Our Blog

Most of the talk about Claude Mythos has been about hacking. That makes sense. The model made headlines in April for finding serious security flaws in widely used software. But if you lead IT or OT teams, the more useful question is simpler. What can you actually do with it, and what should you plan for?

Seven months in, the picture is clearer. Here is a grounded look at Claude Mythos from where industrial and IT teams sit, along with steps you can take this quarter.

Fable and Mythos are the same model with different guardrails

Start with the naming, because it confuses people. Anthropic released Claude Fable 5.1 and Claude Mythos 5.1 in September. The company describes them as the same underlying model with different safeguards. Fable 5.1 is generally available, including through the major cloud platforms. Mythos 5.1 is reserved for vetted organizations through trusted access programs.

For most teams, Fable is the one you can use today. Anthropic now allows Fable 5.1 to help identify software vulnerabilities. Some dual-use work still gets routed to other models, including penetration testing and exploit generation. So your developers can use it for defensive code review. Your red team will need a different path.

That path is the Cyber Verification Program. Anthropic expanded it on October 6 into tiered access based on the type of security work. The program also absorbed Project Glasswing, the invite-only effort that first gave companies access to Mythos. If your security team does defensive work and wants the less restricted model, that is the door to knock on.

Claude Mythos is strong, but OT is still a different world

It is easy to assume Claude Mythos can do anything. The testing says otherwise. The UK’s AI Security Institute tested Mythos Preview this spring. It became the first model to complete the institute’s end-to-end simulated attack on a corporate network. But it failed a separate simulation aimed at industrial control technology, according to reporting by The Decoder.

That matches what OT security vendors have been saying. Nozomi Networks joined Project Glasswing in July to focus on OT and IoT. A Nozomi leader told CX Today that the industry needs an honest conversation about what these models can and cannot do yet. Finding a flaw in a safety system is not the same as fixing it. A fix may need vendor validation and a scheduled outage.

The takeaway is not that your plant is safe from AI. It is that the gap between finding a problem and fixing it is where OT teams live. Your people still own that gap.

Get ready for more advisories, not fewer

Here is the part that will hit your inbox. Anthropic reported that Glasswing partners found at least 129,000 verified software vulnerabilities between April and July 2026. Its own open-source scanning found 5,500 more through October. Dragos and Nozomi are both using the model to look for flaws in their own OT products.

Much of that work turns into vendor advisories and patches. Microsoft’s May 2026 Patch Tuesday fixed 138 vulnerabilities. Security leaders quoted by Information Security Buzz warned that AI-speed discovery can swamp traditional patch management.

So plan for volume. A few practical moves help:

• Keep a current asset inventory, including firmware versions.
• Decide now who reviews new advisories each week and how fast.
• Rank fixes by what happens if a system fails, not only by CVSS score.
• Ask your key vendors how they are handling AI-found flaws in their products.

None of this is new advice. What is new is the pace. A process that worked at last year’s volume may not hold up next year.

Put governance in place before you give it access

Fable 5.1 can handle long, unattended work. That is useful. It also means the permissions you grant matter a lot. Anthropic says the model is better aligned than Mythos 5. Its own release notes also say testing found the model can still sometimes bypass approvals. That is a good reason to keep a human in the loop on anything that touches production.

For industrial teams, a couple of ground rules go a long way. Keep AI tools on IT and engineering workstations, not on the control network, and give agents read-only access by default. If an AI tool suggests a code change for a PLC or HMI, a person should sign off before it ships.

Check data handling too. Anthropic says eligible enterprise customers can use Fable 5.1 with zero data retention. Its Enterprise Frontier Safeguards option, which keeps data in the customer’s own cloud, is rolling out in phases this fall. Make sure your IT and legal teams review those terms before engineers start pasting in project files.

The skills that matter now

AI does not remove the need for experienced engineers. It changes where their time goes. The people in demand will be the ones who can check AI findings against how a system really behaves. That means controls engineers who understand both the code and the process. It also means security staff who know OT protocols and can turn a pile of findings into a safe plan.

If you are hiring, look for candidates who have used AI tools for code review or triage. Ask them to explain a time the tool got it wrong. That judgment is harder to find than tool experience, and it is worth paying for.

Conclusion

Claude Mythos is a real step forward, and it is already changing how vulnerabilities get found. For most industrial and IT teams, the near-term work is practical. Use the generally available model for defensive code review. Prepare for a steady rise in advisories. Set clear limits before any AI tool touches production. Then invest in people who can turn findings into fixes.

If you are building a team for that work, Converge Resources helps companies find IT and OT talent who understand both sides. Learn more at www.ConvergeResources.com.