Anthropic's Claude Mythos 5.2 Achieves High Scores on Cybersecurity Benchmarks
Anthropic has released Claude Mythos 5.2, an AI model for cybersecurity engineering, demonstrating improved vulnerability discovery and reproduction capabilities on industry benchmarks.
Anthropic has announced the release of Claude Mythos 5.2, its latest artificial intelligence model specifically engineered for cybersecurity tasks. The new model has achieved a notable 76.3% score on the CyScenarioBench, a significant improvement over its predecessor, Mythos 5.1, which scored 61.7%. This advancement highlights the model's growing proficiency in identifying and analyzing software vulnerabilities.
In addition to its performance on CyScenarioBench, Mythos 5.2 also demonstrated strong results on Anthropic's internal CVE Rediscovery evaluation, scoring 89.6%. This internal benchmark, which tests the model's ability to rediscover known vulnerabilities based on pre-fix project code, saw Mythos 5.2 outperform Mythos 5.1 (78.3%) and even the safeguarded Opus 5.5 (81.3%). The evaluation covered 1,829 published vulnerabilities, assessing the models' capacity to independently locate the underlying flaws.
It is crucial to distinguish these benchmark scores from a zero-day detection rate. Anthropic emphasizes that rediscovering documented vulnerabilities is not equivalent to discovering entirely new, unknown flaws. While Mythos 5.2 enhances vulnerability discovery, reproduction, and repair capabilities, the reported scores do not signify a 76.3% success rate in finding zero-day exploits. The model's development builds upon previous work in vulnerability research and code scanning, integrating these advancements into its core functions.
Access to Claude Mythos 5.2 remains controlled due to the potential for misuse by malicious actors. Anthropic continues to implement tiered access programs and integrate the model into its Claude Security platform for enterprise customers. This approach aims to balance the benefits of advanced AI for security professionals with the need to prevent exploitation by adversaries. Previous iterations of Mythos were integrated into Claude Security, offering model-powered insights and suggested fixes without granting unrestricted access.
Early testing by a security company indicated that Mythos 5.2 identified one in six confirmed bugs that other tested frontier models missed. Another tester reported a reduction in exaggerated severity ratings for identified vulnerabilities. While these are promising individual results, Anthropic cautions that they do not guarantee consistent performance across all codebases or eliminate the possibility of false alarms.
Mythos 5.2 shares its underlying architecture with Claude Fable 5.2, but with differing safeguards. Mythos is designed for approved research through verification programs, while Fable incorporates stricter restrictions for cybersecurity and biology work. Both models offer up to 30% faster output generation compared to their predecessors, with standard pricing set at $8 per million input tokens and $40 per million output tokens.
Anthropic offers the Cyber Verification Program with Defense, Red Team, and Specialized Access tiers. Defense Access is available to individuals, while higher tiers require organizational approval for tasks like penetration testing and exploit development. All access levels are subject to Anthropic's usage restrictions, and enterprise customers can leverage Mythos 5.2 via Claude Security, which continuously scans repository changes, tracks fixes, and reopens findings if flaws reappear. The platform integrates with API and MCP connections to streamline workflows, though human review and approval of proposed patches remain essential for critical systems.
The latest release, Claude Mythos 5.2, also introduces enhanced safeguards for cybersecurity and biology tasks. Specifically, the Fable version of the model now more strictly blocks high-risk cybersecurity activities such as penetration testing and exploit generation. When a request is blocked, Fable serves a response from Opus 4.8 for cybersecurity tasks or Opus 5 for other categories, aiming to reduce sandbox-breaking behavior and improve overall model stability.