{"slug": "anthropic-puts-claude-security-s-github-scanner-behind-an-enterprise-login", "title": "Anthropic puts Claude Security's GitHub scanner behind an Enterprise login", "summary": "Anthropic has placed Claude Security, its hosted vulnerability scanner for GitHub repositories, into public beta for Claude Enterprise customers as of late April 2026, while keeping its more capable Mythos 5 model in a separate trusted-access program. The scanner analyzes code across files, traces data flows, and provides findings with CWE categories, severity ratings, and suggested fixes, but does not give Enterprise customers access to Mythos 5, which is priced at $10 per million input tokens and $50 per million output tokens.", "body_md": "# Anthropic puts Claude Security's GitHub scanner behind an Enterprise login\n\n**Claude Security entered public beta for Claude Enterprise customers in late April 2026; Anthropic keeps the more capable Mythos 5 in a separate trusted-access program.**\n\nBy [RuntimeWire Staff](/author/runtimewire-staff)\n· Published\n\nPrimary source: [Claude](https://x.com/claudeai/status/2090852316328902930)\n\n## Why it matters\n\nClaude Security turns repository scanning and remediation into additional Claude usage for Enterprise customers, while Anthropic reserves Mythos 5's more sensitive cyber capabilities for vetted partners.\n\n[Dario Amodei](https://www.hertzfoundation.org/people/dario-amodei/?ref=runtimewire) and [Daniela Amodei](https://stripe.com/newsroom/stories/anthropic-interview?ref=runtimewire)'s [Anthropic](https://www.anthropic.com/?ref=runtimewire) put Claude Security, its hosted vulnerability scanner for GitHub repositories, into public beta for Claude Enterprise customers in late April 2026. The [public-beta announcement](https://claude.com/blog/claude-security-public-beta?ref=runtimewire) describes the hosted service's model separately from the official Claude account post discussed below.\n\nAnthropic first released the product as Claude Code Security in a [limited research preview on February 20](https://www.anthropic.com/news/claude-code-security?ref=runtimewire). Users can point the service at a repository and receive findings with CWE categories, confidence and severity ratings, and suggested fixes.\n\nAn official Claude account post, whose publication date is not established in the supplied capture, describes Mythos as the model scanning repositories. The available sources do not establish whether the hosted service later switched models or whether the post describes a separate deployment.\n\nThat distinction matters because Anthropic distributes Mythos 5 through a separate trusted-access program. Anthropic [announced Mythos 5 on June 9](https://www.anthropic.com/news/claude-fable-5-mythos-5?ref=runtimewire) as an upgrade to Mythos Preview, initially for approved Project Glasswing partners.\n\nDario Amodei, a physicist who worked at Baidu, Google Brain and OpenAI, co-founded Anthropic after arguing for stronger controls around increasingly capable models. Daniela Amodei, Anthropic's co-founder and president, previously held operations, recruiting and risk roles at Stripe and became OpenAI's vice president of safety and policy. Claude Security reflects that concern through a hosted workflow, although it does not give Enterprise customers access to Mythos 5.\n\n### Two security products, neither a Mythos endpoint\n\nAnthropic's hosted Claude Security service and its similarly named Claude Security plugin use different deployment models. Enterprise scans run through Anthropic's platform. The [Claude Security plugin](https://claude.com/plugins/claude-security?ref=runtimewire) runs locally and uses the Claude access the customer already has.\n\nMythos 5 remains separate. Anthropic describes it as its most capable model for cybersecurity and biology research and says access is limited to a small group of vetted partners because the same capabilities could be misused to create cyberattacks or dangerous weapons. The [Mythos product page](https://www.anthropic.com/claude/mythos?ref=runtimewire) lists trusted-access pricing starting at $10 per million input tokens and $50 per million output tokens.\n\n### The scanner's actual job\n\nClaude Security connects to GitHub repositories and analyzes code across files. Anthropic says the scanner traces data flows, reasons about interactions among components and looks for vulnerabilities whose exploitability depends on the surrounding application rather than an isolated line of code.\n\nAnthropic says each candidate passes through multiple stages of self-verification before appearing in the product. A finding includes its location, impact, reproduction steps, severity, category and recommended remediation. The official Claude post specifically lists the CWE category, confidence and severity ratings, and a suggested fix.\n\nThe output remains a recommendation for human review. Customers can open a proposed fix in Claude Code and work through the change using a model available in their account, according to Anthropic's [product documentation](https://support.claude.com/en/articles/14661296-use-claude-security?ref=runtimewire).\n\nAnthropic charges direct token costs for scans and says it adds no separate Claude Security platform fee. That pricing makes the scanner a consumption surface for Claude rather than a separately metered security suite. Discovery generates model usage, and remediation sends the engineer into Claude Code. Anthropic therefore owns both ends of the workflow: finding the flaw and producing a candidate patch.\n\nThat product design fits Anthropic's expansion across Claude products. RuntimeWire reported that [Claude Cowork reached every paid plan](/article/anthropic-claude-cowork-all-paid-plans-web-mobile), while [Claude Academy turned training into product onboarding](/article/anthropic-claude-academy-employee-ai-training). Claude Security applies the same playbook to a higher-stakes task, with access narrowed to Enterprise customers. Anthropic keeps Mythos 5 in a separate trusted-access program.\n\n### The number Anthropic still has to prove\n\nAnthropic says Mythos Preview and roughly 50 early partners identified more than 10,000 high- or critical-severity vulnerabilities. That figure describes model-reported findings at scale. It does not equal 10,000 independently confirmed and patched vulnerabilities.\n\nIn Anthropic's [assessment of Mythos Preview](https://www.anthropic.com/research/mythos-preview?ref=runtimewire), contractors manually reviewed the severity assigned to 198 reports. They agreed exactly with the model in 89% of those cases and came within one severity level in 98%. Anthropic also acknowledged that additional findings were still moving through validation and coordinated disclosure.\n\nThat distinction matters for customers budgeting around AI-assisted security tools. Faster discovery creates value when findings survive verification, reach the correct engineering owner and become patches that can safely ship. Claude Security attempts to cover that workflow rather than stopping at a raw count.\n\nThe [hosted service currently supports GitHub repositories](https://support.claude.com/en/articles/14661296-use-claude-security?ref=runtimewire) and limits scanning to code the customer or organization owns or has the necessary rights to scan. Anthropic's documentation also says scans are stochastic because the agent adapts its analysis during each run, so repeated scans can produce different findings.\n\n### GitHub controls the competing workflow\n\nAnthropic enters a market where GitHub already controls the repository, pull request and merge gate. In March, [GitHub said](https://github.blog/security/application-security/github-expands-application-security-coverage-with-ai-powered-detections/?ref=runtimewire) it was pairing CodeQL with AI-powered detections for languages and frameworks that traditional static analysis did not cover. Its findings and suggested fixes appear inside pull requests through GitHub Code Security and Copilot Autofix.\n\nClaude Security's pitch is repository-wide reasoning: trace business logic and data movement, then verify a candidate finding before an analyst sees it. GitHub's advantage is distribution and enforcement at the point where code merges. Security vendors such as Snyk also occupy the workflow, and [Snyk is embedding Claude](https://snyk.io/jp/news/snyk-embeds-anthropics-claude-to-advance-ai-powered-security-for-software-development/?ref=runtimewire) into its own software-security products. Anthropic can compete with those platforms while supplying some of them with models.\n\nAnthropic is betting that its security models can find enough difficult, valid vulnerabilities to offset that distribution gap. Claude Security places the model inside a managed scanning service and routes proposed remediation into Claude Code. Mythos 5, meanwhile, remains a different product with a much shorter customer list.", "url": "https://wpnews.pro/news/anthropic-puts-claude-security-s-github-scanner-behind-an-enterprise-login", "canonical_source": "https://runtimewire.com/article/anthropic-claude-security-mythos-5-github-scans", "published_at": "2026-08-21 17:32:08+00:00", "updated_at": "2026-08-21 17:45:09.555686+00:00", "lang": "en", "topics": ["ai-products", "ai-safety", "ai-tools"], "entities": ["Anthropic", "Claude Security", "GitHub", "Mythos 5", "Dario Amodei", "Daniela Amodei", "Claude Code Security", "Project Glasswing"], "alternates": {"html": "https://wpnews.pro/news/anthropic-puts-claude-security-s-github-scanner-behind-an-enterprise-login", "markdown": "https://wpnews.pro/news/anthropic-puts-claude-security-s-github-scanner-behind-an-enterprise-login.md", "text": "https://wpnews.pro/news/anthropic-puts-claude-security-s-github-scanner-behind-an-enterprise-login.txt", "jsonld": "https://wpnews.pro/news/anthropic-puts-claude-security-s-github-scanner-behind-an-enterprise-login.jsonld"}}