Direct:
Mythos finds roughly five times more critical vulnerabilities than existing scanners in early enterprise trials. Running it continuously is where the cost becomes the problem. A full scan of a real codebase can run up token bills steep enough that early users are rethinking deployment and budgeting.
Anthropic announced Mythos on April 7, 2026 and chose not to release it publicly, routing it instead through Project Glasswing, a defensive program that hands access to vetted partners. The first cohort was about 50 organizations, and access is expanding to roughly 150 more. Glasswing partners have turned up more than 10,000 high or critical severity flaws, including zero-days in every major operating system and web browser.
Mythos Preview runs $25 per million input tokens and $125 per million output, available through the Claude API, Amazon (NASDAQ: AMZN) Bedrock, Google (NASDAQ: GOOGL) Cloud's Vertex AI, and Microsoft (NASDAQ: MSFT) Foundry. Vulnerability discovery shifts from engineer-hours to API usage, and a thorough scan of a large codebase burns a lot of output tokens. Anthropic is covering preview usage with $100 million in credits, which delays the budget shock for the organizations in the program.
Security researchers told CNBC the alarm is overstated. Existing public models from Anthropic and OpenAI can already find much of what Mythos finds, they argue, and comparable capability will be broadly available within 12 to 18 months, open-source models included. If that timeline is right, the lead is temporary and the price drops as competitors catch up.
The pricing test starts when the credits run out. If Mythos-class scanning becomes the baseline expectation for critical software, the cost lands on whoever owns the codebase, metered in tokens instead of headcount. For the vendors responsible for foundational software, that turns vulnerability scanning into a standing infrastructure cost.
Drafted with AI assistance against parallel reporting.
Sources:
- DigiTimes, “Anthropic's Mythos finds far more vulnerabilities but drives sharply higher scanning costs” (June 8, 2026, paywalled stub: headline and lead only)
- Anthropic, “Project Glasswing” and “Project Glasswing: An initial update” (April-May 2026): ~50 initial partners, 10,000+ high/critical flaws, zero-days in every major OS and browser, $100M usage credits
- Anthropic / Cybersecurity Dive, “Anthropic shares Mythos with 150 more organizations” (May 2026): expansion to ~150 additional orgs including critical infrastructure
- Anthropic red team, “Claude Mythos Preview” (red.anthropic.com, April 7, 2026): model announced and withheld from public release, zero-day capability
- Claude Mythos Preview pricing ($25/$125 per million input/output tokens; Claude API, Amazon Bedrock, Google Cloud Vertex AI, Microsoft Foundry), via Anthropic and Help Net Security (May 26, 2026)
- CNBC, “Anthropic's Mythos set off a cybersecurity 'hysteria.' Experts say the threat was already here” (May 8, 2026): skeptical counterpoint, 12-18 month broad availability, ~5x figure context
Reddit: https://ift.tt/ruf5nUP