Claude Mythos 5 for Cybersecurity Teams and MSSPs

Restricted as of July 1, 2026: Claude Mythos 5 is not generally available. Access is limited to vetted partners in Anthropic's Project Glasswing program, with a planned expansion to biomedical researchers (Anthropic). This guide explains Claude Mythos 5 for cybersecurity teams and managed security service providers (MSSPs).

Claude Mythos 5 shares the same base model as Claude Fable 5. The difference is access. Anthropic lifts certain safeguards for authorized cyber defenders.

Most security teams cannot get Mythos 5 yet. This guide covers who qualifies, how governance works, and what to use instead. It focuses on capabilities, access, and compliance, not attack instructions.

Reviewed by Jonathan West, Founder of Layer3 Labs, on July 1, 2026. We research using primary vendor and regulator sources.

What Claude Mythos 5 for cybersecurity is

Claude Mythos 5 for cybersecurity is a restricted version of Anthropic's most capable technical model, released June 9, 2026. It uses the same base model as Claude Fable 5, but with some safeguards lifted for authorized users.

The lifted safeguards allow offensive-security research that public Fable 5 blocks. That work is limited to vetted cyber defenders, infrastructure providers, and biomedical researchers.

Anthropic published a red-team assessment of the model's cybersecurity capabilities. It is strong on complex analysis and technical reasoning.

• Same base model as Claude Fable 5, with safeguards lifted for authorized users.
• Built for high-stakes technical work, including offensive-security research.
• Access is limited to vetted partners, not the general public.
• Anthropic ran a red-team review of its cyber capabilities before release.

How to get access to Claude Mythos 5 for cybersecurity

Access to Claude Mythos 5 comes only through Anthropic's Project Glasswing program. Glasswing is a restricted program for cyber-defense and infrastructure partners.

You cannot buy Mythos 5 on the standard Claude platform or self-serve. Your organization must be vetted and approved as a partner.

US organizations' access was restored on June 26, 2026. This followed US government approval after a brief June export-control review.

• Route: Project Glasswing, a restricted partner program.
• Eligible today: cyber-defense and infrastructure partners.
• Planned expansion: biomedical researchers via a trusted-access program.
• US access restored June 26, 2026, after government approval.

Governance and safeguards for Claude Mythos 5 for cybersecurity

Governance for Claude Mythos 5 sits in Anthropic's Project Glasswing program, not in your standard admin console. The program vets partners before granting access.

The biomedical expansion removes biology safeguards but keeps cyber safeguards in place. This shows Anthropic gates capabilities by partner type, not all at once.

A non-obvious tradeoff matters here. Because the safeguards are lifted, your own internal controls carry more of the load. Access reviews, logging, and staff vetting become your responsibility, not the model's.

• Vetting happens at the program level before access is granted.
• Capabilities are gated by partner type, not opened all at once.
• Lifted safeguards shift more control responsibility onto your team.
• Plan internal access reviews, logging, and staff vetting up front.

Compliance and data handling for security teams

Claude Mythos 5 business accounts carry a mandatory 30-day safety retention. Anthropic uses that data only for safety, then deletes it.

Mythos 5 ships through a restricted program, not the standard Enterprise surface. So its compliance terms are program-specific.

The usual Enterprise BAA and zero-retention terms do not automatically apply. Confirm your exact terms with Anthropic before you send any regulated or client data.

• Mandatory 30-day safety retention on business accounts.
• Compliance terms are set by the Glasswing program, case by case.
• Standard Enterprise BAA and zero-retention are not automatic.
• Verify data terms in writing before sending regulated data.

The Claude Fable 5 fallback for teams without access

Claude Fable 5 is the deployable alternative for any team that cannot get Mythos 5. It is the same base model with safeguards on, generally available worldwide as of July 1, 2026.

Fable 5 blocks high-risk cyber and bio requests and falls back to Claude Opus 4.8. Anthropic reports more than 95% of Fable 5 sessions never trigger a fallback.

For most defensive work, Fable 5 covers the need. Use it for alert triage summaries, policy drafting, and code review, where the blocked capabilities do not apply.

• Fable 5 is GA worldwide as of July 1, 2026.
• Same base model as Mythos 5, with safeguards active.
• High-risk cyber and bio requests fall back to Opus 4.8.
• Over 95% of Fable 5 sessions never trigger a fallback.

Claude Mythos 5 vs Claude Fable 5 for cybersecurity

The choice between Mythos 5 and Fable 5 comes down to access and whether you need lifted safeguards. Both run on the same base model.

Mythos 5 fits vetted cyber-defense partners who need offensive-security research. Fable 5 fits every other team that wants a deployable model today.

• Access: Mythos 5 is Glasswing-only; Fable 5 is available worldwide.
• Safeguards: Mythos 5 lifts some; Fable 5 keeps them on.
• Compliance: Mythos 5 is program-specific; Fable 5 uses Enterprise terms.
• Verdict: use Fable 5 unless you are a vetted partner needing lifted capabilities.