Claude Mythos 5.2 reaches AWS GovCloud, but only for allow-listed organizations

Amazon says Claude Mythos 5.2, Anthropic’s most capable model for cybersecurity work, is now offered to eligible customers in AWS GovCloud (US) through Amazon Bedrock. Per the official announcement, access is limited to allow-listed organizations.

Allow-listed access, with Anthropic’s program as the gate

Amazon describes Mythos 5.2 as Anthropic’s most advanced model so far for cybersecurity, software coding and complex reasoning. It says the model can find sophisticated vulnerabilities in software and demonstrate that they can be exploited. It also says the model can read large codebases and return actionable findings with less manual guidance than earlier AI models.

Amazon frames the purpose as defensive: helping security teams find and fix flaws in critical software before attackers reach them. It also says Mythos 5.2 is the first Anthropic model with strong cybersecurity capabilities to be available in GovCloud (US).

The route in is not a normal model-access request. Organizations must be on an allow list, and Amazon points readers to Anthropic’s Cyber Verification Program as the place to start. The announcement does not say who qualifies, how long review takes, or whether a government agency gets different treatment from a contractor.

A narrow audience, not a general release

For most readers nothing changes. A company outside the US public sector, or one without a verified security use case, cannot simply switch the model on. The people who can benefit are security teams that already work in GovCloud, such as agencies and their contractors, and that Anthropic is willing to verify.

The same limit applies on regular AWS. A separate Amazon blog post on the Claude Fable 5.2 launch describes Mythos 5.2 as available through Anthropic’s verification programs, for cybersecurity work such as security engineering, red teaming and penetration testing, and for life sciences research. That post says it is offered on Amazon Bedrock and through US and global cross-Region inference profiles, and it does not mention GovCloud.

The GovCloud announcement leaves out several practical details. It does not name the GovCloud Regions, give a model ID or list prices. Amazon’s pricing page and the Bedrock documentation are the places to look.

Limits and open questions around a model built for exploits

Everything about the model’s abilities in the announcement is Amazon’s description of Anthropic’s claims. No benchmark numbers or independent test results are given for the vulnerability-finding or exploit-demonstration claims, so how well it does on real government codebases is unverified.

Data handling is a second open question. In our earlier report on Claude Fable 5.2 reaching GovCloud, we noted that Fable 5.2 and Mythos 5.2 sit in a category of Anthropic models that are covered by retention rules. By default, prompts and outputs must be kept for up to 30 days and reviewed by humans so that misuse can be monitored. On Bedrock, Amazon staff do that review inside the AWS boundary, and customers must set the aws_review data retention mode before calling the model. The GovCloud Mythos announcement does not say whether the same terms apply there, which matters for agencies handling sensitive code. The Fable page also described a zero data retention option for eligible customers, without defining eligibility. Whether that carries over to Mythos is not stated.

The release also follows a pattern. On November 4 we reported that OpenAI’s GPT-5.6 Cyber reached US government clouds in a single GovCloud Region, under its Daybreak Red program for vetted defenders, with approval needed from both OpenAI and AWS. That rival offering is limited in the same way, and OpenAI had not published detailed eligibility criteria either. Both vendors now put their most capable security models in government clouds behind identity checks rather than open access. Neither has said how many organizations have been approved.

What would settle the open points is simple to list: published eligibility criteria for the Cyber Verification Program, the GovCloud Regions and prices, a statement on retention terms for Mythos in GovCloud, and any independent evaluation of the vulnerability findings. None of these appear in the announcement.