IBM plans to use Anthropic's AI to hunt hidden security flaws in company code

IBM says it plans to put Anthropic's Claude Mythos AI inside IBM Concert Protect, its security tool for managing weak spots in company systems. The goal is to scan a company's own code for flaws nobody has found yet, work out which ones attackers could really use, and suggest fixes. IBM calls this a plan, not a finished product.

What IBM says it will do

The tool would scan code that customers choose. IBM says it aims to catch problems that older scanners miss, including tricky logic mistakes and so-called zero-days. A zero-day is a flaw that nobody knew about, so no official fix exists yet.

IBM describes the plan in three steps.

• Scan: the AI reads application code to spot unknown flaws, including ones with no public record.
• Prove: Concert Protect checks code, settings and systems to see if a flaw could truly be exploited.
• Fix: the tool drafts changes, and developers review and approve them before anything goes live.

Why this is different

Traditional scanners mostly look for known problems. They rely on patterns and on published flaw lists, which use identifiers called CVEs. IBM argues that as AI finds more flaws faster, waiting for those labels and scores no longer works.

In IBM's words, the hard part is no longer finding flaws. It is knowing which ones can be exploited and fixing them before attackers do. The AI findings would flow into the same workflow companies already use for other scanner results, rather than living in a separate tool.

Who it affects

This is aimed at larger organizations that build their own software and have security teams. IBM also points to Red Hat Lightwell, which supplies fixes for open-source code. If your business relies on custom software or an outside developer, this kind of tool could mean weak spots get found earlier. IBM says it has worked with Anthropic before, including on Project Glasswing, which was limited to internal security research.

What happens next

IBM says general availability is planned for early 2027. It is holding a webinar on November 19, 2026. The announcement does not give pricing or say which customers will get access first.

IBM also notes that its statements about future plans can change or be withdrawn without notice. Until the product ships, the claims about what it can find remain goals, not proven results.