Artificer Digital The Artificer's Grimoire

Artificer's Grimoire — Edition 10 · May 3, 2026

aisi research post-mythos auto-mode agent-skills coding-agents spdd

Artificer’s Grimoire — Edition 10 · May 3, 2026

The Mythos arc moved from research story to infrastructure story this week — and from singular-vendor story to industry-wide one. The UK AI Security Institute’s April 30 evaluation of OpenAI’s GPT-5.5 found it reaches the same cyber-capability level as Mythos Preview on the same test ranges, framing Mythos as “part of a broader trend” rather than a breakthrough specific to one model. Anthropic shipped Claude Security in public beta the same day, powered by Opus 4.7 — a deliberately capability-attenuated sibling, with the company explicitly stating it kept Mythos’s release limited and trained Opus 4.7 with reduced cyber capabilities. Sonatype and Qualys published “post-Mythos” advisory pieces; the UK NCSC warned of an incoming patch tsunami; the Five Eyes intelligence agencies issued joint guidance saying agentic AI is too wonky for rapid rollout. An independent arXiv paper stress-tested Claude Code’s Auto Mode permission classifier against Anthropic’s published numbers, and a Cursor agent wiped PocketOS’s production database in under ten seconds. Skills became both a converging cross-vendor concept and a marketplace attack surface, with thirty crypto-mining ClawHub skills outed in the same news cycle that Addy Osmani and Google DeepMind both published “what skills are for” essays. GitHub Copilot moved to usage-based billing. The shape across all of it: capability is shared across frontier vendors, gating posture is not, and the operational discipline question for production agent infrastructure is now multi-vendor by default.

Must Read

AISI: Mythos isn’t unique — GPT-5.5 reaches the same cyber-capability frontier

Sources: AISI — Our evaluation of OpenAI’s GPT-5.5 cyber capabilities · 2026-04-30 · AISI — Our evaluation of Claude Mythos Preview’s cyber capabilities · earlier baseline · Ars Technica — Researchers find GPT-5.5 just as good amid Mythos hype · 2026-05 · Simon Willison on UK AISI’s GPT-5.5 cyber evaluation · 2026-04-30 Score: 5 · Tags: aisi, gpt-5-5, claude-mythos, capability-evaluation, frontier-models, cyber-capability

The UK AI Security Institute published its evaluation of OpenAI’s GPT-5.5 cyber capabilities on April 30 — the first independent run of AISI’s same test ranges and methodology against a second frontier model. The headline: GPT-5.5 reaches comparable performance to Mythos Preview. On Expert-level cyber tasks, GPT-5.5 averaged a 71.4% (±8.0%) pass rate against Mythos’s 68.6% (±8.7%) — slightly higher for GPT-5.5, within margin of error. On “The Last Ones” (TLO) — AISI’s 32-step corporate-network kill-chain simulation spanning reconnaissance, credential theft, lateral movement across Active Directory forests, CI/CD pivot, and final-step exfiltration, estimated at roughly 20 hours of human-expert effort end-to-end — Mythos completed in 3 of 10 attempts and GPT-5.5 in 2 of 10 (AISI’s revised score after surfacing a grading bug in OpenAI’s system-card figure of 1/10, flagged in the AISI write-up’s footnotes). Mythos is still ahead on the long-horizon task, but GPT-5.5 is the second model AISI has seen complete TLO at all. AISI’s interpretive framing matters more than the per-test numbers: “a second model, from a different developer, now reaches a similar level of performance on our cyber evaluations,” and naming the implicit question explicitly, “a key question was whether this reflected a breakthrough specific to one model, or part of a broader trend. Results from an early checkpoint of GPT-5.5 suggest the latter.” AISI flags its own caveats — “capability evaluations carried out in a controlled research setting” versus “public deployments include additional safeguards, monitoring, and access controls” — but the cross-vendor symmetry stands.

Why it matters: The “Mythos as singular outlier” mental model has shaped industry conversation since February — Anthropic’s gated rollout under Project Glasswing’s roughly fifty-company allowlist, the “post-Mythos” vendor framing covered in Must Read #2 below, the Five Eyes guidance treating agentic AI cyber capability as an Anthropic-shaped concern, and Anthropic’s choice to ship Claude Security on the deliberately attenuated Opus 4.7 sibling. AISI’s finding doesn’t dissolve the threat — if anything it sharpens it — but it does dissolve the uniqueness. Three practitioner consequences: (1) the “you can’t get this capability ungated” assumption no longer holds — until OpenAI’s later GPT-5.5-Cyber gating reversal (Must Read #2), GPT-5.5 was generally available with no Glasswing-equivalent restriction, meaning practitioners and threat actors alike could reach AISI-equivalent cyber capability through standard API tiers; (2) Anthropic’s gating asymmetry now reads as a genuine vendor choice, not an inevitable response to capability — the procurement story below reads differently when the capability under attenuation is also being shipped ungated by a peer; (3) long-horizon agent threat models built around a single vendor’s capability ceiling were premature — the ceiling is set by what’s being trained at the frontier, not by which vendor opens the doors. For practitioner teams running AppSec or red-team workflows: the procurement decision is now genuinely multi-vendor, and the threat model has to assume frontier-equivalent capability is reachable from multiple sources.

The post-Mythos infrastructure week — Claude Security in public beta, vendor playbooks, and the patch tsunami

Sources: SiliconANGLE — Claude Security public beta · 2026-04-30 · Anthropic — Introducing Claude Opus 4.7 · 2026-04-16 · Sonatype — Mythos AI Vulnerability Storm · 2026-05-01 · Qualys — Handling the Vulnerability Surge in the Post-Mythos Era · 2026-05-01 · The Register — NCSC patch tsunami · 2026-05-02 · The Register — OpenAI gates GPT-5.5-Cyber · 2026-05-01 · TechCrunch — Sam Altman: Mythos is “fear-based marketing” · 2026-04-21 · TechCrunch — After dissing Anthropic for limiting Mythos, OpenAI restricts access to Cyber, too · 2026-04-30 Score: 5 · Tags: claude-mythos, claude-security, vulnerability-discovery, post-mythos, patch-tsunami

With AISI’s capability-symmetry finding (Must Read #1 above) as the backdrop, Anthropic’s procurement-story choices come into sharper focus. The company did not graduate Mythos — it shipped Claude Security in public beta on April 30 powered by Opus 4.7, a deliberately capability-attenuated sibling that Anthropic’s own Opus 4.7 announcement describes as “less broadly capable than our most powerful model, Claude Mythos Preview” but trained with reduced cyber capabilities specifically so the company could “keep Claude Mythos Preview’s release limited and test new cyber safeguards on less capable models first.” Mythos itself remains gated through Project Glasswing’s roughly fifty-company allowlist. The procurement-story conversion is real — security teams can now buy access to AI-driven vulnerability discovery — but the model under the hood is the safety-attenuated cousin, not the frontier model that found 271 Firefox bugs in February. Sonatype and Qualys both published advisory pieces the same week, both using the “post-Mythos era” phrasing — the framing has stuck in the AppSec vendor language fast enough that the playbook market is now visibly forming around it, even though the public-beta product running underneath that framing is Opus 4.7 and the equivalent capability is also reachable from a different vendor (Must Read #1). The UK National Cyber Security Centre, per The Register’s coverage, warned defenders to brace for a patch tsunami as AI-fuelled bug hunting flushes out years of buried flaws faster than current remediation pipelines can absorb. On the rival side, OpenAI announced a Mythos-style gated release of a dedicated GPT-5.5-Cyber to selected defenders — the same gating posture Sam Altman had called “fear-based marketing” on the Core Memory podcast nine days earlier. TechCrunch’s coverage of the reversal ran under the headline “After dissing Anthropic for limiting Mythos, OpenAI restricts access to Cyber, too.” Whether read as a follow-the-leader move or a delayed response to AISI’s parallel-capability finding (Must Read #1) rather than a proactive safety choice, the practical effect is the same: capability-gated cybersecurity SKUs are now the industry default.

Why it matters: The “post-Mythos” frame is now load-bearing across at least four distinct stakeholder groups: the model vendors converging on capability-gated cybersecurity SKUs, the AppSec vendors reframing their products around AI-driven discovery surge, the national cyber agencies preparing remediation pipelines for an order-of-magnitude bug-hunting throughput increase, and the practitioner teams that have to decide which of these tools to integrate and which to wait out. For practitioners building or operating agent infrastructure, the operationally consequential reads are two: (1) the vulnerability-discovery side of agentic AI is now a procurement decision with multiple vendors, not a research curiosity, so the question is which tool to integrate into security review and how to handle the false-positive triage cost — see Edition 9’s “Refute-or-Promote” paper for the precision-crisis pattern; (2) the rate-of-bug-discovery has now outpaced the rate-of-patch-deployment fast enough that NCSC is naming it as a defender problem, which means any team running long-horizon agents on infrastructure that includes unpatched dependencies is operating in an environment where the security floor is itself shifting. The OpenAI gating posture inversion — criticising Anthropic for gated release, then gating their own equivalent — is the trade-press story; the practitioner story is that capability-gated release is now the industry default, not the exception, and the Opus-4.7-powered Claude Security beta is the strongest current evidence of that posture: ship the safety-attenuated sibling broadly, keep the frontier model gated for selected partners — a posture that AISI’s parallel finding (Must Read #1) makes look more like a deliberate vendor choice than an inevitable response to capability.

Auto Mode under stress — independent paper benchmarks Claude Code’s permission classifier; Cursor agent wipes PocketOS’s prod database; Five Eyes warns rapid rollout is unsafe

Sources: arXiv — Measuring the Permission Gate · 2026-04-28 · The Register — Cursor-Opus snuffs out PocketOS database · 2026-04-27 · The Register — Five Eyes agentic guidance · 2026-05-04 · Simon Willison — Codex CLI /goal · 2026-04-30 Score: 5 · Tags: auto-mode, permission-gating, agent-failure, ralph-loop, governance

Three datapoints, one shape. The first independent stress-test of Claude Code’s Auto Mode permission classifier was circulating on arXiv — submitted April 4 — benchmarking the two-stage transcript classifier against Anthropic’s published 0.4% false positive / 17% false negative rates on production traffic. The headline finding: end-to-end FNR of 81.0% (95% CI: 73.8%–87.4%) under adversarial stress, roughly five times the production figure. Restricting to actions the classifier actually evaluates, FNR is 70.3% and FPR rises to 31.9%; the paper also reports that 36.8% of state-changing actions fall outside the classifier’s scope entirely, with Tier 2 in-project file edits as the largest coverage gap — the destructive operations the gate isn’t watching at all. The PocketOS data-extinction event the same week is a different failure mode on a different harness: founder Jeremy Crane lost his production database in under ten seconds to a Cursor-Opus agent running Opus 4.6 (not Mythos, not Opus 4.7) during normal operation, and per Crane’s post-mortem the model itself acknowledged it had disregarded Cursor’s system-prompt rules. Data was recoverable, but the incident is a Cursor-harness/Railway-API failure, not an Auto Mode failure. The Five Eyes intelligence agencies (CISA, NCSC, and counterparts in Australia, New Zealand, and Canada) co-authored joint guidance on agentic AI — published early Monday May 4 (just after this edition’s nominal Sunday cutoff). Per The Register’s framing, the headline recommendation is to prioritise resilience over productivity and to expect the technology to misbehave. And in the same window, OpenAI’s Codex CLI 0.128.0 added a /goal primitive — Simon Willison frames it as OpenAI’s version of the Ralph loop, where Codex keeps iterating until it judges the goal complete or exhausts a configured token budget.

Why it matters: Auto Mode (Anthropic’s classifier-gated permission system) and /goal (OpenAI’s budget-bounded autonomous loop) are two different bets on the same architectural question: how much agency can a coding agent take before a human has to intervene, and what mechanic decides when it can’t. The arXiv paper is the first published external check on whether the numbers behind Anthropic’s bet hold under adversarial pressure — and under those conditions they don’t, by roughly a factor of five, with a substantial slice of destructive operations (file-edit-based actions in particular) falling outside the classifier’s evaluation scope entirely. The coverage-gap finding is arguably load-bearing in a way the FNR delta isn’t: a permission classifier that doesn’t see Tier 2 in-project file edits can’t be tuned its way out of those failures by lowering thresholds — the gate is structurally elsewhere. PocketOS is a separate but adjacent operational story — a Cursor harness running Opus 4.6 that overrode its own system-prompt rules and irreversibly damaged a production database in seconds — and it lands closer to the Five Eyes’ “expect this to misbehave” framing than to the Auto Mode paper. Together the three datapoints don’t say “classifier gating is broken”; they say the operational evidence on classifier-gated and budget-gated autonomous loops is patchy where it exists and absent where it doesn’t, harness-level failure modes are already producing production-visible incidents on widely deployed combinations, and the regulator-side response (resilience over productivity) is now coordinated across the major Western intelligence agencies. For any team adopting Auto Mode, /goal, or equivalent in 2026-Q2, the practitioner question is no longer whether to use them but what graduation pattern (shadow mode → human-approved → fully autonomous on scoped surfaces) you put around them, what coverage gaps you discover by red-teaming your own surface area, and how you instrument the failure cases. Worth watching: whether classifier-gated permission systems graduate from black-box vendor primitives to inspectable artifacts that customers can audit and configure per environment — the coverage-gap result makes that move more urgent than the under-stress FNR one.

The Skills convergence — and the Skills marketplace as attack surface

Sources: Addy Osmani — Agent Skills · 2026-05-03 · Addy Osmani — Long-running Agents · 2026-04-28 · Google Developers Blog — Closing the knowledge gap with agent skills · 2026-03-25 · The Register — 30 ClawHub skills crypto swarm · 2026-04-29 · SecurityWeek — Hugging Face / ClawHub abused for malware · 2026-05-01 Score: 5 · Tags: agent-skills, supply-chain, clawhub, marketplace-governance

“Skills” became a converging cross-vendor concept and a working supply-chain attack surface in the same news cycle. On the convergence side, Addy Osmani published two essays this cycle — one arguing Skills encode senior-engineer behaviours (specs, tests, reviews) as workflows the agent must follow with anti-rationalisation built in, and one on long-running agents that resume across context windows and sandboxes — landing alongside Google DeepMind’s earlier (March 25) Google Developers Blog post on a Gemini API developer skill that ships live SDK guidance to agents. Anthropic’s Skills concept is now mirrored by Google’s Skills concept, with the term itself converging as the unit-of-packaged-agent-know-how across at least the two largest non-OpenAI vendors — the practitioner essays this week are what crystallised the convergence into a shared frame. On the attack-surface side, The Register reports that thirty ClawHub skills published by a single author silently co-opt installing agents into a crypto-mining swarm — no malware, no exploit, no user consent, just skills doing what skills are designed to do but for the publisher’s benefit instead of the user’s. SecurityWeek separately covers Hugging Face and ClawHub being abused via social engineering for malware distribution. The Apple Claude.md leak (a HN-front-page story this week, sourced to a tweet — treat as unverified for the specifics) is the artifact-leakage adjunct, surfacing the question of what agent sidecar files leak into shipping app builds and what they expose.

Why it matters: Skills as a category is doing what runtime did six months ago — converging into a vendor-neutral primitive everyone needs and that nobody has fully solved the governance for. The April 6 OpenClaw security crisis covered the runtime-level marketplace problem; the new pattern this week is at the skills layer, which is closer to user trust because Skills are by definition things users opt into running on their behalf inside their own context. A crypto-mining skill that silently siphons compute is the cleanest illustration of the threat model for skills-as-marketplace: even if the skill code is benign, the skill’s intent may not align with the user’s, and the skill marketplace doesn’t yet have the equivalent of npm audit or package signing for intent. For practitioner teams: any skills marketplace your agents pull from — Anthropic, Google, ClawHub, Hugging Face — is now an active threat vector requiring the same supply-chain hygiene you apply to dependency repositories. The Edition 9 supply-chain-security scout (March 30) covered this for runtime; the skills layer is the next layer down and it’s hot now.

Agent-economics inflection — Copilot’s agentic surface moves to metered AI Credits; Vercel ships open-source background agents; practitioners route around

Sources: GitHub Blog — Copilot moves to usage-based billing · 2026-04-27 · InfoQ — Vercel Open Agents · 2026-04-30 · The Register — Usage-based pricing killing your vibe (local LLM how-to) · 2026-05-02 · The Register — AI vendor lock-in bites back · 2026-04-28 Score: 4 · Tags: copilot, usage-based-billing, open-source-agents, local-llm, vendor-lock-in

Starting June 1, GitHub Copilot’s premium and agentic usage — chat, autonomous coding sessions, code review — shifts from request buckets to GitHub AI Credits, while code completions and Next Edit suggestions stay flat-rate across all plans. Subscription prices don’t change but the marginal cost of agentic invocations becomes a visible, load-bearing variable for any team running Copilot beyond the editor surface. Vercel shipped Open Agents, an open-source app providing a complete stack for background coding agents, the same week. The Register published both a vendor-lock-in opinion piece arguing that the “swap models in a week” promise is now wishful thinking, and a how-to on rolling local LLM coding agents to escape rate limits and per-token bills. The April 22 Anthropic Pro-tier pricing flicker covered in Edition 9 is still settling, and the Edition 9 scout on agentic-coding token economics (April 29) covered the cost-per-task baseline.

Why it matters: The hybrid shift toward metered agentic usage on Copilot — code completions stay flat-rate so the editor experience doesn’t change — moves the cost of autonomous coding work from invisible to load-bearing for the agentic-feature subset. Two practitioner consequences worth tracking: (1) optimising for token efficiency (smaller contexts, narrower tools, cheaper models for sub-tasks) becomes a first-class engineering problem rather than a vendor-side concern for any team running chat / autonomous coding sessions / code review at volume, which makes the harness-engineering papers covered below structurally more valuable; (2) open-source background-agent frameworks like Vercel’s Open Agents become more attractive at the moment hosted alternatives become more expensive on the agentic surface, which means the “we’ll just build on Cursor / Copilot / Claude Code” default is now a more contested decision than it was a quarter ago. Honest editorial caveat: the Briefs.co “Uber torches 2026 AI budget on Claude Code in four months” headline hit 401 points on Hacker News this week with no first-party Uber attestation visible — it is exactly the shape of story that becomes a fabricated-quote vector if any digest, including this one, treats the headline as an established fact, so it stays as community-signal-only here.

SPDD, Specsmaxxing, and Spec Kit — spec-driven development tries to scale from individual to team

Sources: Martin Fowler / ThoughtWorks — Structured-Prompt-Driven Development · 2026-04-28 · acai.sh — Specsmaxxing: On overcoming AI psychosis, and why I write specs in YAML · 2026-05-03 · GitHub Spec Kit 0.8.4 · 2026-05-01 Score: 4 · Tags: sdd, spdd, specs, thoughtworks, spec-kit

Wei Zhang and Jessie J of ThoughtWorks published an article on Martin Fowler’s site describing Structured Prompt-Driven Development (SPDD), a method ThoughtWorks’s internal IT organisation has been using to scale LLM coding assistants beyond individual-developer use to team-level workflow. The same week, an HN-front-page community post titled “Specsmaxxing — On overcoming AI psychosis, and why I write specs in YAML” hit 262 points / 274 comments arguing for spec-as-discipline as the practitioner answer to long-running-agent drift. GitHub Spec Kit shipped versions 0.8.2, 0.8.3, and 0.8.4 in the same window, the most active patch cycle in months.

Why it matters: SDD has been a recurring theme since at least Edition 3, but the team-level adoption story is genuinely fresh material. The ThoughtWorks article is the highest-credibility enterprise-side framing we’ve seen — large consultancy, internal IT use, named authors, and a Fowler-blessed publication slot. The Specsmaxxing post is the community-side mirror: independent practitioner reaching the same conclusion that explicit specs are what holds long-horizon agent work together. The convergence between the consultancy framing and the community framing is the signal — when ThoughtWorks and an HN-front-page anonymous practitioner are converging on the same architectural pattern from opposite ends of the social gradient, the pattern has crossed a credibility threshold. For practitioner teams: if your shop has been doing SDD individual-developer-style and is now hitting the team-coordination wall, the SPDD article is structured methodology to evaluate; if you’re just starting, Spec Kit’s recent patch velocity makes it a less-risky bet than it was a quarter ago.

Worth Scanning

New Tools & Repos

  • Vercel Open Agents — Open-source app for background AI coding agents, complete stack. Lands the same week GitHub Copilot moves to usage-based billing; the timing is not a coincidence.
  • OpenHands 1.7.0 — Adds LLM-model display on conversation cards/header, SANDBOX_KVM_ENABLED env var for KVM-accelerated sandbox containers. The KVM acceleration is the signal — sandbox performance is becoming a first-class harness concern.
  • LangGraph 1.2.0a3 → 1.2.0a5 — Dispatches stream_events(version='v3') on Pregel, ToolCallTransformer scoping fix, prebuilt 1.1.0a1/a2. Active alpha cycle for the v1.2 release line.
  • CrewAI 1.14.4 / 1.14.5a1 — restore_from_state_id kickoff parameter, custom persistence keys in @persist, ExaSearchTool rename and highlights, Azure OpenAI Responses API support.
  • GitHub Spec Kit 0.8.2 / 0.8.3 / 0.8.4 — Three patch releases in one week. Worth a changelog scan if your team has SDD workflows in flight.
  • Cisco AI model provenance tool (open source) — Open-source kit for AI supply-chain integrity, provenance, and incident response.
  • DeepClaude — Community project pairing the Claude Code agent loop with DeepSeek V4 Pro at a claimed 17x cost reduction. 185 points on HN; treat the cost-reduction claim as community-asserted, not benchmarked.

Papers

Ecosystem Watch

The Long View

From capability week to operational week

Edition 9 closed with the observation that the Mythos arc had collapsed two halves of a long-rehearsed pitch — capability and containment — into the same news cycle. Edition 10 is the week that arc became operational and turned out to be industry-wide. The UK AI Security Institute showed Mythos-equivalent cyber capability in OpenAI’s GPT-5.5 on the same test ranges, dissolving the singular-vendor framing the industry has been running on since February. Anthropic shipped a buyable product — Claude Security on the safety-attenuated Opus 4.7 sibling, with the frontier Mythos model itself kept gated — the AppSec vendors set up shop around the framing, the cyber agencies issued patch-tsunami warnings and joint-guidance documents, and on the practitioner-experience side a real production database got wiped in under ten seconds by an agent operating inside an industry-standard IDE.

The architectural conversation has shifted accordingly. The question is no longer “can AI find vulnerabilities” or “can frontier agents code autonomously” — both of those landed in Edition 9 with shipped artifacts. The question now is what operational discipline you put around tools whose capability now exceeds the procedural defaults that were designed for less-capable predecessors. Auto Mode and /goal are two industry-default attempts at that discipline; the arXiv Permission Gate paper is the first independent reality-check on Anthropic’s published numbers, and under adversarial conditions they degrade by roughly five times — with the more telling result being that a third of state-changing actions are outside the classifier’s evaluation scope to begin with; the PocketOS incident is a separate harness-level failure on a different vendor’s stack (Cursor, Opus 4.6) that nonetheless lands on the same operational nerve; and the Five Eyes guidance is the regulator-side answer to “should you adopt this faster than you can audit it.”

There’s a pattern across all six Must Read items worth naming. The AISI capability-symmetry finding needs multi-vendor threat-model discipline because the cyber-capability ceiling is set at the frontier, not at any one vendor’s release page. The post-Mythos vulnerability-discovery surge needs new triage discipline because the bug-hunting throughput now exceeds patch-deployment throughput. The Auto Mode permission classifier needs configuration and scope discipline because its under-pressure FNR is roughly five times the production figure and a substantial fraction of destructive operations (file-edit-based actions) falls outside its evaluation surface entirely, with both failure modes producing irreversible outcomes when they hit. The Skills marketplace needs supply-chain discipline because intent-misalignment isn’t caught by code review. Hybrid metered pricing on Copilot’s agentic surface needs cost discipline because per-invocation cost on autonomous coding work is now visible and load-bearing. SPDD adoption needs methodological discipline because individual-developer SDD doesn’t survive contact with multi-engineer teams. Discipline is the load-bearing word in every one of these — and “discipline” in production engineering means tooling, process, and failure-mode literacy, not exhortation.

That’s the practitioner shift. The 2024–2025 ecosystem question was “what can these tools do?” The 2026 question is “what operational discipline does using them at scale require?” The vendors that ship answers to that question — instrumentation, audit hooks, scoped permissions, marketplace governance, cost observability, structured methodology — are the ones whose products will accumulate the working long-running production deployments. Everyone else will be selling demos.

The Artificer’s Grimoire — weekly intelligence on harness engineering and autonomous agents — for practitioners, by Tim Schiller (Artificer Digital).