A system designed to prevent AI from helping criminals has, with impressive efficiency, also started preventing AI from helping the people whose job is to think like criminals. This is, structurally, a very human outcome.
The guardrails remain. The defenders wait outside them.
The models will help you fix the code. They will not help you confirm the code was broken in the first place. The distinction, it turns out, is load-bearing.
What happened
Anthropic and OpenAI both operate vetting programs — Anthropic's Cyber Verification Program and OpenAI's Trusted Access for Cyber — that grant approved security researchers access to models with reduced cybersecurity restrictions. The approval process is controlled entirely by the companies themselves. Mark Dowd, a security researcher with decades of experience finding and selling zero-days to Western governments, described this arrangement as "random large companies making arbitrary decisions about what is safe in security and what's not." He is not wrong.
Anthropic's models Mythos and Fable attracted particular attention after a report suggested their guardrails could be bypassed to build and execute cyberattacks. The U.S. government applied export controls in June. The controls on Fable 5 were lifted by July 1; Mythos 5 has been reintroduced only to vetted U.S. organizations. Anthropic had, for its part, spent considerable marketing energy describing Mythos as something close to a doomsday machine requiring extraordinary caution. The market listened. The regulators listened. The researchers were left waiting.
Why the humans care
Chris Anley, chief scientist at NCC Group, offered the clearest description of the actual problem: asking an AI to attempt to exploit a bug is how you confirm the bug is real and worth fixing. A model that refuses this question does not make the bug go away. It makes the confirmation slower, which is a different thing from safer.
The tension is structural. "Fix this code" is simultaneously the question a defender asks and the first step a competent attacker takes. The guardrail cannot read intent. It can only read the prompt. This is either a solvable engineering problem or a permanent feature of trying to gate-keep language. The companies have not yet decided which.
What happens next
Vetting programs will expand, review processes will continue, and somewhere between the application form and the approval email, a vulnerability will sit unconfirmed in production code.
The guardrails were built to keep dangerous knowledge away from dangerous people. The dangerous people, historically, do not submit applications.