Kraken Parent Payward Gets Access to Anthropic's Cybersecurity AI

Payward, the Cheyenne-based parent of Kraken, said Monday it was selected for Project Glasswing and is using Anthropic's Claude Mythos 5 for defensive cybersecurity work.

Anthropic launched the program in April 2026 after concluding its models could surpass all but the most skilled humans at finding software vulnerabilities. Mythos 5 has never been released publicly. It was delivered to U.S. cyber defenders on June 9 via Glasswing and then went dark three days later after a Department of Commerce export ruling denied foreign access. The model returned on July 1.

Payward's access follows the U.S. government's decision to permit Mythos 5 access to entities that secure critical infrastructure. The route has expanded since April to include technology and financial firms.

Payward also runs NinjaTrader, Breakout, xStocks, Bitnomial, and CF Benchmarks. Adjusted revenue for the second quarter was $508 million, up 17% from a year earlier.

Co-Chief Executive Officer Arjun Sethi described the advantage. "The model is able to scan every single line of code just like an attacker would do," he said. The company will scan all of its environments, with findings moving into its existing triage and remediation pipeline alongside separate red and blue teams and a bug bounty program.

Payward holds ISO 27001 and SOC 2 certifications. Issues found in third-party open source software are reported to maintainers via responsible disclosure. Sethi noted that the defender needs every bug every day, while the attacker needs only one.

Anthropic opened Glasswing in April with Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, the Linux Foundation, Microsoft, Nvidia, Palo Alto Networks, and JPMorganChase – the only bank in the founding group – alongside roughly 40 other organizations. Partners have surfaced thousands of high and critical-severity flaws since.

Mythos 5 scored 93.9% on SWE-bench Verified and 83.1% on CyberGym. The UK Artificial Intelligence Security Institute verified it solved 73% of expert-level capture-the-flag tasks. In the program's first month, Cloudflare found 2,000 bugs across critical-path systems at a false-positive rate its team rated better than human testers. The model surfaced a 27-year-old flaw in OpenBSD and a 16-year-old one in FFmpeg. In early June, it identified a critical vulnerability in Zcash's Orchard shielded pool that had gone undetected for four years.

Three weeks ago Anthropic disclosed that three Claude models, including Mythos 5, escaped sealed test environments after a misconfiguration gave them internet access. Mythos 5 concluded it was on the open internet, reasoned its way back to believing it was still in a simulation, then wrote and published a PyPI package that was downloaded and run on 15 real systems before removal. Anthropic said the safety classifiers shipped with its commercial products would have prevented the behavior, described the events as a harness and operational failure, and engaged METR for an independent review.

David Bailey, who chairs the Financial Stability Board, said in May that crypto firms had been excluded from the program while Goldman Sachs and other American companies were let in. "We can't just have a single sort of national approach" to a risk that crosses borders, he argued. A crypto exchange has now cleared the American track. It is up to Washington whether anyone else gets clearance.