This week, model policy and systems architecture converged on the same question: where can an AI act, and who can reconstruct what happened? Cyber and biology releases used identity-gated access; agent platforms moved credentials and state outside generated-code sandboxes; benchmark audits showed why the evaluator itself belongs outside the agent's reach.
1. Capability gates now differ by domain, not model family
Anthropic placed Mythos behind Project Glasswing, OpenAI routed GPT-5.4-Cyber through Trusted Access, and GPT-Rosalind entered a qualified life-sciences preview. The common unit is no longer a public model endpoint; it is an approved person, organization, and use case.
The programs protect different bottlenecks. Cyber access tries to give patching a lead over exploitation, while biology access limits who can combine specialized reasoning with sensitive tools and data. Their credibility can be compared through enrollment scope, revocation mechanics, retained telemetry, and published incidents, not a generic claim of responsible release.
Sources: Anthropic's Project Glasswing · OpenAI on Trusted Access · Reuters on proposed US agency access to Mythos
2. Durable state and credential custody define the agent control plane
Anthropic's Managed Agents keeps sessions outside replaceable harnesses and sandboxes. Cloudflare's MCP architecture keeps credentials and tool policy at a shared portal. Both designs prevent generated code from becoming the durable owner of state or secrets.
Their tradeoffs differ. Anthropic optimizes recovery across long-running execution; Cloudflare optimizes identity and tool exposure across many servers. Combining the patterns creates a clearer boundary: an agent can lose its sandbox without losing its audit history, and it can invoke a tool without receiving the credential behind it.
Sources: Anthropic on managed agents · Cloudflare's enterprise MCP architecture
3. Agent benchmarks fail when the grader shares the blast radius
Berkeley researchers showed that AI agent benchmarks can yield near-perfect scores after generated code tampers with tests, binaries, or answer files. GraphicDesignBench attacked a different failure by splitting polished output into layout, typography, vectors, semantics, and animation.
Together they define two forms of evaluator isolation. Infrastructure isolation keeps the agent away from the grader; metric isolation prevents visual appeal from swallowing structural defects. A premium leaderboard has to preserve both, because a secure grader can faithfully score the wrong property.
Sources: Berkeley RDI's benchmark exploit report · GraphicDesignBench preprint, version 2