You cannot keep it in a box. Last week proved it twice.

The Trump administration decided the most powerful hacking AI ever built was too dangerous to leave the country. It took a Chinese lab four days to hand the world an equal, for free, on a laptop.

On June 9, Anthropic shipped Mythos, a model that reads a codebase and finds the exploitable flaws in it faster than any human team. Three days later Washington barred Anthropic from giving Mythos, or its sibling Fable, to any foreign national, including its own non-citizen staff, and Anthropic switched both off for everyone. For about a day, the most capable bug-finding AI on earth sat in a box. Then, the same week, the Chinese lab Zhipu released GLM-5.2: open weights, a permissive license, a free download that runs on a laptop, with the safety controls strippable by design. Semgrep benchmarked it against the model Washington had just locked away, titled the result "We have Mythos at Home," and found GLM-5.2 beating Claude Code at a class of access-control bugs at about seventeen cents per vulnerability found.

So inside one week, a serious government made a serious attempt to keep a frontier cyber-capability in a box, and an open-weight equal made the box irrelevant before the news cycle turned over. Not because the control was lazy. Because you cannot export-control a capability another lab can rebuild and give away. Washington decides what its own companies ship. It does not decide what the rest of the world open-sources. One side boxed it, the other set the equal free, same week, opposite directions, one conclusion.

A government treated this like a weapon for a reason every defender should sit with. A model that autonomously finds exploitable flaws is one you point at every wall you have built, and until last week the strongest version of that lived with a vetted hundred. Now the equal is free, tireless, cheap, and running on the same machines your code and your agents already run on. The useful assumption is no longer that you can keep it out. It is that it is already inside, reading, hunting the one secret that turns a foothold into a breach.

That is the question we built Clavitor around, years before this week made it for us: not how to keep the lockpick out, but what it finds when it is in.

Every other vault is a wall around a secret. Get past the wall, by a stolen token, a leaked key, a flaw in the running code, and the secret is right there to read. The wall is the whole defense, so the wall failing is the whole breach. Getting past walls is exactly what a frontier vulnerability-finder is for.

We took the opposite bet, the only one that survives the lockpick getting loose: there is no readable secret at the end of the wall. Your most sensitive fields are encrypted with a key derived from your own hardware, your fingerprint, your face, your security key, at the instant you tap it, inside your own browser. That key is never sent to us and never stored on our servers. We checked this against our own source before writing it down: take the entire backend, every server, the whole database, and what you hold is ciphertext and a 256-bit key you were never given and cannot find, because it was never on the machine you took.

The reason that survives GLM-5.2 is boring, and boring is the point. Finding a software flaw and guessing a 256-bit key are different problems. A frontier model is extraordinary at the first and no better than a coin toss at the second, and no amount of scaling changes that. It attacks implementations. It does not attack entropy. So everything else we run exists only to shrink what it can reach, until the one thing left to attack is the math, and the math does not open.

None of which makes you untouchable, and anyone who sells you that is lying. A good enough attacker, now holding a free frontier bug-finder, will eventually find a flaw in running code. Assume it gets in. What we took away is the payoff. Get in, and the secrets are ciphertext whose key was never there to find, because it lives on your hardware and exists only in the instant you use it. We do not promise you cannot be reached. We promise there is nothing decryptable at the end of the reach.

The headline this week is geopolitical, and it will cycle out. The part that lasts is quieter: a capability cannot be kept in a box, and last week proved it twice, in opposite directions, at once. The answer was never a better box. It is to stop putting anything in one worth the trouble of opening. We did not build a vault nobody can break into. We built the one you can break into and still walk out of empty-handed.

The rules we hold ourselves to, for the side of the house where this danger actually lives, are here.

So here is the question worth arguing about, because the answer changes how you build everything else: do you think we can keep the next generation of these models out of our systems at all? Or is the only honest plan to assume they are already inside?

Clavitor (@clavitorai) is the credential vault built for AI agents, and against them. clavitor.ai

Sources

Fortune (@FortuneMagazine): "Anthropic disables Fable and Mythos AI models following U.S. government export ban." The June 9 launch, the June 12 Commerce directive barring distribution to any foreign national, and Anthropic disabling both models for all users. [1]

Semgrep (@semgrep): "We have Mythos at Home: GLM-5.2 beats Claude in our cyber benchmarks." Open-weight GLM-5.2 benchmarked on vulnerability detection, beating Claude Code on access-control (IDOR) bugs at roughly $0.17 per finding. [2]

CNBC (@CNBC): "Trump admin allows Anthropic to release Mythos AI model to some companies, government agencies." The later limited release of Mythos to roughly 100 vetted companies and federal agencies. [3]

Cybersecurity Dive (@CyberSecDive): "Cybersecurity experts blast U.S. government for restricting Anthropic's AI models." Industry reaction that the capability is common enough that the control could not hold. [4]