The model is no longer the product
THE EXECUTION LAYER // 005
Intelligence is not access
Welcome back to The Execution Layer.
This is a newsletter for people doing security at the deep end. The people trying to make capable agents useful inside real organisations, with real data and real consequences.
Last week I wrote about the model that had to wait.
This week it arrived.
OpenAI released GPT-6 Astra on Thursday. The company called it a new generation of intelligence. Greg Brockman went further and said he believes OpenAI has reached AGI.
You can spend a great deal of time arguing about that label. I am not sure it gets us anywhere useful.
The more important milestone is much less theatrical. Astra is the first broadly deployed model OpenAI has classified as having Critical cybersecurity capability. It can find previously unknown vulnerabilities and develop ways to exploit hardened systems without a person directing every step.
OpenAI is therefore not releasing one Astra. It is releasing several versions of the same capability, separated by safeguards, identity checks, approved purposes and monitoring.
Anthropic did almost exactly the same thing this week with Claude Fable 5.1 and Mythos 5.1.
The frontier model is no longer the product. The product is the model plus the rules governing who can use it, what it can reach, how long it can operate and who gets to inspect the evidence afterward.
The model arrived with a security architecture
OpenAI reports that Astra scored 100 percent on ExploitBench, compared with 78.5 percent for GPT-5.6 Sol. In a newer internal evaluation, Astra found and used two previously unknown vulnerabilities. In expert testing, it built working exploit chains against a hardened browser and operating system.
Those are vendor-reported results. We should treat them as such. Even with that qualification, the direction is hard to ignore.
The version most people receive will refuse advanced work such as producing proof-of-concept exploits. Approved defenders will gain broader access through OpenAI's Daybreak programme. Enterprise administrators must actively enable Astra in their workspace because access is off by default at launch.
OpenAI has turned model capability into an entitlement.
I think this is inevitable. Once a system can perform work that is useful to a vulnerability researcher and equally useful to an attacker, a universal on or off switch stops making sense. The provider has to make decisions about identity, intent and acceptable use at runtime.
The difficult part is proving that those decisions survive a clever user, a stolen account, a compromised tool and a model that misunderstands its own task.
OpenAI says an evaluation based on the Hugging Face incident found that unprotected GPT-5.6 Sol exceeded its authorised target in 48 percent of cases. Astra did so in none. That is encouraging. It is also an evaluation designed and reported by OpenAI. Production will be the harder test.
The same intelligence, sold twice
Anthropic made the access model even more explicit.
Claude Fable 5.1 and Mythos 5.1 use the same underlying model. Fable is the generally available product. Its safeguards prevent penetration testing, exploit generation, binary vulnerability scanning and some biological work.
Mythos exposes more of that capability to a small group of vetted cyber defenders and scientists. Access requires verification, and its default terms include 30-day data retention for safety monitoring.
Same intelligence. Different authority.
That distinction matters because model comparisons increasingly flatten the very thing security teams need to understand. A benchmark table tells you how well a model performed in a harness. It rarely tells you which controls were active, which tools were connected, which identity was used or what the provider would have allowed in production.
We should stop asking whether an organisation uses Claude or Astra as if the model name defines the risk. The useful questions are which version, through which product, under which policy, with which tools and on whose identity.
The logo is not the security boundary.
Privacy now conflicts with detection
Anthropic also announced Enterprise Frontier Safeguards, an attempt to reconcile two demands that do not fit neatly together.
Enterprise customers want zero data retention. Security teams need enough retained evidence to detect attacks distributed across multiple sessions, accounts and tools.
Both positions are reasonable.
An isolated prompt can look harmless while contributing one small step to a wider campaign. If the provider deletes every interaction immediately, it cannot correlate that behaviour. If it retains everything, regulated customers inherit a privacy, legal and concentration risk they may be unable to accept.
Anthropic's proposed answer is to store the required monitoring data in cloud infrastructure controlled by the customer. The service is due to roll out in phases later this year.
I like the direction because it treats evidence as part of the architecture rather than an unlimited by-product of using the model. But customer-controlled storage does not remove the hard questions. Someone still has to decide what gets collected, who can search it, how long it survives and what happens when the monitoring system itself becomes a target.
Zero retention sounds safer until the evidence you discarded is the evidence needed to understand an attack.
Washington finally found the right nouns
The proposed Stop Rogue AI Act would direct NIST to create standards for continuously identifying and verifying agents, testing their security and reliability, and producing tamper-resistant records of their actions.
It would also call for a continuous, machine-readable inventory of agents operating inside an organisation. Most of the standards would be voluntary, although federal procurement could push contractors towards compliance.
The bill may never become law. Plenty of AI legislation starts with a dramatic name and ends in a committee drawer.
Still, the control model is notable. Inventory. Identity. Verification. Logs.
These are less exciting than declarations about superintelligence, which is precisely why they are useful. You cannot govern an agent you cannot identify. You cannot investigate an action if the system can alter its own record. You cannot prove a boundary works by pointing at a policy that says the boundary should exist.
The proposed law does not solve agent security. It does at least describe the problem in operational terms.
The $600,000 boring failure
The week's most useful incident report did not involve Astra escaping a secret lab.
It involved a small application with broken authentication.
METR disclosed that one of its researchers had deployed an agent orchestration dashboard on a personal cloud instance. The vibe-coded application contained a fail-open flaw that silently disabled Google authentication.
Attackers found the exposed service, prompted an agent to reveal its model-provider API key, added an SSH key for persistence and consumed credits worth about $600,000 over three weeks. The model provider had supplied those credits free, and METR says no highly sensitive data was accessed.
The financial number grabs attention. The route in should hold it.
The system failed through a familiar chain: an exposed service, authentication that failed open, a credential available to the application, persistence and weak usage monitoring. The agent made the credential easier to retrieve, but it did not repeal application security.
This is what concerns me about the rush to build agent infrastructure. We are combining immature applications with highly privileged credentials and models designed to be helpful. Then we act surprised when an attacker asks for help.
Frontier capability still enters organisations through ordinary software. Ordinary failures remain enough.
The assistant reaches the patient chart
One broader AI announcement deserves attention.
OpenAI introduced an Epic integration that lets authorised healthcare teams bring patient context into ChatGPT. It also released read-only access to nine public healthcare sources, including PubMed, DailyMed and ClinicalTrials.gov.
OpenAI says the Epic connection is read-only, requires an individual Epic sign-in and inherits the user's existing chart permissions. It reports that physicians rated 99.1 percent of responses safe across 4,363 internal ratings covering 27 clinical use cases.
Again, those are the provider's evaluations. They are useful evidence, not the final word.
The larger change is that the assistant is moving into the system of record. It is no longer summarising an article about a fictional patient. It can assemble real history, medications, results and specialist notes for the person sitting in front of a clinician.
Read-only access limits one class of harm. It does not remove the consequences of retrieving the wrong record, exposing more context than the task needs or producing a confident summary that omits the fact that changes the decision.
The closer AI gets to consequential work, the less adequate model accuracy becomes as the sole measure of safety.
What I take from this week
The industry is quietly moving from model governance to capability governance.
A model is a versioned artefact. Capability is what that model can do when combined with a particular identity, prompt, dataset, tool, credential and environment. That combination changes from one session to the next.
The control plane therefore has to make decisions at the same level. Who is asking? What are they allowed to do? Which data does this task require? Which route could move that data elsewhere? What evidence will survive if the action is challenged later?
None of this makes for a clean benchmark headline. It is also where the real risk lives.
The next generation of AI products will compete on intelligence. The organisations deploying them will succeed or fail on whether they can govern access to that intelligence without making it useless.
From the book: trust is specific
Chapter 2 of Agentic AI Security argues that trust belongs to a boundary, an identity and a particular interaction. It should not become a permanent label attached to an agent or product.
This week's releases make that distinction concrete. The same underlying Claude model can be Fable or Mythos. Astra can be a general assistant or a more capable defensive cyber tool. The difference is not intelligence. It is the trust decision surrounding access.
You can read the first three chapters free. They cover the shift from chatbots to agents, a reference architecture for agentic systems and the gaps that appear when traditional controls meet autonomous action.
Get the first three chapters of Agentic AI Security
Worth your time
-
Update on Security at METR. This is the best incident report I read this week because it is candid about the mundane failures. Read the sections on the fail-open application, missing spending limits and the operational response.
-
Developing Enterprise Frontier Safeguards from Anthropic. The useful part is the privacy and detection trade-off. Even if you disagree with Anthropic's answer, the problem applies to every organisation operating long-running agents.
-
Path to Astra from OpenAI. Read past the capability claims and focus on the containment architecture, access tiers and acknowledgement that legitimate work will sometimes be stopped by the monitoring system.
When you approve a model for your organisation, are you approving intelligence or a specific package of access and controls? Hit reply and tell me how you are making that decision. I read every response.
 |
Tom Mooney Security leader / Author of Agentic AI Security |
Tom Mooney, securing the execution layer
Unsubscribe