🧭 Claude Mythos 5 Now Powers Claude Security's Vulnerability Scanner — Backed by a $35M Open-Source Fund

Anthropic has brought Claude Mythos 5 — previously available only to vetted defenders through Project Glasswing — into Claude Security, the company's enterprise vulnerability-scanning product now in public beta for Claude Enterprise customers. The same announcement launches the Defender Advantage Fund (0xDAF), a $35 million pool of Claude credits for organisations improving the security of widely used open-source software.

What Claude Security does with Mythos 5

Claude Security scans a selected repository with Mythos 5 and returns findings classified by Common Weakness Enumeration (CWE) category, severity level, confidence rating, and AI-generated suggested patches. The upgrade from the prior model to Mythos 5 meaningfully increases recall on complex, multi-file vulnerability patterns — the kind that require understanding inter-module data flow rather than matching individual function signatures.

# Triggering a Claude Security scan via Admin API
curl -X POST https://api.anthropic.com/v1/security/scans \
  -H "x-api-key: $ANTHROPIC_API_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -d '{
    "repo_url": "https://github.com/your-org/your-repo",
    "branch": "main",
    "severity_threshold": "medium"
  }'

Defender Advantage Fund (0xDAF) — three grant tracks

• Patch Track — credits for directly closing live CVEs and CWEs in widely used open-source projects.
• Automation Track — credits for building reusable scanning and patching pipelines that other projects can adopt.
• Architecture Track — credits for structural security work that eliminates entire vulnerability classes (e.g. migrating a C project to memory-safe alternatives).

🧭 Enterprise Admin API User-Management Endpoints Reach General Availability

Anthropic has graduated the Admin API's user-management endpoints for Claude Enterprise (claude.ai) organisations from beta to general availability. The anthropic-beta: ce-user-management-2026-07-13 header is no longer required; requests that still include it are accepted without error, but new integrations should omit it. All four resource types — members, invites, groups, and custom roles — are now production-grade.

What you can do programmatically

• List all organisation members or look up a specific user by email address.
• Change member roles (e.g. promote to admin or demote to standard user).
• Remove members and withdraw pending invites without touching the claude.ai console.
• Create, update, and query groups, and manage group membership in bulk.
• Read custom role definitions to verify permission sets before assigning them via script.

Practical integration pattern

# List all members (GA — no beta header needed)
curl https://api.anthropic.com/v1/organizations/members \
  -H "x-api-key: $ANTHROPIC_ADMIN_KEY" \
  -H "anthropic-version: 2023-06-01"

# Invite a new user
curl -X POST https://api.anthropic.com/v1/organizations/invites \
  -H "x-api-key: $ANTHROPIC_ADMIN_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -d '{"email": "newuser@example.com", "role": "user"}'

🧭 Claude Code v2.1.240–241: Bedrock, Alpine/musl, Python Upgrade Helper, and Skill-Alias Fix

Two successive Claude Code releases this weekend pack a range of new capabilities alongside targeted bug fixes. The headline additions are native AWS Bedrock session support, an Alpine/musl build for minimal Linux containers, a Python 1.x → 2.x upgrade helper, and a fix for bundled skill aliases silently failing in non-interactive mode.

New capabilities in v2.1.240–241

• Bedrock session support — Claude Code agents running via AWS Bedrock can now create, resume, and list sessions, matching parity with the direct Anthropic API. Bedrock customers no longer need to maintain a separate session registry outside Claude Code.
• Alpine/musl build — a statically linked claude-code-musl binary is now published alongside the standard glibc build, enabling use in Alpine-based Docker images without compatibility shims. Size is approximately 30% smaller than the glibc binary.
• Python upgrade helper — running /upgrade python in a repo detects Python 1.x syntax patterns and proposes an incremental migration plan. The helper is aware of common breaking changes (print statements, integer division, unicode handling) and generates a per-file migration diff for review.
• Improved /resume and /goal behaviour — /resume now surfaces a disambiguation menu when multiple sessions match the active branch; /goal persists across session restarts and is included in the session summary shown at startup.

Bug fixes

• Skill alias shadowing in -p mode — bundled aliases like /checkup and /review were reporting "Unknown command" when a user-level or project-level skill with the same name was loaded via plugins or MCP. The alias resolution order is now: user skill → project skill → bundled alias, so bundled fallbacks survive the shadow correctly.
• Remote Control: deleted-session recovery — resuming a conversation whose backing session had been deleted from claude.ai or the desktop app now starts a fresh replacement session instead of returning an opaque failure message.
• Cost estimate 1.1× premium for data-residency workspaces — the /cost command, status line, and --max-budget-usd now include the US-only inference surcharge for data-residency workspaces, preventing budget overruns when routing to data-residency endpoints.