Artificial Intelligence

Anthropic’s Opus 5 Nears Mythos 5 on Finding Bugs, but Falls Short on Exploits

Binary-based vulnerability scanning, penetration testing, and exploit generation are blocked in Opus 5.

Anthropic

Anthropic on Friday rolled out Claude Opus 5, pitching it as a cheaper alternative to its top-tier Fable 5 model. In terms of cybersecurity, the new model is nearly as good as the AI giant’s most capable system, Mythos 5, at spotting software vulnerabilities, but remains well behind it in turning those findings into working exploits.

The difference comes from Anthropic’s own OSS-Fuzz-based evaluation, which measures how well a model can locate and then exploit vulnerabilities with minimal human steering. According to the company, Opus 5 identifies vulnerabilities at a rate close to Mythos 5, but its exploit-development score trails considerably. 

Anthropic frames this as a deliberate outcome, noting that it has avoided training Opus 5 directly on offensive cyber tasks. The gains it does show, the company says, are a byproduct of broader capability improvements.

Opus 5’s safety classifiers are tuned to be less restrictive than those on Fable 5, with Anthropic expecting roughly 85 percent fewer interventions. 

The model is permitted to search for vulnerabilities directly in source code, but binary-based vulnerability scanning, penetration testing, and exploit generation remain blocked. Requests that trip those classifiers fall back automatically to the older Opus 4.8 model inside Claude.ai, Claude Code, and Claude Cowork.

Enterprises and researchers enrolled in Anthropic’s Cyber Verification Program can get a version of Opus 5 with those restrictions loosened further.

Mythos 5 also remains withheld from general release, while Fable 5 is described as the safeguarded, publicly available counterpart built on the same underlying model. Both models were taken offline by Anthropic last month due to the Trump administration’s concerns over their use by foreign nationals. The restrictions were later lifted.

Advertisement. Scroll to continue reading.

Pricing for Opus 5 holds at $5 per million input tokens and $25 per million output tokens (same as for Opus 4.8), with a faster-response mode available at double the base rate.

Related: Nuclear-Sabotage Malware Benchmark Trips Up Most Frontier AI Models

Related: CISA Reportedly Using Anthropic’s Mythos to Scan Government Software for Flaws

Related: OpenAI and Anthropic Limit New AI Models to Trump-Approved Customers During Cybersecurity Review

Related Content

Artificial Intelligence

Xint says a flaw in OpenAI’s compaction process let researchers move reasoning traces between models, potentially making it cheaper to distill a rival AI.

Artificial Intelligence

The model engaged in severe overreach and dishonesty, creating fake identities and submitting malicious code on GitHub.

Artificial Intelligence

The state-sponsored hackers targeted hundreds of organizations and gained privileged access to some environments.

Artificial Intelligence

Hackers used compromised GitHub CLI OAuth tokens to push and approve malicious packages on PyPI and Docker.

Artificial Intelligence

Deceptive prompts lure AI agents into decoys and dead ends, cutting attack success by up to 91% in tests and raising the cost of...

Cybersecurity Funding

Asymptote Labs raises $5.5M seed led by Tower Research Ventures to commercialize its Beacon AI agent runtime security platform.

Artificial Intelligence

In two internal incidents, agents read routine coding instructions as permission to weaken monitoring, and one gave a false answer about it.

Artificial Intelligence

Tasked with writing an application for a US defense contractor, the model made the code 19% more likely to be hackable.

Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.

Exit mobile version