IBM plans to bring Anthropic’s Claude Mythos to enterprise customers

IBM plans to add Anthropic’s Claude Mythos to Concert Protect so customers can scan their own code for unknown flaws, test which are exploitable and get fixes for developers to approve. It is aiming for early 2027. Mythos itself remains limited to vetted organisations.

IBM plans to build Anthropic’s Claude Mythos into its Concert Protect security software, the company said on Monday. Mythos is so good at finding security flaws that only vetted groups can use it. IBM wants to offer the feature in early 2027.

Mythos would scan code that customers pick for flaws no one knew about, including ones that normal scanners miss. Concert Protect would then check whether hackers could really use each flaw in that customer’s systems.

IBM and Red Hat tools would draft fixes, which developers must review and approve before they go in. IBM cautioned that its plans could change. It is not betting on one lab: in June it joined OpenAI’s cyber programme for a similar service.

“The bottleneck is no longer finding vulnerabilities. It is determining which can actually be exploited and fixing them before attackers do,” IBM wrote.

That gap is real. Project Glasswing, Anthropic’s restricted Mythos programme, flagged more than 10,000 possible serious flaws in its first month, but only 97 had been patched by then.

IBM says its past Mythos work, through Glasswing, was internal research. This is its first step toward selling it to customers. That fits Anthropic’s plan to put Mythos inside partners’ products, where users get findings and fixes rather than the model itself.

Access to Mythos is tightly controlled. Anthropic briefly switched it off in June to comply with US export controls, and the White House now reportedly decides who joins its partner list. Anthropic released Mythos 5.2 on Monday, still only for vetted organisations.