Anthropic launches Claude Mythos 5.2 to improve vulnerability detection

New benchmarks for security

Anthropic recently released Claude Mythos 5.2, a specialized AI model designed for cybersecurity engineering. As reported by CyberSecurityNews, the model is built to help security teams find, reproduce, and fix software vulnerabilities. It represents a significant step forward in using large language models to automate parts of the software security lifecycle.

The model achieved a score of 76.3% on CyScenarioBench, which is a notable improvement over the 61.7% score of its predecessor, Mythos 5.1. This gain of 14.6 percentage points suggests the model is becoming more proficient at navigating complex security scenarios. However, Anthropic notes that different labs use different tasks on this benchmark, making direct comparisons with other models difficult.

In addition to the CyScenarioBench, the model was tested on an internal CVE Rediscovery evaluation. This test involved 1,829 published vulnerabilities where the model was given project code from before a fix was applied. The goal was to see if the AI could independently locate the underlying flaw, which Mythos 5.2 did with an 89.6% success rate.

Distinguishing known from unknown

It is important to understand what these scores actually represent in a real-world context. Rediscovering known vulnerabilities is not the same as finding new zero-day flaws that are currently unknown to software developers. The benchmarks measure how well the model can identify documented issues rather than proving it can find every hidden bug in a new system.

Anthropic clarifies that the 76.3% score does not establish a specific success rate for detecting unknown zero-day flaws. Instead, the model is designed to improve the discovery, reproduction, and repair of vulnerabilities that exist within a codebase. This distinction is vital for security professionals who need to know the limits of AI-assisted auditing.

Despite these limitations, independent testing has shown promising results for the model's accuracy. One security company found that other tested frontier models missed one in six confirmed bugs that Mythos 5.2 successfully identified. Another tester noted that the model produced fewer exaggerated severity ratings during its evaluation.

Controlled access and tiers

Because the skills required to find and fix vulnerabilities can also be used by attackers, Anthropic maintains controlled access to Mythos 5.2. The company uses a Cyber Verification Program to manage how different users interact with the model. This program includes Defense, Red Team, and Specialized Access tiers to ensure the technology is used responsibly.

Individuals can apply for Defense Access, while higher tiers require formal organizational approval. For example, Red Team Access is specifically designated for authorized penetration testing and exploit development. Anthropic continues to apply usage restrictions across all tiers to prevent the model from being used for malicious purposes.

Enterprise customers have a different path to the technology through a service called Claude Security. This allows them to access model-powered findings and suggested fixes without needing to join the formal verification program. This separation ensures that businesses can benefit from the AI's capabilities while Anthropic maintains a strict oversight framework for more sensitive research tasks.

Integration into workflows

The release of Mythos 5.2 also brings performance improvements, with the model generating output up to 30% faster than previous versions. It is priced at $8 per million input tokens and $40 per million output tokens. These efficiencies help security teams process larger amounts of code more quickly during the discovery phase.

For organizations already using Claude Security, the model integrates into existing development and security workflows. The service can check repository changes, track fixes, and automatically reopen findings if a previously patched flaw returns. It also uses API and MCP connections to move these findings directly into the tools that developers use every day.

Despite these automated capabilities, Anthropic emphasizes that human review remains central to the process. Security teams must still review and approve any proposed patches, particularly for critical systems. While the AI can shorten the time spent on investigations, humans are still required to validate the impact of a flaw and test the final fix.