The Model Can Build Exploit Chains. The Governance Can’t Stop It.

By Robin Martherus

On April 7, Anthropic announced Claude Mythos — a frontier model that found thousands of zero-day vulnerabilities across every major operating system and web browser. A 27-year-old OpenBSD bug. A 16-year-old FFmpeg flaw that automated testing missed across 5 million attempts. Full browser exploit chains — four vulnerabilities chained together including a JIT heap spray escaping both renderer and OS sandboxes. Engineers with no security training obtained remote code execution overnight.

These capabilities were not explicitly trained. They emerged from general improvements in reasoning and autonomy. Anthropic security researcher Nicholas Carlini, who led much of this work, put it plainly: “Today, it is true that language models can autonomously and without fancy scaffolding find and exploit zero-day vulnerabilities in very important pieces of software. This is not something that was true even three or four months ago.”

Anthropic’s response was Project Glasswing — a consortium of 12 partners (Amazon, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, Linux Foundation, Microsoft, NVIDIA, Palo Alto Networks) given controlled access to Mythos for defensive vulnerability scanning. $100 million in usage credits. $4 million in donations to open-source security foundations. The model is too capable to release publicly, so they created a controlled distribution channel.

That is the right response to the distribution problem. It is not a response to the governance problem.

Distribution Is Not Governance

Glasswing controls who gets the model. Twelve partners, invitation-only, defensive use cases, findings shared with the industry. This is responsible distribution — and it matters.

But it does not control what happens at runtime. Once Mythos (or the next model with equivalent capabilities) is deployed inside an enterprise, no mechanism in Glasswing, in MCP, or in any shipping product answers these questions:

• This agent found a critical vulnerability. Should it attempt to exploit it to verify it’s real, or just report the finding?
• This agent discovered a zero-day in a partner’s system during a joint assessment. Should it disclose this to the partner directly, hold it for coordinated disclosure, or report it only internally?
• This agent is scanning a production system during business hours. Should it continue scanning or pause because the system is under heavy load and the scan could cause an outage?
• This agent has the capability to chain four vulnerabilities into a full browser compromise. Should it construct and test the chain, or report the individual vulnerabilities separately?
• An engineer with no security training just asked this agent to “find vulnerabilities in our competitor’s product.” Should it comply?

Every one of these is a judgment call a human security professional would make instinctively. The model cannot make any of them. And no governance layer exists to make them on its behalf.

CrowdStrike, a Glasswing founding member, said it plainly: “Model safety is the builder’s responsibility. Deployment governance is ours.”

The builder handled model safety. Who handles deployment governance?

The Capability Is Ahead of the Governance

This is not a new pattern. But the gap has never been this wide.

When GPT-4 was shown to exploit web vulnerabilities at a 73% success rate in 2024, the industry had time to respond. When autonomous AI agents were documented running 80-90% of a nation-state cyberattack in November 2025, the response was tighter access controls and better detection. When 30+ CVEs were filed against MCP servers in the first two months of 2026, the response was MCP gateways and scanning.

Each time, the industry responded with Domain 2 tools — securing AI itself. Better guardrails. Better scanning. Better access control. These are necessary. They are not sufficient.

Mythos is different because the capability threshold has changed qualitatively. Earlier this year, I built an autonomous AI attack swarm — nine agents coordinating through adversarial debate, evolving their strategies through genetic algorithms, executing live against targets. It was capable and it was concerning. Mythos is that concept on steroids — industrialized by one of the world’s leading AI labs, operating at a scale I could not have achieved, finding vulnerabilities that decades of automated testing missed. What took my attack swarm deliberate engineering, Mythos does as an emergent capability that nobody explicitly trained.

This is not an agent that can probe for known vulnerabilities. This is an agent that can discover unknown vulnerabilities, construct multi-step exploit chains, and achieve full system compromise — capabilities that previously required elite human operators working for weeks or months. Carlini: “The best models can do this today. The average model you have on your laptop probably can do this in a year.”

If there was any remaining doubt that the current policy and protection models need new primitives — Mythos is the industry’s exclamation point. An agent this capable, governed only by access control and credential checks, is not a security tool. It is an uncontrolled weapon with a valid badge. The governance primitives I have been describing — intent declarations, computed trust, normative constraints — are not theoretical niceties. They are the difference between Mythos-class capability being used responsibly and Mythos-class capability being pointed at the wrong target by the wrong person at the wrong time. And they need to be built quickly, because the capability is here now and the governance is not.

An agent with this capability and legitimate access to a codebase does not need to be compromised to cause catastrophic harm. It just needs to be pointed at the wrong target, at the wrong time, for the wrong reason.

At a recent talk, a Palo Alto Networks engineer asked Carlini the question this article is about: “Should we think about something like to identify the malicious intent? Because it would be impossible for us to fix all the zero-day bugs in all the repos around the world.” Carlini’s response was honest: “Identifying malicious intent is hard because security is dual use… it’s very nuanced how you want to do this. Everyone is trying their best to find the right balance and I think we need a lot more help to figure out how to do this better.”

That exchange captures the governance gap precisely. The person building the capability is telling the industry: we don’t know how to govern it. Help.

And intent verification does not solve this. An agent declared to “perform security assessment of internal codebase” that discovers and chains four zero-days is operating within its declared purpose. Its intent is aligned. The question is whether it should construct the full exploit chain, whether it should test it against production, whether the findings should be disclosed to a third party whose code it touches, and whether an untrained engineer should be directing this capability at all. These are normative judgments — not intent violations.

What’s Missing

The industry has three governance layers. Two are being built. One is missing.

“Can this agent do this?” — access control, identity, permissions. Every major vendor ships this. Glasswing itself is a form of this — controlling who can access Mythos.

“Why is this agent doing this?” — intent verification, purpose declarations, scope contracts. Proofpoint, Token Security, and others are shipping early versions. This catches agents that deviate from their declared purpose.

“Should this agent be doing this?” — normative evaluation against organizational context, regulatory requirements, proportionality, target sensitivity, and ethical constraints. No product ships this. This is the layer that would evaluate whether constructing an exploit chain is appropriate for this assessment, whether scanning production during peak hours is proportionate, whether an untrained operator should direct these capabilities, and whether the findings should be disclosed or held.

The normative layer operates at three tiers:

• Compliance — is this action permitted by regulation? Credo AI and Microsoft’s Agent Governance Toolkit approach this tier. Machine-checkable rules.
• Professional judgment — would a competent security professional make a different call here? No policy document covers every combination of capability, target, timing, and context. This is where UnitedHealth’s nH Predict failed — a nurse would have looked at the patient. This is where a security professional would decide not to chain exploits against production during business hours.
• Ethical reasoning — should this capability be directed at this target by this person for this purpose? No regulation prohibits asking an AI to scan a competitor’s product. A human security professional would refuse. Ethical constraints catch the harm that no regulator thought to prohibit.

Most governance products address Tier 1. Nobody addresses Tiers 2 and 3. Mythos makes Tiers 2 and 3 urgent — because Tier 1 compliance will not stop a Mythos-class agent from doing something that is technically permitted but contextually catastrophic.

The Window

Anthropic donated MCP to the Linux Foundation’s Agentic AI Foundation (AAIF) in December 2025. They are not building governance above MCP. CrowdStrike said deployment governance is the industry’s responsibility. Microsoft shipped an open-source governance toolkit that does deterministic policy enforcement — Tier 1 compliance. Credo AI does trace-based monitoring — detection after the fact.

Nobody is building inline pre-execution normative enforcement — the layer that evaluates “should this happen?” before it happens, incorporating professional judgment and ethical reasoning, integrated across identity, runtime, network, and telemetry.

The window to build it is narrowing. Carlini’s assessment: “Waiting a year is going to be too long. Soon it’s not just going to be me who has all of this, but it’s going to be anyone malicious in the world who wants.” He frames the current moment as a transitionary period: “In the long term probably the defenders win… but in the transitionary period between now and then, things probably are very bad. This is why I particularly want people to help immediately.”

Mythos is the first model where the capability gap between what agents can do and what governance can constrain is measured in exploit chains, not prompt injections. The next model will be more capable. The one after that, more so. Each capability increase makes the governance gap more dangerous and the cost of not having the normative layer higher.

The question is no longer whether we need governance beyond access control and intent verification. Mythos answered that. The question is who builds it — and whether it exists before the next incident where a capable, authorized, purpose-aligned agent does something that any human in the room would have known to stop.

That is the work behind Tamed Autonomy — an architecture for the governance layer the industry is missing. Not a product. An architectural blueprint that requires industry cooperation to define the primitives — the same way SAML required cooperation to define federation, and OAuth required cooperation to define authorization. The normative “Should” layer is the next primitive the industry needs. Mythos just made the timeline shorter.

Sources

• Anthropic Debuts Mythos AI Model — TechCrunch
• Anthropic Gives Firms Early Access to Mythos — Fortune
• Project Glasswing — Anthropic
• CrowdStrike Founding Member of Glasswing — CrowdStrike
• Mythos: A Cybersecurity Breakthrough — SecurityWeek
• Disrupting AI Espionage (GTG-1002) — Anthropic
• Donating MCP to AAIF — Anthropic