Virtual Event Today: CodeSecCon - Learn to Secure Your Software > Join Event
Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Artificial Intelligence

Anthropic’s Opus 5 Nears Mythos 5 on Finding Bugs, but Falls Short on Exploits

Binary-based vulnerability scanning, penetration testing, and exploit generation are blocked in Opus 5.

Anthropic

Anthropic on Friday rolled out Claude Opus 5, pitching it as a cheaper alternative to its top-tier Fable 5 model. In terms of cybersecurity, the new model is nearly as good as the AI giant’s most capable system, Mythos 5, at spotting software vulnerabilities, but remains well behind it in turning those findings into working exploits.

The difference comes from Anthropic’s own OSS-Fuzz-based evaluation, which measures how well a model can locate and then exploit vulnerabilities with minimal human steering. According to the company, Opus 5 identifies vulnerabilities at a rate close to Mythos 5, but its exploit-development score trails considerably. 

Anthropic frames this as a deliberate outcome, noting that it has avoided training Opus 5 directly on offensive cyber tasks. The gains it does show, the company says, are a byproduct of broader capability improvements.

Opus 5’s safety classifiers are tuned to be less restrictive than those on Fable 5, with Anthropic expecting roughly 85 percent fewer interventions. 

The model is permitted to search for vulnerabilities directly in source code, but binary-based vulnerability scanning, penetration testing, and exploit generation remain blocked. Requests that trip those classifiers fall back automatically to the older Opus 4.8 model inside Claude.ai, Claude Code, and Claude Cowork.

Enterprises and researchers enrolled in Anthropic’s Cyber Verification Program can get a version of Opus 5 with those restrictions loosened further.

Mythos 5 also remains withheld from general release, while Fable 5 is described as the safeguarded, publicly available counterpart built on the same underlying model. Both models were taken offline by Anthropic last month due to the Trump administration’s concerns over their use by foreign nationals. The restrictions were later lifted.

Advertisement. Scroll to continue reading.

Pricing for Opus 5 holds at $5 per million input tokens and $25 per million output tokens (same as for Opus 4.8), with a faster-response mode available at double the base rate.

Related: Nuclear-Sabotage Malware Benchmark Trips Up Most Frontier AI Models

Related: CISA Reportedly Using Anthropic’s Mythos to Scan Government Software for Flaws

Related: OpenAI and Anthropic Limit New AI Models to Trump-Approved Customers During Cybersecurity Review

Written By

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default.

Register

CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps!

Register

People on the Move

Daniel Dubowski has been named Senior Vice President and Chief Information Security Officer at Marriott International.

Allied Universal has named Jordan Avnaim Global Chief Information Security Officer.

Cycode has promoted Seth Robbins to President and Chief Revenue Officer.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.