Aaron Rubin, founder and chief executive of logistics software provider ShipHero, deployed Anthropic's restricted cybersecurity model Claude Mythos across his company's codebase in an automated security audit that cost approximately $10,000 and finished in 10 hours. Rubin reported that the model outperformed conventional third-party penetration testing firms on both cost efficiency and vulnerability discovery rate.
ShipHero provides warehouse management software (WMS) that handles one in every 80 US ecommerce packages and processes over $15 billion in annual gross merchandise value. The deployment offers one of the first detailed pricing and operational data points for frontier AI models applied to full-scale enterprise software security audits.
The Capabilities Behind Claude Mythos
Anthropic unveiled Claude Mythos Preview on April 7, 2026, restricting access under its Project Glasswing initiative. Unlike general-purpose coding assistants designed for code generation and autocomplete, Mythos was trained specifically to discover, analyze, and synthesize functional proof-of-concept exploits for complex software vulnerabilities.
During Anthropic's internal evaluations, Mythos identified a 27-year-old flaw in OpenBSD's TCP SACK implementation, a 16-year-old vulnerability in FFmpeg, and previously undocumented exploit paths in the Linux kernel. On benchmark evaluations involving Firefox 147 JavaScript engine vulnerabilities, Claude Mythos generated 181 working shell exploits, compared to two generated by Claude Opus 4.6 on the same test suite.
Because the same offensive capabilities that allow defenders to patch zero-day flaws can also enable rapid exploit development by malicious actors, Anthropic gated access to vetted organizations. Project Glasswing launched with partners including Amazon Web Services, Apple, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, Nvidia, and Palo Alto Networks, backed by $100 million in compute credits and $4 million in donations to open-source infrastructure maintainers.
Shifting Economics of Security Testing
Traditional penetration testing typically involves scheduled human engagements that cost tens of thousands of dollars and take weeks to plan, execute, and deliver in written reports. In contrast, running high-throughput reasoning models directly against repository source code reduces initial vulnerability discovery to hours of compute time.
However, automated security auditing changes rather than replaces the responsibilities of human security teams. While frontier models can systematically trace memory management errors, injection vectors, and broken access controls across millions of lines of code, outputs require human triage to filter false positives, evaluate business logic constraints, and verify that suggested remediations do not introduce regressions.
For enterprise software platforms managing multi-tenant customer workflows, automated audits offer a continuous alternative to annual or semi-annual penetration testing schedules, allowing organizations to scan repositories whenever major architectural revisions are deployed.
