I think the cyber concern is legitimate but the framing is still very capabilities-centric. The more interesting thing about the Mythos situation is that Anthropic's mitigation strategy is entirely structural, they'll give defenders early access so they get a head start. Instead of them orchestrating an alignment intervention or capabilities restriction, they're sequencing Mythos's deployment. Who gets access, when, under what conditions. The model itself is dual-use by nature; the same capability that finds vulnerabilities for defenders finds them for attackers. What determines whether this net-positive or net-negative isn't a property of the model, I believe it's a property of the institutional context it's deployed into.

Which makes the leak itself the most informative data point here. A company building what it describes as an AI model with unprecedented cybersecurity capabilities exposed the existence of that model through a CMS misconfiguration. That is an institutional failure (although perhaps failure is a strong word here). It's the kind of thing that doesn't show up in model evaluations at all. If the worry is that cyber offense will outpace defense, the bottleneck probably isn't the single model's capability curve. I believe that the real bottleneck lies in whether the organizations deploying these models can maintain the operational discipline the deployment strategy assumes.