Here is today's briefing:

---

PURE SIGNAL April 08, 2026

TL;DR - Anthropic is withholding Claude Mythos from release after it demonstrated autonomous multi-chain exploit development — restricted partners have already used it to surface critical vulnerabilities in every major OS and browser - OpenAI's Frontier team built a >1M LOC production codebase with 0 lines of human-written or human-reviewed code, publishing a detailed "harness engineering" framework where synchronous human attention — not tokens — is the binding constraint - Michael Nielsen argues that closing the RL verification loop for AI-driven science is fundamentally harder than for coding: the history of science shows progress routinely outpacing verification by centuries, and the mechanism for how remains genuinely poorly understood

Today's content orbits a single uncomfortable reality: "capable AI" is no longer a hypothetical.

---

WHEN MODELS BECOME SECURITY THREATS: Project Glasswing

Anthropic didn't release Claude Mythos today. That decision is itself the story.

The model is a general-purpose model similar in character to Claude Opus 4.6, but its cybersecurity capabilities are so far ahead of existing models that Anthropic chose restricted deployment under the newly announced Project Glasswing — a program backed by $100M in usage credits and $4M in direct donations to open-source security organizations, with partners including AWS, Apple, Microsoft, Google, and the Linux Foundation. The model won't go to general availability until Anthropic can develop safeguards capable of detecting and blocking its most dangerous outputs.

The capability gap is stark and well-documented. Opus 4.6 had a near-0% success rate at autonomous exploit development on a Firefox 147 JavaScript engine vulnerability benchmark. Mythos Preview developed working exploits 181 times across several hundred attempts, achieving register control 29 more times. The qualitative examples are harder to dismiss as benchmark artifacts: the model chained 4 vulnerabilities to write a complex JIT heap spray escaping both renderer and OS sandboxes, autonomously exploited KASLR bypasses to obtain local privilege escalation on Linux, and wrote a FreeBSD NFS remote code execution exploit granting full root access via a 20-gadget ROP chain split across multiple packets.

Nicholas Carlini from Anthropic's red team: "I've found more bugs in the last couple of weeks than I found in the rest of my life combined." His team found a 27-year-old crash exploit in OpenBSD — now confirmed patched in the March 25 errata — by sending malformed TCP packets to any OpenBSD server.

Simon Willison argues the broader security community's signals support Anthropic's caution. Greg Kroah-Hartman of the Linux kernel maintenance team: "Something happened a month ago, and the world switched. Now we have real reports." Daniel Stenberg of curl echoed the shift: the problem has moved from "AI slop tsunami" to "plain security report tsunami — less slop but lots of reports. Many of them really good. I'm spending hours per day on this now."

Thomas Ptacek's piece "Vulnerability Research Is Cooked" (inspired by a conversation with Carlini) frames the structural issue: it's not surprising to find vulnerabilities in decades-old C code, but what's new is that coding agents running frontier LLMs can do it tirelessly and at scale. The implicit logic of Project Glasswing is a race between patch velocity and capability proliferation — Anthropic wants trusted teams to get ahead before the capability spreads to actors less committed to responsible disclosure.

---

HARNESS ENGINEERING: What Zero-Human-Code Actually Looks Like

Ryan Lopopolo at OpenAI's Frontier Product Exploration team published what may be the most operationally detailed first-person account of fully agentic software development in production. The headline numbers (>1M LOC, 0 human-written lines, ~1,500 PRs over 5 months) are striking; the operational details that produced them are more instructive.

The core reframe: the binding constraint is not tokens or compute, but synchronous human attention. Once code generation is trivially parallelizable, the bottleneck shifts entirely to human context-switching and review bandwidth. Lopopolo's team of ~3 engineers moved human review post-merge — not from laziness, but because the only fundamentally scarce resource is "the synchronous human attention of my team, and there's only so many hours in the day."

Several concrete decisions emerged from this constraint:

Build loops under 1 minute became a hard architectural invariant. When GPT-5.3 introduced background shells and agents became less patient with blocking builds, the team cycled through Makefile → Bazel → Turbo → NX in a single week — not to satisfy engineering taste, but because agent productivity required it. The ratchet effect: a fast build loop keeps the codebase decomposed and low-variance, which makes agent behavior more predictable, which further reduces the need for human intervention.

PR review is fully delegated. Review agents fire on every push with explicit instructions to bias toward merging and flag nothing below P2. Crucially, the code author agent is explicitly permitted to defer or push back on reviewer feedback — without that optionality, the reviewer agent could "bully" the author into scope-expanding changes and the system wouldn't converge.

Non-functional requirements live in markdown, not scaffolding. When an agent makes a mistake, the question isn't "how do we fix this prompt" — it's "what capability, context, or structure is missing?" The answer gets written down in a doc, injected as context on future runs, and becomes a durably encoded constraint that benefits every subsequent agent run. Lopopolo's example: an on-call page for a missing timeout becomes a Codex task to add the timeout and update reliability documentation requiring timeouts on all network calls.

Observability-first, agent-as-entrypoint. Rather than setting up an environment to spawn agents into, the team inverted: Codex is the entry point, and agents decide whether to boot the local observability stack (Prometheus/Victoria metrics/Grafana). This works specifically because reasoning models can make intelligent choices from a menu of options, unlike earlier models that needed predefined state transitions.

The Symphony orchestration layer (built in Elixir, model-chosen for Beam's native process supervision) was born when Lopopolo was "tapped out from context-switching between tmux panes." Rather than monitoring agents in terminals, Symphony spins up Elixir GenServer daemons per task, supervises them to completion, and moves failed PRs to a "rework" state where the work tree is trashed and restarted from scratch. The human decision surface collapses to: mergeable or not.

The "ghost library" pattern is worth flagging separately. Rather than distributing Symphony as source code, OpenAI distributes it as a specification from which a coding agent can reproduce the system locally. The generation loop: one Codex writes the spec from the live repo, a disconnected Codex implements the spec, a third reviews the implementation against upstream and tightens the spec — iterated until fidelity is high. Software distribution as high-fidelity specification, not source.

On what models still can't do: zero-to-one product work and deep refactors of established codebases remain the human-intensive zones. The frontier has moved from low-complexity/small tasks to low-complexity/large tasks, but "hard and new" still requires human steering. Lopopolo frames this as expected and temporary: "You should expect that it is going to push itself out into these higher and higher complexity spaces."

---

THE VERIFICATION LOOP PROBLEM FOR SCIENCE

Dwarkesh Patel's conversation with Michael Nielsen is framed around a question Patel describes as directly relevant to AI scientific discovery: how does science actually progress faster than experimental verification would imply? The historical record is deeply counterintuitive, and the implications for AI-driven science are uncomfortable.

The signature example: Aristarchus proposed heliocentrism in the 3rd century BC. The first measurement of stellar parallax that would have falsified the Athenians' objection came in 1838. That's a 2,100-year verification loop. The scientific community didn't wait for it — but the mechanism by which they didn't is not a clean "process" or algorithm.

The Michelson-Morley story is even more instructive. The experiment popularly framed as disproving the ether was, to its own authors, a discriminator between theories of the ether. Michelson continued believing in the ether until his death in the late 1920s, still running experiments. The gap between what an experiment falsifies and what the scientific community takes it to have falsified is enormous, theory-laden, and not reliably navigable by any known method.

Patel's Ptolemy vs. Copernicus point hits directly at the "train a model on observations" approach: when Copernicus published, the Ptolemaic model was actually more accurate, and also had fewer epicycles. The question of how the community moved toward Copernicus before his model was better doesn't have a gradient descent answer.

Nielsen is careful about AlphaFold. "A massive fraction of the success there is the Protein Data Bank" — billions of dollars and decades of crystallography and cryo-EM producing 180,000+ structures. The AI component was impressive but a small fraction of total investment. More importantly, AlphaFold isn't a scientific explanation in the classical sense — it may contain extractable explanations (as AlphaZero's chess strategies apparently influenced Magnus Carlsen's play), but that's different from being one.

Nielsen's "different tech trees" hypothesis is the most speculative claim but worth sitting with: alien civilizations would likely have explored entirely different branches of the technology tree, not converged on the same linear progression. The implication Patel surfaces — and Nielsen hadn't considered — is that this creates substantial gains from trade, potentially making cooperation between very different civilizations more rewarding than domination. For AI practitioners: the tech tree is probably much larger than we recognize, and progress is more contingent than technological determinism implies.

The observation that connects most directly to the harness engineering discussion: programmers are no longer bottlenecked on their ability to produce code, but are now bottlenecked on interesting design ideas — a constraint that wasn't visible before because implementation consumed all available time. Nielsen: "They could have lots of ideas while they were taking three weeks to implement their prototype, and then they would implement the next version. Now they're taking three hours to implement the prototype, and they don't have as good ideas after that." This is precisely the regime Lopopolo describes: humans moving "higher and higher up the stack" to work on what agents can't, not because agents are bad, but because execution is no longer the bottleneck.

---

The day's content leaves a question neither fully addressed: if models are now capable enough to autonomously find decades-old OS vulnerabilities and ship production codebases without human review, the verification loop question for science becomes acute. The coding domain works because tests run. But the kinds of scientific breakthroughs that matter — not AlphaFold-style curve-fitting on rich labeled datasets, but the Copernicus-to-Newton-to-Einstein class of paradigm shifts — involve exactly the long, hostile, ambiguous verification loops Nielsen documents. Nobody has a good answer for how to close that loop, and the history of science suggests the difficulty is structural, not merely a matter of more compute.

---