The IT Nerd

Claude Cowork has a major issue that could let an AI agent act outside its intended boundaries is the latest example of a pattern the security and compliance community keeps circling back to: we’re deploying autonomous agents faster than we’re building the evidence trail to govern what they actually do.

If you are not familiar with this jailbreak, this will catch you up: Critical Security Flaw in Anthropic’s Claude Cowork Allows File Exfiltration via Prompt Injection | LinkedIn

Justin Beals, CEO & Founder of Strike Graph, an AI-native GRC and compliance automation platform had this to say:

“Every agentic AI vulnerability disclosure tells the same story. We built these tools to act on our behalf, then forgot to build the evidence trail for what they actually did. This isn’t a bug in one product. It’s a category problem.

Once an agent can take action inside a system, it’s not a feature anymore. It’s an identity. And most organizations still govern it like a checkbox on a vendor questionnaire instead of a live risk surface that needs continuous verification.

The companies that get burned by the next version of this flaw will be the ones still treating AI agent oversight as a one-time approval. Continuous evidence of what an agent did, not just what it was authorized to do, is the only model that scales.”

It would really be nice if AI was treated more strictly. But sadly it isn’t and that will come back to bite us all sooner rather than later.

Anthropic’s latest research on AI-accelerated N-day exploits highlights a growing challenge for defenders: the window to patch before vulnerabilities are weaponized may be shrinking from days to hours. Which isn’t good.

You can read more here: https://www.anthropic.com/research/n-days

Yogita Parulekar, Founder & CEO, Invi Grid (https://www.linkedin.com/in/yogitaparulekar)

“Security teams are gearing up for the race to patch faster as AI compresses exploit timelines to hours. But to win, one needs a different strategy. 

“A strategy where the starting point is understanding that the ownership lies jointly with engineering and infrastructure teams who know and own their code and infrastructure. And winning the fight lies in identifying the risks jointly and correctly. The risk isn’t only what shouldn’t have been open, but also what is legitimately left open for app traffic and can get exploited. Misconfigured infrastructure and unnecessary exposure should be immediately closed. And correctly-scoped, legitimately open surfaces need mitigation layers before attackers can weaponize those paths.

“The real fix is not a faster security team. It involves forward thinking, with security and engineering owning and designing security into the pipeline itself and designing solid mitigation for exposure that legitimate traffic requires, rather than just inspecting after the fact. Security Day Zero to Day Z: a discipline built in collaboration from the moment infrastructure is designed.”

Corey Ham, Director of Continuous Pentesting, Black Hills Information Security (https://www.linkedin.com/in/coreyham)

“Defense in depth still matters. For example, with wp2shell, Cloudflare’s WAF was blocking the exploit as soon as it was published. Generic WAFs would likely have blocked some payloads regardless, since it relied on SQL injection.

“Auto-update is a must. Again, with wp2shell, clients who had that enabled were covered as soon as the patch became available.”

Kevin Surace, CEO, TokenCore (https://www.linkedin.com/in/ksurace)

“Anthropic’s findings show that AI can reduce exploit development from weeks to hours, with one working exploit reportedly created in under an hour. That means traditional risk reviews, monthly patch cycles, and human approval chains are no longer fast enough.

“Security teams need AI driven vulnerability prioritization, automated testing and deployment, continuous asset visibility, and the authority to isolate exposed systems immediately. But patching faster is not enough: organizations must also eliminate phishable MFA and protect access with hardware bound biometric identity, because in the AI era, humans cannot be expected to serve as the enterprise firewall.”

Seemant Sehgal, Founder & CEO, BreachLock (https://www.linkedin.com/in/s-sehgal)

“The patch-to-exploit window has been compressing for years, and what AI does is remove the skill floor from that process. Writing a working exploit used to require someone who understood memory corruption or authentication logic deeply enough to operationalize a CVE. Now that capability is accessible to a much wider pool of actors, which means organizations still running 30-day patching cycles have a structural exposure their risk models have not caught up to yet.“

Bronwen Aker, AI Researcher & Strategist, Black Hills Information Security (https://www.linkedin.com/in/bronwenaker)

“It’s no secret that patch development has been under-supported by software developers for decades. Part of the problem is that developing patches is mind-numbingly detailed work, and fixing a vulnerability is much harder than just finding one. Add to that the fact that business is chronically unwilling to invest time and money to harden software, and it becomes obvious why we are losing the proverbial war in cybersecurity.

“Ultimately, what needs to happen is a sea change in attitude by those who dictate how software developers do their jobs. There are always going to be zero days and newly discovered vulnerabilities in software, but if we can leverage artificial intelligence to make the software being delivered tougher, more stable, and more resilient to attack before it ships, the game will change. That will not happen, however, until corporations decide that security is just as important as what the mascot looks like, if not more so.”

Jacob Krell, Sr. Director, Secure AI Solutions & Cybersecurity, Suzu Labs (https://www.linkedin.com/in/jacob-krell)

“Anthropic quantified what Mandiant’s M-Trends already established. Mean time-to-exploit went negative last year, and AI is accelerating the trend. A single operator can now turn a month of patches into working exploits in one afternoon for a few hundred dollars. That breaks the core assumption underneath every enterprise patching SLA.

“Most organizations can deploy patches fast once they decide to. The bottleneck I keep seeing is the decision layer, change advisory boards, risk assessment, approval chains calibrated for weeks of runway between disclosure and weaponization. That runway is gone. Compressing governance speed to match is the first shift. Where even that isn’t fast enough, architecture has to assume immediate weaponization and limit blast radius when the patch arrives too late.”

Ted Miracco, CEO, Approov (https://www.linkedin.com/in/tedmiracco)

“The core argument that ‘patch velocity no longer matters because exploitation has outpaced it’ is correct but incomplete, as it primarily addresses CVE-driven risk, while not accounting for zero-days. Mobile and API security are not primarily patch-dependent, as they rely on obfuscation and the assumption that manual reverse-engineering is too costly to justify against most targets. AI removes that cost asymmetry entirely, allowing automated discovery of authorization and business-logic flaws that are rarely assigned CVEs because they are not classified as bugs. The result is a second, quieter collapse alongside the CVE one. An entire defensive model built on attacker effort exceeding attacker patience has lost its foundational assumption in the increasingly important mobile and API sectors as well.”

Donald McFarlane, Xcape (https://www.linkedin.com/in/dmcfarlane)

“AI is changing the economics of defense. Patching and increasingly ephemeral infrastructure are table stakes, but defenders must assume exploitation will occur, making continuous detection, layered defenses, and effective containment just as important as rapid remediation. Governance should accelerate action, not become a substitute for it.”

Consider yourself warned. The time to patch is dropping. Which means that your defences need to reflect that reality. Otherwise you’re guaranteed to get pwned.

Reuters reports that the CISA is said to be using Anthropic’s Mythos AI model to scan federal government software for security vulnerabilities. The CISA’s Attack Surface Evaluation team is using the model to audit source code and identify flaws that could be exploited by cybercriminals or nation-state actors.

The initiative is part of a pilot program to evaluate whether AI can accelerate software security reviews across government systems. Reuters reports that Mythos has identified multiple vulnerabilities during testing, although specifics on the number of vulnerabilities, severity, or affected software are not disclosed.

Bronwen Aker, AI Research & Strategy Analyst, Black Hills Information Security:

The federal government can’t seem to decide what it thinks about AI in general, or Mythos, in particular. One week Anthropic is a supply-chain risk, the next week CISA is handing Mythos the keys to scan federal code for vulnerabilities. That inconsistency would be bad enough to start with, but because it’s not clear what Mythos is actually scanning, it’s much, much worse. Is this government-written code, or software built by third-party contractors and vendors? In-house bugs are one problem. Vendor bugs running across federal systems are a supply chain problem, and the public has a right to know which one this is.

Chris Traynor, Penetration Tester at BHIS and Instructor at Antisyphon:

Software code review and analysis is nothing new. Realistically, most issues found are not exploitable without very specific conditions being met (i.e. – the vulnerable function needs to actually be invoked and exposed to the attacker in order to be abused).

I believe AI vulnability scanning will likely find many new and novel issues that were simply too complex to identify with legacy tools before. But added complexity can cause limitations exploitability. AI scanning will likely produce a lot of unactionable output very quickly that will need to be reviewed by experts to find the real risks.

Seemant Sehgal, Founder & CEO, BreachLock:

“AI finding vulnerabilities in federal code at scale is interesting, but the harder question is what happens after the finding. A vulnerability that exists in a library no one calls, behind a network segment no one reaches, is not the same problem as one sitting in a critical authentication path. Without validating exploitability and reachability, every finding lands with the same weight, and that creates its own kind of risk. The real test of this program is whether the output helps prioritize action or just expands the backlog.”

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

“Using AI to scan for vulnerabilities in legacy code while AI generates vulnerable new code on the other end only solves half the problem. CISA pointing Mythos at government codebases is a smart move. I’ve seen federal systems running code that hasn’t had a serious security review in a decade, and a model like Mythos can cover that volume in hours instead of months.

“The blind spot is the generation side. Every federal agency and contractor also has developers writing code with AI assistants, and those tools produce insecure output more often than secure output. Authorization flaws, hardcoded credentials, missing input validation, all shipping by default because the models optimize for “does it run” and skip “is it safe.”

“Combine both facts and you get a treadmill. Mythos finds legacy bugs, teams patch them, and AI coding tools introduce fresh vulnerabilities into the same repos at machine speed. The backlog doesn’t shrink. It gets younger.

“Power grids and water systems are privately run but sit squarely in nation-state crosshairs. CISA can’t harden federal code and call it done. If the agency has a scanning tool this capable, the operators running critical infrastructure need access to it too, because those are the systems that actually keep the lights on.

“I’d want CISA to pair this initiative with secure-generation standards for AI coding tools in federal development, and extend scanning access to critical infrastructure operators. We are draining the pool while the hose is still running.”

I for one would like the CISA to combine vulnerability scanning via AI with human follow up. Because relying on just AI alone is a recipe for failure. This of course ignoring the fact that the Trump Administration seems to flip flop on Anthropic and their potential harms to society. .

The CISA is using Anthropic’s AI model Mythos to audit government software, scanning ​government code repositories for bugs that could leave the door open for foreign spies and cybercriminals

More details here: https://www.reuters.com/world/us-cyber-agency-is-using-anthropics-mythos-audit-government-code-sources-say-2026-07-06/

Ensar Seker, CISO at threat intelligence company SOCRadar, provided the following comments:

“This is a significant shift in how governments approach secure software development. AI is moving beyond being a productivity tool and becoming a force multiplier for defensive security operations. If Mythos is consistently identifying vulnerabilities that traditional code reviews and static analysis miss, it demonstrates that frontier AI models can materially reduce the time between introducing a flaw and discovering it.

That said, organizations should resist the temptation to treat AI findings as authoritative. Large language models are excellent at prioritizing suspicious code paths and surfacing complex logic issues, but they still require experienced security engineers to validate findings, assess exploitability, and distinguish real vulnerabilities from false positives. AI should augment secure development practices, not replace them.

The broader implication is that the vulnerability discovery race is accelerating. The same AI capabilities helping defenders identify weaknesses are also becoming available to sophisticated threat actors. Governments and enterprises should assume both sides are using increasingly capable AI systems and adjust their remediation timelines accordingly. Finding vulnerabilities faster only improves security if organizations can also fix them faster.”

Again I get to say that organizations need to treat AI as a tool that they use in conjunction with old fashioned work by developers and not as an independent entity. If they don’t, bad things are guaranteed to happen.

Anthropic is putting Claude Fable 5 back online worldwide. On June 30, the U.S. Commerce Department lifted the export controls it had imposed on Fable and its more tightly controlled sibling Mythos 5 about two and a half weeks earlier.

Fable 5 returns to users on Wednesday, July 1, across Claude.ai, the Claude Platform, Claude Code, and Claude Cowork.

Export controls restrict who can receive or use a technology. The June 12 order told Anthropic to cut off both models for any foreign national, inside or outside the United States, including its own non-citizen staff.

Commenting on this is Mayur Upadhyaya, CEO at APIContex: 

“The restoration of Claude Fable 5 is welcome news. However, many organizations discovered they had unintentionally created a single point of failure in their AI strategy.

 Where workflows had automatically adopted the latest Anthropic model, removing Fable didn’t always result in graceful degradation. In some cases, automations failed silently because there was no fallback, no cold restart, and no operational awareness that the dependency had changed. This isn’t a criticism of Anthropic. The pace of innovation from the foundation model providers is extraordinary. But it does highlight that enterprises are beginning to treat AI models as operational infrastructure rather than productivity tools. Every infrastructure dependency eventually changes. Models are updated, withdrawn, restricted, or superseded. The question for organizations is no longer whether they’ll use frontier AI. It’s whether their workflows continue to operate when those underlying dependencies inevitably change. As AI becomes part of critical business processes, resilience needs to evolve beyond model performance. We need to verify that the transactions built on top of these models continue to perform and conform, even when the infrastructure beneath them changes.”

I’m going to go out on a limb and suggest that the US didn’t really have much of a choice but to release Claude Fable 5. But that doesn’t me that anything that AI generates doesn’t need to be validated. In fact, I would argue that it doubles the need for validation.

You may have noticed that Claude AI has had an outage today. 9to5Google reports the following:

Anthropic says it is aware of an outage and has rolled out a fix as recent as 10:53 a.m. ET. The company’s server status website indicates an issue affecting multiple models occurred at 10:19 a.m. ET.

The status update doesn’t detail which models were affected, though attempts to get a response from Sonnet and Opus returned nothing. Those models seem to be the most commonly used, especially as Fable 5 was recently pulled from user access.

The current outage did, however, affect those models across all platforms except for Claude for Government. That includes claude.ai, Claude Console, Claude Code, and Claude API. The total outage time comes close to an hour and stands out as one of the largest outages to hit Anthropic within the past 60 days.

Commenting on this news is Jamie Beckland, Chief Product Officer at APIContext: 

“Ready or not, AI inference is now production infrastructure. Enterprises are no longer using these systems only for experiments or side projects. They are putting AI into customer support, coding workflows, analytics, operations and decision support. When an inference endpoint slows down, throws errors or goes unavailable, that can now break a real business process.

Enterprises must run AI with the same discipline they apply to payments, cloud, APIs and other critical services. That means continuously monitoring inference endpoints for latency, error rates, model availability, response quality and regional performance. It also means having a tested failover plan before the outage happens.

Applications with one model provider hardcoded create a single point of failure. A more resilient approach is to design AI systems with fallback models, backup providers, graceful degradation and clear routing rules. Not every task needs the same model. If the primary model is unavailable, some workloads can move to another frontier model, some can fall back to a smaller model, and some should pause rather than return a bad answer.

Six months ago, these tools were enterprise experiments. Now, AI resilience is part of operational resilience.”

If you rely on AI as part of your business, then you need to plan for downtime. Why? Downtime is part of the game and you need to be prepared for it or bad things will happen.

Something that I missed last week is the fact that Anthropic who has had a testy relationship with the government has released Claude Fable has been released and then pulled shortly after release:

The AI lab said in a statement that the federal government told it Friday afternoon that it had become aware of a way of “jailbreaking” Fable 5, bypassing limits that Anthropic had implemented to reduce the risk the model could be misused. When Anthropic first announced Mythos, it released the software to only a select group of government agencies and technology professionals because of its ability to uncover cybersecurity vulnerabilities. 

The government imposed what are known as export controls on the products, which Anthropic said means it had to suspend access to the two models by any foreign national, whether inside or outside of the US. The only way it could do so is by shutting the models down entirely, the company said.

So what is Claude Fable 5. I will let the company itself explain:

Claude Fable 5 is a Mythos-level model built for your most ambitious, long-running projects. Try problems you weren’t able to solve with other models. Claude Fable 5 is thorough, proactive, and tests its own work.

Scary stuff. Chris Nyhuis, CEO of the cybersecurity company Vigilant had this comment including with the fact that Amazon was behind this:

A jailbreak is when someone gets an AI model to step around the safety limits its maker built in. In our work that matters because the same capability that lets a model find and fix a vulnerability in a client’s code is the capability that can hand an attacker a roadmap. It’s dual-use, like most powerful tools

Did a “jailbreak” even happen or did Amazon make it up? 

From my perspective it is not even clear a real jailbreak happened. What was demonstrated was a model being asked to read code and fix the flaws in it. That is not someone breaking the guardrails; that is the exact job we hire these tools to do. By the maker’s own account the vulnerabilities were minor and already findable with other models. We pulled a national defensive asset off the field over a finding that, on the public record, looks more like normal defender work than a weapon.

What are the ramifications from the White House to Wall Street to Main Street?

This was the first time a government pulled a commercial AI model off the market over a cyber capability. That sets a precedent every CISO, cloud provider, and investor now has to price in. When access to your best defensive tool can disappear in ninety minutes by directive, that is a board-level risk, not just an engineering one.

Has the White House overstepped and weakened cybersecurity nationally? 

The cybersecurity defender’s argument is straightforward. America’s adversaries are not waiting for an export license. If we slow the people defending American networks while the attackers keep moving, we have made the gap worse, not better. The honest version is that this is a genuinely hard tradeoff, and reasonable people in my field disagree on where the line sits.

How do we know what to trust from AI and if cybersecurity can protect us from hackers jailbreaking? 

Tools come and go, but the harder problem is the people. In the cyber world we hand a small number of people the keys to everything: the networks, the source code, the detection systems. As a nation we have to be far better at making sure the people in those seats are vetted, trusted, and genuinely on our side. That is not about where someone was born. It is about whether we have done the work to earn confidence that the person holding the keys is aligned with the mission. Right now we lean too hard on the technology and not nearly hard enough on the trust model around the people who run it.

Anthropic’s release of Claude Fable 5 highlights a significant shift in how advanced AI systems are being deployed. Rather than limiting capability, the company is separating access and safety controls from the underlying model itself, making powerful AI available for general use while restricting higher-risk applications through additional safeguards and controlled access programs. The approach reflects a broader challenge facing the industry: how to balance increasingly capable AI systems with the governance, oversight, and usage controls needed to prevent misuse in sensitive areas such as cybersecurity.

Gidi Cohen, CEO & Co-founder, Bonfy.AI

“The most honest thing Anthropic has done here is ship one model as two products. Splitting Fable 5 and Mythos 5 is an acknowledgment that capability and safety are in genuine tension — and that pretending otherwise doesn’t serve anyone.

But the most important line in the entire announcement isn’t about the classifiers. It’s buried in the operational detail: a high-severity vulnerability found by the model takes about two weeks to patch on average. Meanwhile, Mythos Preview built working exploits from a disclosed CVE in under a day.

That gap is where risk lives. And no classifier closes it.

This makes concrete what the CSA data showed last week: enterprises aren’t failing because they can’t detect vulnerabilities. They’re failing because they can’t act on them fast enough. AI has collapsed the attacker’s timeline to hours. The defender’s timeline hasn’t moved.

Anthropic is right that the defensive head start only matters if the industry uses it. The harder truth is that most enterprises aren’t yet equipped to — not because the tools don’t exist, but because the governance architecture to deploy them safely hasn’t kept pace with the capability.

That’s the real race.”

Yagub Rahimov, CEO, Polygraf AI

“By splitting one model into two products, separated by a safety layer rather than by capability is a genius marketing and gtm strategy. With this approach Anthropic admits publicly that LLMs have dangerous capabilities, and frankly speaking every enterprise should therefor question who governs access to these LLMs. Every enterprise leader should have this sort of honesty as a base standard.

This admittance about AI risk also changes the conversation. Imagine that within just days of its launch a single model autonomously finds vulnerabilities that survived 27 years of every human review in a major operating system. The strategic question we should ask is no longer how powerful that model is. It is who controls the behavioral layer between the model and the mission. America has been leading the world in building frontier AI. Now, our next obligation is to lead in governing and securing how that AI behaves once it touches enterprise and government data. Capability won the first race. Governance and security wins the second.”

Organizations need to keep pace with security and the like so that releases such as Claud Fable 5 don’t overwhelm them. If they don’t, then you can expect that organizations will lose this battle.

UPDATE: I have additional commentary starting with Ryan McCurdy, VP of Marketing, Liquibase:

   “Anthropic’s release shows the industry is starting to separate model safety from deployment safety. That is the right conversation. A more capable coding model can be safer at the model layer and still create risk once it is connected to repositories, pipelines, cloud environments, and databases.

   “The enterprise question is not just whether the model has safeguards. It is whether the organization can prove control over the work the model produces. Who approved the change? What systems did it touch? Did it follow policy? Can it be traced and reversed if it breaks production? As models get better at long-running software tasks, governance has to move closer to the actual change, especially in the systems where code, data, and compliance meet.”

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

   “Anthropic filed for its IPO on June 1 and launched Fable 5 eight days later at double the Opus token rate. The benchmark gains are real but concentrated in frontier-hard tasks. SWE-bench Pro jumps 11 points, from 69.2% to 80.3%. On routine work the gap shrinks to near-parity, and cost-per-solve still favors Opus 4.8 at $1.45 vs $2.49 per solved task.

   “The token economics compound the pricing. Fable 5 burns tokens at twice the Opus rate. A BleepingComputer reviewer exhausted a $100 daily allocation in nine minutes running Anthropic’s workflow mode. At $10/$50 per million tokens, heavy agentic work can clear three figures a day.

   “I do complex offensive cybersecurity tasks on Opus 4.6. No cybersecurity classifier. No mandatory data retention. Fable 5 charges double, blocks those queries, and redirects them to Opus 4.8.

   “Anthropic needs to show public-market investors it can monetize a $965 billion valuation. Fable 5 doubles per-token revenue. The cybersecurity gains are locked behind Project Glasswing.

   “Everyone else pays double and gets Opus 4.8 responses on security queries.”

Noelle Murata, Chief Operating Officer at Xcape, Inc.

   “Anthropic’s broad commercial release of Claude Fable 5 represents a calculated pivot in the frontier AI landscape: attempting to monetize elite, long-horizon reasoning architecture while strictly walling off its most “hazardous” capabilities. By implementing an aggressive, real-time classifier system that automatically downgrades high-risk cybersecurity, biochemical, or model-distillation requests to the less powerful Claude Opus 4.8 framework, Anthropic is trying to fulfill its commercial obligations without turning a public LLM into an on-demand zero-day factory.

   “However, this bifurcated release strategy highlights a growing divergence in enterprise defense. While everyday enterprise customers gain access to Fable 5’s highly advanced software engineering and long-running autonomous logic, Claude Mythos 5 remains exclusively accessible to a tight cohort of government intelligence agencies and select critical infrastructure defenders under Project Glasswing. This means the actual “cybersecurity tier” of this technology remains behind sovereign closed doors, leaving commercial security teams to defend against an increasingly automated threat landscape without the same unrestricted analytical tools being deployed by nation-state actors.

   “Critical Takeaways

•    “The Fallback Safety Loop: Fable 5 relies on active routing classifiers; roughly 5% of user prompts trigger a silent safety downgrade to Opus 4.8, creating an intentional, built-in performance ceiling on sensitive technical domains.
•    “The Defensive Technology Asymmetry: By maintaining a fully un-guardrailed “Mythos 5” tier strictly for government and certified infrastructure partners, the gap between state-level cyber capabilities and commercial enterprise defense tools is widening.
•    “Commercially Prohibitive Intelligence: At $10 per million input and $50 per million output tokens, Fable 5 is priced as a premium, specialized tool—making it twice as expensive as Opus 4.8 and reinforcing that frontier-level autonomous reasoning remains a luxury tier for enterprise workflows.
  

   “Anthropic built a brilliant system to prevent script kiddies from generating bioweapons, but blocking offensive cyber requests simply ensures that the good guys are the only ones playing with handcuffs on.”

John Strand, Owner, Black Hills Information Security, Inc.:

   “We need to remember that Mythos is not the end state. Mythos is a harbinger of what’s coming next. Too many people look at these demonstrations and assume they’re seeing the finished product. They’re not. They’re seeing the beginning.

   “Every major AI vendor on the planet is investing heavily in capabilities that will eventually compete in this space. At the same time, open-source models continue to improve at an astonishing pace. It won’t be long before anyone can download a model from an open-source repository, run it locally, and achieve exploit development, vulnerability research, and attack-path analysis capabilities that rival or exceed what we’re seeing from the most advanced systems today.

   “The real lesson isn’t that Mythos exists. The real lesson is that these capabilities are becoming democratized. What is currently available to a handful of well-funded organizations today will eventually be available to everyone. The barriers to sophisticated vulnerability discovery, exploit development, and attack-path chaining are falling rapidly, and defenders need to start planning for a world where advanced offensive capabilities are widely accessible.”

Sunil Gottumukkala, CEO, Averlon:

   “Fable 5 represents a meaningful shift in what’s possible for code generation at scale. Models at this capability level can compress months of engineering work into days, which changes the economics of vulnerability exposure and remediation significantly.

   “That makes it even more important for organizations to understand their attack surface, know which vulnerabilities are actually exploitable in their environment, what they connect to, and which ones warrant that fix-generation capacity in the first place. The most effective approach evaluates risk as changes are introduced, not after they’ve already reached production.

   “As the dual forces of code generation and exploit generation become faster and cheaper, the triage layer becomes the critical bottleneck to ensure the right risks are prioritized and fixes are in place before a breach.”

Anthropic is expanding access to its most advanced frontier model, Mythos, to roughly 200 organizations through Project Glasswing.

Through the expansion, access to Claude Mythos Preview — Anthropic’s model for identifying software vulnerabilities in codebases — will be granted to around 150 additional organizations, all of which must clear security requirements before joining. Participating organizations now span more than 15 countries, with Anthropic signaling plans to broaden that geographic footprint going forward.

Justin Beals, CEO & Founder, Strike Graph, an AI-native GRC and compliance management platform:

“Controlled rollout of frontier AI is the right instinct. But opacity is not a security strategy. Anthropic has published some metrics, and that’s a start, but the validation methodology is self-selected. They chose which findings to send for independent review, and the reviewers were contractors they hired. The broader security community needs access to independent, third-party evaluation across the full corpus. As these tools become more capable, the organizations cleared to use them become high-value targets. Access without continuous compliance validation is just a slower version of the same risk. Whoever gets access, the standard should be verifiable transparency, not curated receipts.”

I for one am cautiously optimistic. But I have see more in terms of controls coming from Anthropic before I feel 100% comfortable.

Anthropic quietly patched a sandbox bypass vulnerability in Claude Code without public disclosure, leaving developers and security teams unaware that the agentic coding tool they were running had a containment flaw. The silent fix reflects a broader pattern: as AI coding agents are rapidly adopted into developer workflows, the security posture of those tools is often opaque — even to the vendors shipping them.

SecurityWeek has coverage here: Anthropic Silently Patches Claude Code Sandbox Bypass – SecurityWeek

Gidi Cohen, CEO & Co-founder, Bonfy.AI had this comment:

“The technical details here are worth understanding — a null-byte injection that tricks an allowlist filter into approving connections it should block, chainable with prompt injection to exfiltrate credentials and tokens. Anthropic fixed it. The researcher is frustrated about disclosure process. That debate will continue.

But the more important signal is structural: sandbox boundaries are policy enforcement mechanisms, and policy enforcement is only as good as the data flowing through it. When the filter sees .google.com and approves, it’s not making a security mistake — it’s doing exactly what it was told. The problem is that the data it was evaluating had already been manipulated upstream.

This is the pattern that keeps recurring across AI agent security incidents. The attack doesn’t defeat the control directly. It shapes the input so the control defeats itself. Prompt injection, malicious comments, null-byte tricks — these work because inspection is happening at the wrong layer, or not at all, and because the data moving through these systems isn’t being evaluated for what it actually contains.

Organizations deploying AI coding agents today should be asking a harder question than “is our sandbox configured correctly?” The question is whether they have any visibility into the data those agents are touching, generating, and sending — before it reaches any boundary at all.

Configuration is a starting point. It was never a substitute for understanding the data.”

I really hope that this doesn’t become a trend as it would really make me less likely to trust AI based developer tools. But I guess we will see on that front.