze incidents. It should not be used to build or run attacks against live systems.
  • Use Claude Fable 5. It is the same base model with safeguards left on and is generally available worldwide as of July 1, 2026. It handles most defensive tasks like detection tuning, log triage, and report writing.
  • Yes. Business accounts carry a mandatory 30-day safety retention. Data is used only for safety, then deleted. Full zero-data-retention is not available on Mythos 5.
  • No. Because Mythos 5 ships through a restricted program, its terms are program-specific. The usual Enterprise BAA and zero-retention terms do not automatically apply. Confirm your terms inside the Project Glasswing agreement.
  • US organizations' access was restored on June 26, 2026 after US government approval. This followed a brief June export-control review. Access status can change, so confirm current terms before planning around it.
  • Layer3 Labs uses Mythos 5 only for defensive work such as threat hunting, detection engineering, and incident analysis. We do not produce operational attack instructions. Keep any engagement scoped to authorized, defensive use.

Plan your AI-assisted infrastructure defense

Book a free 30-minute AI workflow audit with Layer3 Labs. We help critical infrastructure teams map Claude Mythos 5 or Claude Fable 5 to defensive workflows, compliance limits, and real sensor coverage.

Book Your Free Audit