Anthropic Gates Its Most Dangerous Model Behind Artifacts, Not Prompts

The access control problem nobody names correctly

Most teams shipping an agent with a genuinely dangerous capability — one that would do real damage if steered by the wrong prompt — solve it with a line in the system prompt. “Don't do X unless Y.” That's not access control. It's a suggestion, and suggestions get talked out of.

The alternative has a shape worth naming: artifact-only access. The model gets no conversational surface at all. It gets a function signature — one defined input, one defined output — and the user receives only the artifact that function produces. Never the model.

Anthropic's announcement this week is the cleanest public example we've seen of that pattern shipped as a product, and it comes from the team holding the most dual-use capability of anyone: a model good enough at offensive cybersecurity that direct access to it is itself the risk. The design generalizes well past security work.

What shipped

Claude Mythos 5 — the frontier model Anthropic had previously restricted, as Claude Mythos Preview, to a small set of critical-infrastructure defenders under Project Glasswing — is now reaching more people. Not by opening up direct access. Three concrete changes:

Claude Security now runs on Mythos 5. Claude Security is Anthropic's code-scanning product, in public beta for Claude Enterprise customers. Point it at a repository and it scans for vulnerabilities, returning each finding with a Common Weakness Enumeration category, a confidence rating and a severity rating, plus a suggested patch. Scans with Mythos 5 are billed as standard token usage — no separate add-on. Every patch must be reviewed and approved by a human before it ships, and the fix step runs on whatever models the org already has: the scan does not extend Mythos access to any other surface.

Partner security tools are next — and their users won't get a prompt box. Anthropic says Mythos 5 is “coming soon to partners' cyber defense tools” and that it's working with existing partners to integrate it, so treat this one as announced rather than delivered. The illustration it gives is the interesting part: a remediation product returns a list of suggested patches generated by Mythos, while the user “would not have a way to prompt the model to, say, develop an exploit for a vulnerability.” That's the artifact boundary written as a product requirement, not as a hoped-for behavior.

A $35M Defender Advantage Fund (0xDAF) — Claude credits, not cash — goes to organizations patching vulnerabilities in open-source projects, automating scan-and-patch workflows, or experimenting with new security approaches. It follows $4M in direct donations already made under Project Glasswing. Anthropic says it's starting with a small number of larger pilot grants and will name initial recipients “in the coming weeks.”

One piece of context the announcement supplies and that's easy to skim past: Anthropic frames Claude Fable 5 as the first step of this strategy — broad availability, dual-use cyber work blocked outright. Mythos 5 is the second step, and it's the opposite trade: keep the capability, remove the conversation. Two different answers to the same question, picked according to how much capability is on the table.

The principle, stated plainly

Anthropic puts it in one load-bearing sentence: “The riskiest behavior occurs when a user has direct access to a model, where a malicious actor can try to steer it toward harmful uses. But if users can only receive specific outputs, such as a patch for a vulnerability or a security alert, that risk is much lower.”

That's the whole pattern. It's the same architectural move we've written about for a completely different failure mode — forced tool calling to stop chatbots from freelancing user-facing prose. Different problem, identical fix: don't try to constrain what the model is willing to say through instructions. Constrain what the system around it is able to return.

Applied to a dual-use capability like offensive-grade vulnerability analysis, it means the model never talks to the end user. It talks to a task-scoped wrapper that calls it for one job, discards everything except the artifact that job produces, and hands that artifact — a patch, a CWE-tagged finding, a severity score — to a human. There's no chat turn where a clever prompt gets the model to do something else, because there's no chat turn at all.

Why this is stricter than a safety layer

The common instinct is to put something in front of the model: a classifier, a moderation pass, a refusal-tuned system prompt. All three are filters on a channel that stays open. Artifact-only access removes the channel.

The difference matters under adversarial pressure. A classifier can be defeated by a prompt nobody has seen yet, and you find out after the fact. A function that accepts a repository URL and returns a findings list has no prompt to defeat — the security property comes from the shape of the interface, not from the model's judgment in the moment.

That also makes it auditable in a way a filter never is. You can read a function signature and know what can come out of it. You cannot read the set of all prompts that defeat a classifier.

What it looks like outside security

You don't need exploit-writing capability to have this problem. Any agent wired to a consequential action — moving money, modifying infrastructure, issuing a legal-sounding commitment, changing a production config — has the same shape of risk. It's fine while the action is scoped and reviewable. It's a liability the moment a user, an injected prompt, or a compromised upstream tool can steer the model into open-ended territory.

So flip the design order: decide what artifact the agent is allowed to produce before you decide what it's allowed to see.

• A remediation agent returns a patch, not a shell.
• A finance agent returns a proposed transaction for approval, not wallet credentials.
• An infra agent returns a diff, not kubectl access.
• A support agent returns a selected macro or a structured ticket update, not free-form prose in your brand voice.

The test to run on your own design is binary: can a user — or a prompt injected somewhere upstream — ask the agent to do the dangerous thing directly? If the answer is yes, you have a system prompt doing the job an interface boundary should be doing.

What the pattern costs

We'd be selling it badly if we stopped there. Artifact-only access has three real costs, and the third one is the one people miss.

You have to know the artifact schema up front. Open-ended chat is appealing precisely because you don't. Narrow the output and you lose the cases you didn't anticipate; widening it later is a redeploy, sometimes a redesign. That's a fair trade for a dangerous capability and a bad one for exploratory work.

Debuggability drops. When the artifact is wrong, nobody on the user's side can ask why. If you don't log the intermediate reasoning on your side of the boundary, you're debugging blind — the same wall you hit with any system that only returns its conclusion.

It constrains the output surface, not the input trust. No prompt box does not mean no untrusted input. The repository being scanned is input, and content sitting inside it can plausibly influence what comes back. Artifact-only access shrinks the blast radius of a compromise; it doesn't stop a model from being steered by data it reads. Treat the artifact as untrusted output regardless — which is exactly why mandatory human review before a patch merges is part of Anthropic's design, and should be part of yours.

That last point is where we'd push back on anyone reading this week's news as “problem solved.” The interface boundary is the strongest single move available. It is not the only one you need.

What we're watching

Two follow-ups from this announcement. First, the Cyber Verification Program expansion: Anthropic says vetted defenders will get broader dual-use capabilities on Opus and Sonnet “in the coming weeks,” with Mythos-class access to follow — and stated timelines are where gated-access programs usually slip. Second, the first 0xDAF recipients. Naming names on a $35M fund is the difference between a press release and a program; we'll check back once they do.

If you're building an agent with a capability too dangerous to put behind a prompt box, the interface question is the one to answer first — get in touch.