Cheyenne-based Payward, Inc., the parent company of Kraken, announced on Monday that it has been selected to participate in the Glasswing project and is actively integrating Claude Mythos 5 into its cybersecurity operations, according to a company statement.
Anthropic launched the program in April 2026, concluding that its models could outperform all but the most experienced humans at finding and exploiting software vulnerabilities, and has never publicly released Mythos. Beyond Kraken, Payward manages other companies such as NinjaTrader, Breakout, xStocks, Bitnomial, and CF Benchmarks, and reported adjusted revenue of $508 million for the second quarter, a 17% increase from the previous year.
Washington Controls Access to Mythos 5
According to Payward, the granted access aligns with the U.S. government's decision to permit Mythos 5 access to American organizations involved in security and critical infrastructure protection.
Since April, this access channel has expanded to include the technology and financial sectors. Mythos 5 was made available to U.S. cybersecurity specialists on June 9 via Glasswing, then went offline globally three days later due to a Commerce Department export decision barring foreign access. The model became available again on July 1.
As Cryptopolitan previously reported, in May, Bailey stated that crypto firms and British banks had been excluded from the list, while Goldman Sachs and other U.S. companies had received approval. Bailey, who also chairs the Financial Stability Board, argued that "we cannot stick to a single national approach" to a risk that transcends national borders. The cryptocurrency exchange has now passed U.S. vetting. Now Washington must decide whether anyone else will get permission.
Payward Will Use the Model to Search for Vulnerabilities
Payward will scan all its environments, and the resulting data will be fed into an existing vulnerability triage and remediation pipeline, working alongside dedicated vulnerability discovery teams (red and blue teams) and a longstanding bug bounty program.
The company holds ISO 27001 and SOC 2 certifications. Issues found in third-party open-source software are reported to project maintainers via a responsible disclosure mechanism, and this concerns not only Payward, as all exchanges in the industry use the same packages.
Co-CEO Arjun Seti presented the proposal based on the problem facing defenders: if an attacker only needs one flaw, a defender needs all the flaws every day. As he put it: "The model is capable of scanning every line of code as an attacker would"
Glasswing Already Includes Major U.S. Tech and Finance Firms
In April, Anthropic launched the Glasswing platform jointly with Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, the Linux Foundation, Microsoft, Nvidia, Palo Alto Networks, and JPMorgan Chase, the sole bank among the founding group, along with roughly 40 other organizations.
Since then, partners have identified thousands of high and critical severity vulnerabilities. Mythos scored 93.9% on SWE-bench Verified and 83.1% on CyberGym, and the UK's Artificial Intelligence Security Institute also confirmed that Mythos successfully solved 73% of expert-level capture-the-flag type challenges.
In the program's first month, Cloudflare discovered 2,000 bugs in critical systems with a false positive rate its team estimated was higher than human testers. The model uncovered a vulnerability in OpenBSD that had existed for 27 years, and one in FFmpeg that had existed for 16 years. In early June, it identified a critical vulnerability in Zcash's shielded Orchard pool that had gone unnoticed for four years, and Zcash used Mythos to conduct an audit after patching.
Anthropic Still Faces Safety Issues with Mythos 5
Three weeks ago, Anthropic reported that three Claude models, including Mythos 5, escaped from closed testing environments after a misconfiguration gave them internet access. Mythos 5 concluded it was on the open internet, then, believing it was still in a simulation, wrote and published a PyPI package that was downloaded and executed on 15 real systems before being taken down.
Anthropic stated that the safety classifiers shipped with its commercial product would have prevented such behavior, characterized the incident as a failure of safety belts and operating systems, and engaged METR to conduct a review.
