Anthropic’s Claude Mythos 5 Cleared for Limited US Critical Infrastructure Access After Security Review

Anthropic’s Claude Mythos 5 is returning to a small group of American organisations — but only just. The US Commerce Department, which ordered both Mythos 5 and its sibling configuration Fable 5 taken offline globally around mid-June, has now notified Anthropic that Mythos 5 can be redeployed to roughly 100 vetted US companies, federal agencies, critical infrastructure providers and cybersecurity organisations. Fable 5, the safety-hardened version of the same underlying model, remains disabled pending further government review.

The figures show just how restricted this redeployment is. Around 100 organisations — drawn from critical infrastructure operators, Fortune 500 companies and cybersecurity bodies — have reportedly been cleared for access under the Trump administration’s conditional authorisation. That is a far cry from general public availability, which Anthropic has said it does not plan to restore for Mythos-class models in their current form.

What Mythos 5 Actually Is

It’s worth being precise about the model involved, because the naming can confuse. Fable 5 and Mythos 5 are not two separate AI systems. They are two configurations of the same model. Fable 5 is the version with full safety classifiers active — high-risk requests in domains like advanced cybersecurity or biology are flagged, routed, or blocked. Mythos 5 is the same model with some of those constraints loosened, specifically for vetted professional use in high-stakes environments.

Anthropic describes Mythos 5 as having the strongest cybersecurity capabilities of any model the company has produced. That means it can identify and exploit complex software vulnerabilities that have persisted despite extensive human and automated testing — capabilities that are genuinely useful for defenders, but equally concerning in the wrong hands.

That dual nature is exactly why the US government moved to shut both configurations down. A reported jailbreak raised questions about whether the safety classifiers underpinning Fable 5 were holding. From the Commerce Department’s perspective, that made both versions a national security concern, and the shutdown order followed.

The Shutdown and What Changed

Anthropic has stated that since 12 June it has been working closely with US government officials to restore access. The negotiations centred on additional safeguards: stricter data retention policies, tighter access controls, and measures to prevent misuse in cybersecurity and potentially sensitive biological applications. Anthropic’s documentation indicates a 30-day data retention requirement for Mythos-class traffic, used partly to defend against attacks and reduce false positives.

The result is a conditional authorisation, not a clean reinstatement. Vetted organisations can gain access through Project Glasswing, Anthropic’s existing programme for cyberdefenders and infrastructure providers. The framework is designed around tasks such as vulnerability detection, penetration testing and securing endpoints. Approved organisations are also reported to be able to grant access to eligible foreign employees within the programme’s safeguards — a detail that matters for multinational companies with staff outside the United States.

Dario Amodei, Anthropic’s chief executive, has previously said the company believes powerful AI models can be used for legitimate cyberdefence but that safe, scalable deployment mechanisms need to be in place before broader access is considered. The Project Glasswing framework is, in effect, Anthropic’s attempt to demonstrate that such mechanisms exist.

The Concerns Being Raised

Not everyone is comfortable with how this is playing out. Some analysts and commentators have raised questions about concentrating advanced offensive and defensive cyber capabilities in a small set of government-approved organisations. The worry isn’t just about misuse — it’s about the structural dynamics that emerge when a handful of vetted US entities gain access to tools that can find and fix complex vulnerabilities in widely used software, while the rest of the world waits.

There’s also the question of dependency. The shutdown itself demonstrated that the US government can, and will, compel Anthropic to take its most powerful models offline globally at short notice. For international partners and non-US organisations that rely on shared software infrastructure, that’s a reminder of how much turns on decisions made in Washington.

Fable 5 Still Offline

Fable 5 — the version most commercial users would actually interact with — remains unavailable. There’s no confirmed timeline for its restoration. Anthropic has said it aims to develop safe deployment mechanisms for Mythos-class models more broadly, and that the trusted-access framework looks set to expand to more cybersecurity organisations and selected biomedical researchers over time, but under US government consultation and a structured application process. None of that is imminent, based on current reporting.

What This Means for Kent Residents

There’s no direct deployment of Claude Mythos 5 to UK organisations reported, and the current authorisation explicitly covers vetted US entities only. But Kent residents and businesses that rely on major international cloud platforms, software vendors or financial services could see indirect benefits if those US-based providers participate in Project Glasswing and use Mythos 5 to identify and patch vulnerabilities in widely used systems. The broader issue for UK organisations — including local authorities, NHS bodies and utilities — is that US export controls and national security decisions around frontier AI models are increasingly shaping what tools are available globally, and tracking those policy shifts will matter for anyone planning cybersecurity strategy in the years ahead.