Still Waiting
on the Bill

In April 2026, Anthropic released a new AI model to a small group of vetted organizations and said clearly that it had no plans to make it publicly available. The model, Claude Mythos, had demonstrated an ability to autonomously find high-severity vulnerabilities in major operating systems and browsers at a level that reportedly exceeded many human security professionals. Anthropic's reasoning was direct: the industry lacked sufficient safeguards against misuse.

Six weeks later, Anthropic reversed course. Alongside a separate model release in late May, the company confirmed that Mythos-class models would be available to all customers in the coming weeks. The public version, reporting suggests, will carry substantial guardrails and more limited cybersecurity functions than the version available to restricted partners. A broader rollout appears imminent.

I am not writing this to second-guess that decision. Anthropic has access to information I do not, and the guardrail work that enabled the reversal may well be sound. What I want to examine is the structure of the situation — because it surfaces something my research has been circling for a while, and names it more clearly than most examples I have found.

The Problem With Amplification

I have written before about the idea that AI should amplify human capability rather than replace it. It is a framing I genuinely believe in. But amplification carries a condition that the slogan often leaves out: amplification works in both directions.

A model capable of finding software vulnerabilities that human security professionals miss is, by definition, also capable of helping someone exploit those vulnerabilities faster than defenders can respond. The same capability. The same model. The outcome depends entirely on who is using it and what they are trying to do.

This is the dual-use problem, and it is not new — it predates AI by decades in domains like chemistry, biology, and cryptography. What is new is the scale and accessibility. A dual-use capability that previously required significant expertise, infrastructure, and time can now be accessed through an API. The asymmetry between offense and defense, already difficult to manage, becomes harder when the tool lowers barriers for both sides simultaneously.

Where My Research Connects

The understanding-trust gap I documented in my dissertation is a finding about individuals under pressure: trust in AI outputs increases even as comprehension decreases. The gap widens exactly when accurate calibration matters most.

The cybersecurity context sharpens this in a way that other domains do not. In most AI deployment scenarios, a miscalibrated trust relationship produces inefficiency, poor decisions, wasted resources. Those costs are real, but they are often recoverable. In the security domain, the cost of miscalibration can be an incident. An unpatched vulnerability. A breach. And unlike a budget overrun or a failed product launch, that kind of bill does not arrive with a clear line item. It arrives as an event, often long after the decision that enabled it.

What concerns me is not that Mythos is being released. It is that the humans on both sides of this — the defenders using it to harden systems, and the actors who will attempt to use it otherwise — are operating under conditions that my research suggests are not optimal for calibrated trust. Defenders are under chronic pressure: understaffed, reactive, working against a threat landscape that moves faster than their tools. Those are exactly the conditions under which my research shows the understanding-trust gap widens. Pressing a powerful, novel tool into that environment and trusting that the guardrails hold is not a small bet.

The Developer's Version of Crisis Adoption

I have written about the Crisis Adoption Problem from the perspective of organizations adopting AI under pressure. But the Mythos reversal surfaces a version of the same pattern on the developer side.

Anthropic stated publicly in April that it would not release Mythos. Six weeks later, it confirmed a public rollout. The reporting attributes this to one of two things: the safeguard work moved faster than expected, or competitive pressure from other frontier labs forced the timeline. Both are plausible. Both are also structurally familiar. "The safeguards are ready" and "we cannot afford to wait" are the two most common justifications for releasing a capability before the environment has fully absorbed what it means.

I want to be precise: I am not claiming Anthropic made the wrong call. I do not have the information required to make that judgment. What I am noting is that the conditions surrounding the reversal — a six-week policy pivot, competitive market dynamics, a capability with acknowledged dual-use risk — are conditions that reliably compress deliberation. That is worth naming, regardless of whether the specific decision was correct.

The Bill We Cannot Price Yet

In an earlier essay I wrote about the day the bill arrives: the moment when organizations that adopted AI broadly, without establishing what the tools were worth, face the accountability reckoning. I described it as a financial event — the point when actual costs surface against a backdrop of unmeasured returns.

The bill I am describing here is not financial. It cannot be priced in advance, because it depends on how a capability is used by people we have not yet identified, in circumstances we cannot fully anticipate, against systems whose vulnerabilities are not yet known. It is the kind of bill that appears as a headline, not a spreadsheet.

That does not mean we should not release powerful tools. It means we should be honest about what we are accepting when we do. Releasing a model with significant offensive cybersecurity capabilities into a broad public environment is an act of trust — trust in the guardrails, trust in the operators, trust in the broader ecosystem of defenders who will need to absorb and adapt to whatever the model enables.

My research suggests that trust, when it outruns understanding, is a liability. That finding was about individual operators at a decision interface. But the structure is the same at every scale. The question is never whether the tool is powerful. It is whether the humans on both sides of its release are prepared for what that power produces.

We are still finding out. The bill has not arrived yet.