Key Takeaways
- UK AISI confirmed Mythos at 73% expert CTF performance — 36x higher than Claude Opus 4.6 (2 exploits) — making it the first frontier model with demonstrated cyber-offensive capability at defensive-relevant scale
- DeepSeek V4 shipping at $0.30/MTok (Apache 2.0) vs Mythos at premium pricing means Anthropic voluntarily forfeits 2-3 quarters of revenue from its most capable model
- White House AI framework explicitly preempts state safety laws with zero federal replacement — no regulatory mechanism to force industry-wide compliance with Anthropic's self-restraint
- Project Glasswing consortium's exclusion of OpenAI signals defensive isolation, not industry coordination — the safety coalition is fragmenting along competitive lines
- By Q3 2026, Mythos-comparable offensive capability becomes open-weight and commodity-priced, rendering containment logically impossible
The Arithmetic of Restraint
Anthropic withheld Claude Mythos from public release under ASL-4 protocols — the company's self-imposed safety restraint framework that restricts access to a 40-entity consortium (Apple, Microsoft, Google, Amazon, NVIDIA). The cost to Anthropic is direct: zero API revenue from the most capable model in its roadmap during the highest-margin quarters of the year.
The structural justification was defensible when only Anthropic possessed frontier cyber-offensive capability. UK AISI's independent evaluation found Mythos succeeded on 73% of expert-level capture-the-flag challenges and completed a 32-step network takeover in 3 of 10 attempts — capability thresholds that did not exist in any prior system. Containment made sense when the asymmetry was 'defenders have it, attackers don't.'
That asymmetry evaporates the moment DeepSeek V4 becomes public.
DeepSeek V4 at $0.30/MTok: When Capability Goes Commodity
DeepSeek V4 is expected to ship at $0.30 per million tokens — approximately 50x cheaper than Mythos-tier enterprise pricing. Internal benchmarks claim 80%+ on SWE-Bench Verified, statistically matching Claude Opus 4.6 (80.8%) and Gemini 3.1 Pro (80.6%).
If those claims hold under independent verification, frontier coding capability becomes open-weight at commodity prices. More critically, DeepSeek's prior R1 release included autonomous exploit-chaining capabilities and was Apache 2.0 licensed. V4 is expected to follow the same distribution model.
The timeline is compressed. Anthropic's own Mythos system card (240 pages) acknowledges: 'Rapid model replication across companies makes long-term containment structurally implausible.' DeepSeek's release proves the point empirically — not as speculation about future capability parity, but as a present-day fact.
Federal Preemption Removes the Regulatory Floor
Anthropic's safety restraint was always premised on the existence of a regulatory floor — a shared understanding that frontier models require governance mechanisms. The White House National Policy Framework (March 20, 2026) demolishes that premise.
The framework explicitly seeks federal preemption of state AI safety laws and recommends creating no new federal AI regulatory body. This is not ambiguous policy — it is active dismantling. New York's RAISE Act (effective March 19, 2026), the only state law requiring frontier model transparency, is specifically targeted by the Trump Administration's AI Litigation Task Force for preemption challenge.
OpenAI's explicit exclusion from Project Glasswing is the tell. If Anthropic and Google believed the safety consortium would become an industry norm, they would have included their primary competitor. Instead, they built it defensively — a coalition that signals 'we trust these 40 entities with dangerous capability' while implicitly excluding others from both the defensive tools and the offensive access.
The Commerce vs. Safety Bifurcation
DeepSeek and Chinese open-weight labs win: they absorb the demand Anthropic voluntarily refuses. Enterprise security firms with Glasswing access (Microsoft, Google, NVIDIA) get a 2-4 quarter head start on defensive tooling. OpenAI, excluded from the consortium but unburdened by matching Anthropic's restraint, can release GPT-5.5 or GPT-6 without equivalently stringent self-imposed restrictions.
Anthropic's revenue team loses catastrophically. The most capable model in the company's roadmap generates $0 API revenue. The AI safety research community loses the narrative that 'voluntary containment works' — the moment DeepSeek V4 ships, the precedent collapses. Enterprise CISOs at non-Glasswing companies face open-weight offensive AI without access to the defensive tooling that consortium members possess.
State attorneys general, unexpectedly, win. Federal preemption weakness validates their continued enforcement authority. By mid-2027, the political failure of the White House 'light-touch' framework becomes clear — not because regulation activists demanded it, but because the market proved the framework had no answer for open-weight frontier capability.
What Happens to Safety When Restraint Becomes Unilateral
By late 2027, three outcomes are plausible:
(A) Anthropic reverses the Mythos restriction to match open-weight commoditization. This means accepting that unilateral restraint is reputational positioning, not capability containment. Mythos gets released and priced competitively, destroying the safety-premium thesis.
(B) The industry converges on a tiered model where 'dangerous' capabilities are only available through regulated consortia (Glasswing-style B2B). This requires competing labs to forgo public revenue — OpenAI, Google, and Meta accept the restraint collectively. This is politically and commercially unrealistic unless there is a forcing incident (leaked capability used for real harm).
(C) Safety becomes orthogonal to model access as open-weight tiers make containment logically impossible. Defensive investment becomes the only mitigation — enterprises with resources train their own specialized models for threat detection, and the market bifurcates into 'offensive capability available to all, defensive capability concentrated among richest enterprises.'
Outcome (C) is most likely. Anthropic's safety leadership was historically premised on the assumption that keeping dangerous capability scarce keeps it controllable. That assumption is falsified the moment frontier models become open-weight commodities. The commercial viability of unilateral restraint is not a technical question — it is a business failure waiting to be acknowledged.