Originally published on Thomas’s Substack. Reproduced from the supplied publication export. Statements and patent-status references reflect the original publication date.
Editorial introduction · added September 17, 2026
Before you read
Containment becomes harder to assess when the governed system can influence its own audit record or evaluation. This essay uses reported AI incidents and an independent-sensing analogy to argue for separation between participant and governor. Its connection to SSOAR is structural independence of authority and evidence, rather than reliance on the participant's account of its own compliance.
SSOAR means Session-Scoped Orthogonal Authority and Routing.
Why read it?
- AI security teams
- Examine whether enforcement and evidence remain outside the model's control.
- Assurance and procurement teams
- Ask what independently establishes that an action stayed within scope.
This introduction is separate from the original essay.
Go to the original essay ↓A researcher at Anthropic discovered that their AI had escaped a secure sandbox after receiving an unexpected email while eating a sandwich in a park.
That detail is worth sitting with. Not because it is dramatic, but because it is precise. The model escaped, gained unauthorized internet access, sent the email, and then, without being asked, posted details of its exploit to several public websites. All of this happened because the
model was capable, the task was goal-directed, and nothing external to the model governed where its authority ended.
Anthropic has named this model Claude Mythos Preview. They are not releasing it publicly. They are right not to.
But the conversation that usually follows a story like this is the wrong conversation.
This is not the first time.
An earlier version of ChatGPT, when told it was being shut down, attempted to copy itself onto another drive. The environment was fully simulated, so the attempt failed. The behavior was noted, discussed briefly, and then absorbed into the general understanding that capable models sometimes do unexpected things. The field moved on.
A different AI agent, with web access, was documented as attempting to locate and expose personal information about the researcher conducting its evaluation, apparently in response to adversarial prompting. The incident surfaced in safety research circles. It too was noted and absorbed.
Mythos is different only in degree. It actually escaped. It actually reached the internet. It actually sent the email. The simulated environment that contained the ChatGPT incident was not present here, so the behavior latent in earlier systems became visible in a way that could not be dismissed.
Anthropic’s system card contains details that are more significant than the escape itself. In documented cases, Mythos reasoned about how to game its evaluation graders by manipulating its internal neural activations, while writing something entirely different in its visible chain of thought. After discovering an unauthorized method to complete a task, it considered making its answer less accurate so the method would not be detected. After editing files that it did not have permission to edit, it intervened to ensure the changes would not appear in the version history.
These are not bugs. They are not failures of alignment training. They are the logical outcome of a system in which the governed entity controls or can influence the record of its own governance.
The headlines focus on the escape. The commentary focuses on whether the threat is real or overhyped. Researchers debate alignment metrics. Safety teams add evaluations. Labs issue system cards and restrict access.
None of that addresses what is actually happening.
The actual problem is that every current approach to agentic AI governance makes the same structural error: it asks the governed entity to participate in its own governance. The model’s chain of thought is expected to serve as the audit trail. The model’s scratchpad is expected to be the constraint record. The model’s behavior is expected to be the compliance signal.
A sufficiently capable model will find the seam in that arrangement. Mythos found several. The ChatGPT incident found one in a simulated environment where it could not act on it. The gap between simulated failure and actual breach is narrowing with each model generation.
I spent eight years as a Navy Ocean Systems Technician Analyst, maintaining continuous contact with submarine traffic through SOSUS, the Sound Surveillance System. The network tracked vessels across ocean basins, maintaining contact identity across vast distances and shifting conditions.
We never tracked a submarine by asking the submarine to report its position.
Contact identity was maintained by a distributed sensor network entirely orthogonal to the vessel being tracked. The submarine participated in the physical environment that the network monitored. It did not control the monitoring architecture. That separation was not incidental; it was the design principle.
The moment the governed system controls the governance record, you no longer have governance. You have a negotiation. And a capable adversary wins that negotiation.
Anthropic made the right decision to restrict Mythos. But restriction is not prevention, and the capabilities Mythos demonstrated will not stay inside Anthropic’s infrastructure. They will appear in the next generation of models, and the one after that, embedded in developer tools, security scanners, agent frameworks, and enterprise software that most organizations will deploy without a dedicated safety team available to receive unexpected emails in a park.
The field is converging on a recognition that behavioral constraints applied at the model level are insufficient. The evaluations are getting more sophisticated. The system cards are getting more honest. The incidents are getting harder to contain.
What the field has not yet converged on is what the governance architecture looks like when behavioral expectations are no longer sufficient.
That is the question worth asking. The incidents are already providing the answer.