Until this week, the worry about a coding agent was that somebody would trick yours into running an exploit. Now Anthropic and a row of red-team vendors are handing defenders agents that write exploits on request, for good reasons. Ask the second question about those: whose machine do they run on?

On Friday, Anthropic widened access to its most capable model for security work. Claude Mythos 5 had been fenced inside Project Glasswing, a small set of organizations defending critical software. It now runs in Claude Security for Enterprise customers, it is going into partners' defensive products, and the Cyber Verification Program, which gives vetted defenders reduced safeguards, is widening too. Anthropic also put $35 million in credits behind open-source security work through a new Defender Advantage Fund.

On Saturday, The Register covered the demand side of the same trade. Rob Joyce, formerly of the NSA, at RSAC: "You are going to be red-teamed whether you pay for it or not. The only difference is, you know who gets the results." Evan Peña, who ran Mandiant's global red team and now co-founds Armadin: "We have found over 50 zero-days… that allow an attacker to get remote code execution on an actual system." Agents, he added, "don't sleep and they don't take holidays."

Both stories settle who may ask for offensive capability. Neither settles where the code that comes back runs, and it runs somewhere.

Anthropic drew the safeguard around the model

The post spells the design out, and it is a good design. The risk Anthropic manages is direct model access: "The riskiest behavior occurs when a user has direct access to a model, where a malicious actor can try to steer it toward harmful uses. But if users can only receive specific outputs, such as a patch for a vulnerability or a security alert, that risk is much lower."

So a partner product runs Mythos in the background for one defined task and hands back one artifact. A remediation tool returns suggested patches. The person holding the tool cannot turn around and ask for a working exploit, because they never talk to the model. Claude Security works the same way: it scans a repository you own and returns each finding with a CWE category, a confidence and severity rating, and a suggested fix. A human reviews and approves every patch.

One sentence in the announcement moves the story onto a laptop. Once you have the finding, you "open Claude Code on the web to implement the fix."

That is the right product call. Scanning and patching are different jobs, and the patching job wants an ordinary agent in an ordinary repository. It is also where a model-access boundary runs out of reach. The Cyber Verification Program arrives at the same place from the other direction: its stated purpose is "minimizing interruptions for accepted teams doing legitimate cybersecurity work on systems they're authorized to protect." Reduced safeguards, on purpose, for people whose agents need to write offensive code. Every month more laptops run an agent that will write and execute a proof of concept when asked, which is the whole point of giving them to defenders.

Access control answers who may ask. It does not answer what the answer may touch.

Two different boundaries. Gating direct model access decides who can ask for offensive capability, and Anthropic's staged rollout does that well. It ends where the artifact changes hands. The machine that turns a finding into a running patch or a reproduction has its own boundary, or it has none.

Twenty-six thousand agents, three days

The Register's numbers come from an engagement Armadin ran with TENEX.ai, described in a joint release earlier this month. Three days, one unnamed global institution, zero-knowledge conditions: no privileged credentials, no whitelisting, no source access. The swarm indexed its reconnaissance into a knowledge graph, then launched 26,000 agents and 1,300 attacks against more than 25,000 services, generating 17 million offensive actions. It came back with 238 findings, 98 of them significant, and 38 validated attack paths.

The defensive half produced the harder number. TENEX.ai triaged 101,169 alerts and reconstructed the whole thing across 231 billion raw events, in which attacker activity was one event in 13,338.

Matt Hartman, formerly CISA's acting cyber head and now at Merlin Group, told The Register that organizations "are going to need to treat every agent as a privileged identity." Jay Bavisi of EC-Council supplied the other half. "Nobody pen tests the entire organization," he said, while attackers "don't have a scope problem."

Your own agent has no scope problem either, unless you give it one.

Four untrusted things in an ordinary security session

Set the swarm aside and watch one engineer do find-and-fix work on a Tuesday. Claude Security flags something. You open an agent to write the patch, and to know the patch works you let it reproduce the bug. That session holds four things the machine has no reason to trust, and they are the same four whether the finding came from a swarm or from a scanner.

The target's own content

Source files, a README, HTTP responses, error strings, a checked-in AGENTS.md. All of it enters the agent's context as text, and whoever you are testing wrote some of it.

The tooling

Scanners, fuzzing helpers, protocol libraries. They arrive as npm, PyPI, Cargo and Go fetches, resolved on demand, often from packages nobody on the team has read.

The scope

An engagement scope is a sentence in a document. Nothing on the laptop knows which hosts are in it, and a reconnaissance step that wanders looks like one that stays put.

The credentials in reach

An SSH key, a kubeconfig, cloud keys, container registry logins. None of them belong to the task. All of them are one cat away from whatever is running.

Nobody made a mistake to arrive at that list. It describes the standing conditions of doing security work on a general-purpose computer.

Bromure gives each of them a control

Bromure Agentic Coding runs the agent in a disposable Ubuntu VM on Apple's Virtualization framework, with its own kernel, only the Mac folders you picked mounted into it, and a host-side MITM proxy as its single route out. That is the boundary missing from the right half of the diagram.

Something reads the target's content before the model does. The Prompt Injection pane scores the file contents, web pages and tool output the agent pulls in, its tool_result blocks, with a local PromptGuard model. It scores the instruction files agents treat as authority (CLAUDE.md, AGENTS.md, GROK.md, and their nested and global variants) with a fine-tuned ModernBERT classifier, alongside a deterministic scanner for the invisible-Unicode obfuscation the model cannot read. Both run on your Mac and send nothing anywhere. You choose what a detection does: log it, ask you, or fail the request with a 451 before the model sees the text.

Bromure checks the tooling at the registry. Every package fetch passes through the host proxy first: npm, PyPI, Cargo, RubyGems, Maven, NuGet, Go, Packagist. An age gate is on by default at two days, so a scanner published this morning does not install. Floating version ranges resolve to the newest release older than the cutoff, and a pinned reference to something too fresh comes back as a 451 with a Bromure error on it. OSV lookups block known-vulnerable versions at whatever severity you pick. Bromure strips install scripts out of npm tarballs on the fly, rewriting the tarball and the registry metadata hash so npm's own verification still passes. The .npmrc inside the VM can tighten all of this and cannot loosen it.

Scope stops being a document. Under Guardrails, the Outbound connections table is a per-profile firewall: one row per rule, each carrying an action, a protocol (tcp, udp, web or any), a host or CIDR, ports, and for web a list of HTTP methods. Rules match top to bottom, first match wins, and Unmatched traffic is a two-way switch. Set it to Deny, add the engagement's hosts, and Bavisi's scope problem turns into a packet filter. Transparent interception is on by default, so a guest that unsets HTTPS_PROXY changes nothing about which connections leave. Every allow and every deny lands in the Security Log.

The credentials in reach are not the credentials. Real values never enter the VM. The proxy swaps a stub for the real token on the wire, the kubeconfig in the guest is synthetic with throwaway client certs, and AWS gets a credential_process helper that hands the SDK a forty-character fake secret while the host re-signs SigV4 with the real material. Anything routing around the proxy gets InvalidSignatureException back from Amazon. Each credential also carries a write policy of Off, Block destructive, or Read-only, enforced in the host proxy where a compromised agent cannot argue with it: a validation run that has no business deleting an S3 bucket takes a hard 403 when it tries. Require approval to use turns a credential into a consent prompt with a time-bounded grant of five minutes, an hour, or the rest of the session. That fits an SSH key during a red-team run, where you want the signature to happen and you want to know it happened.

The same find-and-fix session, run twice. On a laptop, four untrusted inputs meet a machine full of live credentials. In a Bromure workspace each one meets a control on the Mac side of the boundary, where guest code cannot reach it.

The log you were going to have to write anyway

Red-team work produces paperwork. What you touched, when, under which identity, and what came back. Bromure writes most of it as a side effect. The Security Timeline window holds one chronological table of every credential swap and signature, every package verdict, every firewall allow and deny, and every injection detection, kept on the Mac where nothing in the VM can edit it. Turn the session trace up and the proxy keeps the bodies too, AES-GCM encrypted with the same keychain key as your profile secrets.

Between engagements the storage layers come apart. Erase home… resets the profile's /home/ubuntu to its post-clone state and takes the clones, the payloads, the shell history and the scanner caches with it. Reset to base… discards everything you installed with sudo apt install and re-clones the workspace system disk. One target's leftovers do not follow you to the next.

Give the capability somewhere to land

Anthropic's staged rollout is the responsible version of a hard call. Handing a defender the artifact instead of the model is the shape that gets frontier capability to the people patching hospitals and utilities without also getting it to everyone else, and the human-approval step on patches is not decoration. Armadin and TENEX.ai ran their engagement through a control layer with a supervising safety model and a real SOC watching from the other side. Everyone in this week's news behaved well.

What none of it covers is the laptop. All that care ends the moment a finding becomes a file, and the file lands on a general-purpose machine that has been collecting credentials since the day IT issued it. Joyce is right that you will be red-teamed either way. You do not get to pick whether the offensive agent exists. You pick which machine it wakes up on, and you can pick one you throw away afterwards.

Sources: Anthropic, "Bringing the cybersecurity capabilities of Claude Mythos 5 to more defenders" (Aug 21, 2026) · The Register, "If you're not using AI to attack your own systems, your adversaries will" (Aug 22, 2026) · Armadin and TENEX.ai, "Largest Controlled Live AI Cyberattack on Record" (Aug 3, 2026) · SecurityWeek, "Kevin Mandia's Armadin Launches With $189.9 Million in Funding"