IBM Adds Mythos to Scan Code for Unknown Flaws
The planned Concert Protect feature, targeted for early 2027, would test whether each flaw is exploitable before fixes are drafted.
Updated on Nov. 10, 2026 in Cybersecurity
Live Poll
Do you trust AI companies to keep software security tools safe?
IBM plans to add Anthropic's Claude Mythos to its Concert Protect security software, letting customers scan their own code for unknown flaws, according to an announcement made Monday. The feature is planned rather than shipped, with IBM targeting early 2027 and cautioning that its plans could change.
Why it matters
Enterprise security teams are moving toward AI systems that find and triage vulnerabilities at scale, a shift that also raises the stakes around how fast those flaws get fixed. Project Glasswing's first-month results, with more than 10,000 possible serious flaws flagged but only 97 patched, show how far detection has outpaced remediation.
Project Glasswing flagged more than 10,000 possible serious flaws in its first month but had patched only 97 of them by the end of that period. How many of the unpatched flaws are exploitable in practice has not been reported.
The players
IBM
A legacy enterprise technology company whose Concert Protect software, Red Hat tooling and consulting business put it in direct contact with large corporate codebases.
Anthropic
An AI developer whose Claude model family includes Mythos, a vetted-access model used here to find unknown software flaws.
OpenAI
An AI developer that runs a cyber programme IBM joined in June for a similar vulnerability-scanning service.
Red Hat
An open-source software company owned by IBM whose tools would draft proposed fixes for developer review.
The details
Mythos scans customer-selected code for unknown flaws, including ones that conventional scanners, which check only for already-known vulnerability patterns, tend to miss. Concert Protect then checks whether a hacker could actually use each flaw against the customer's systems, filtering out findings that are not reachable in practice. IBM and Red Hat tools would draft proposed fixes, but developers must review and approve each one before it is applied.
Timeline
IBM announced its plan on Monday, the same day Anthropic released Mythos 5.2 for vetted organisations.
IBM joined OpenAI's cyber programme in June for a similar service.
Anthropic briefly switched off Mythos access in June to comply with US export controls.
IBM wants to offer the Concert Protect feature in early 2027.
The Tech Race
IBM's Concert Protect plan follows its June entry into OpenAI's cyber programme, placing it among competing enterprise offerings built on frontier AI models for vulnerability discovery. Anthropic's June shutdown of Mythos access under US export controls shows that model availability in this market is shaped by government restrictions as well as by product roadmaps.
Security teams at organisations that use Concert Protect could eventually scan their own code for unknown flaws, with developers approving any proposed fixes before they are applied. The feature is not yet available, and IBM has not confirmed pricing or access terms beyond its early 2027 target.
The takeaway
Watch whether IBM delivers Concert Protect with Mythos in early 2027 and how the patch rate on flagged flaws changes over time. The gap between the 10,000-plus flaws flagged and the 97 patched is the metric to track as these tools expand.
What happens next
IBM's Concert Protect feature with Mythos is targeted for early 2027, though IBM has cautioned that the plan could change.
Further reading
For broader context on how AI is reshaping software vulnerability work, explore Cybersecurity coverage on We are the Frontier.
Live Poll
Do you trust AI companies to keep software security tools safe?
