The Model Stays Home. The Patch Ships.

Ask which enterprise security teams get direct access to the version of Claude Mythos 5 that can hunt a zero-day in code nobody's read in twenty years, and the answer is almost none of them. What they get instead is the finding.

That's the shape of Anthropic's latest cybersecurity move. Claude Security, in public beta for Enterprise customers, now runs codebase vulnerability scans on Mythos 5 itself, billed as ordinary token usage, no separate add-on, no special contract tier. What comes back is a CWE-categorized finding, a confidence and severity rating, and a suggested patch, built for a human to review before it ships through Claude Code. Anthropic paired the release with the Defender Advantage Fund, thirty-five million dollars in Claude credits earmarked for organizations patching vulnerabilities in open-source projects, and confirmed it's widening the Cyber Verification Program's reduced-safeguard access from Opus and Sonnet toward Mythos-class models over the coming weeks.

None of that hands a customer the raw model. It hands them a governed product surface built on top of it.

Export-controlled aerospace testing has run on this same logic for decades. A wind tunnel rated for hypersonic flow doesn't get sold to every aerospace firm that wants to test a new airframe. The lab that owns it runs the firm's design through the tunnel, sends back the pressure data and the stall points, and keeps the tunnel. The firm gets the numbers its design needs. It never gets the machine that can test anyone else's design too. The capability that matters, finding where a shape breaks under conditions almost nobody can generate on their own, stays put. What travels is the output, metered and reviewable on the way out the door.

I've made the same argument about governance generally, just aimed the other direction. The four-layer runtime model I've written about, policy, inventory, monitoring, and a gateway that intercepts an agent's action before it executes, exists because a prompt telling an agent what not to do is a suggestion, and an access policy the system enforces before the action runs is a boundary. Anthropic built the vendor-side version of that same boundary around its own most dangerous capability, structuring the product so the model's raw capability never leaves the building, regardless of how carefully Mythos 5 is instructed to use it.

That's the right architecture for a lab's own dual-use risk, and it solves exactly half the problem. Claude Security's finding lands inside a customer's environment as an input still requiring judgment, and what happens to that input depends entirely on whether the customer has a control plane of its own. A CWE-categorized finding with a confidence score is a claim about the codebase, generated by the same kind of system whose benchmark claims need a second party before they land in a client recommendation. Feeding that finding straight into an automated patch pipeline without an evaluation baseline to check it against is the mistake I've watched governance programs make for years in a different form: treating a vendor's output as verified because the vendor's process sounds rigorous, then discovering the gap when something ships that shouldn't have.

The pathway forward is building the second gate, the one on the customer's side of the handoff, so the finding gets evaluated against the codebase's actual behavior and the patch clears a real approval step before Claude Code touches production, the same sequence layer four already requires for any other agent action.

That has a different weight depending on who's asking. For the security engineer doing the review, the job has quietly changed shape: less time spent hunting for the vulnerability, more time spent judging whether an AI-generated finding and patch are trustworthy enough to ship, which is a different skill than the one most of them trained for. For the organization buying the product, the real question isn't whether Anthropic's access-by-output model is safe, it's whether the organization's own runtime layer is mature enough to be the second check that model was never designed to be. For the industry watching this launch, it's a template. Cybersecurity is the first capability serious enough to force a frontier lab to build this kind of product-layer gate around itself, and whether it holds under real adversarial pressure will decide whether regulators treat access-by-output as sufficient control for the next dual-use capability, or start asking for something more.