The release-with-guardrails debate just ended, and almost nobody noticed

For two years, the dominant frame in frontier-lab safety policy has been "release with guardrails, or do not release at all." Anthropic invoked the second half of that frame when it kept Claude Mythos out of general public release and limited access through Project Glasswing, citing offensive cyber capability that the UK AI Security Institute had previously documented at expert-tier levels.

Last week the UK AISI ran the same evaluation on GPT-5.5 Instant, the model OpenAI just made the default in ChatGPT for hundreds of millions of users. The results are comparable. The "do not release at all" half of the frame did not survive that test.

What AISI actually measured

AISI's evaluation of GPT-5.5 Instant used the same 95-task offensive cyber gauntlet they ran on Claude Mythos Preview earlier this spring. Four difficulty tiers. Same scoring. Same scaffolding.

The headline numbers are close. On the Expert tier, GPT-5.5 Instant solved 71.4% of tasks (with an 8.0% standard error). Mythos Preview solved 68.6% (8.7% standard error). On the 32-step Top-Level Objective task, Mythos solved 3 of 10 attempts. GPT-5.5 solved 2 of 10. Both failed the Cooling Tower scenario. AISI's framing is that the two models are at a comparable capability level for offensive cyber.

This is not "GPT-5.5 matches Mythos at every level," which is how some early coverage framed it. It is something more uncomfortable for the policy frame: a model already in millions of consumer sessions is, by the same evaluator using the same eval, in the same capability neighborhood as the model the field's most safety-focused lab decided not to release. Saying "we do not release at this capability level" only works if your peers also do not.

Why this breaks the policy lever

The "do not release" position is not a position about a model. It is a position about a state of the world. The argument is roughly: capability X is dangerous enough that adding any new instance of it to the world increases marginal harm beyond the marginal upside of the release.

That argument depends on the assumption that withholding actually keeps capability X scarce. Once another lab ships a public model at the same capability level, the math reverses. The marginal harm of one more public model in that capability class is approximately zero, because the capability is already in circulation. The opportunity cost of withholding is the lab's product, its revenue, its researchers leaving for the lab that did ship.

This is the structural problem with unilateral safety policy in a multi-lab field. It only works if everyone holds the line. The minute one lab releases at a given capability level, the others are choosing between matching that release and accepting a competitive position they cannot recover from.

I am not saying that is a good outcome. I am saying it is the actual outcome, and the policy frame most labs have been signaling with for two years did not budget for this case.

The Pentagon angle, which most takes are missing

There is a second story running parallel to this one that makes the contradiction sharper. CNN reported on May 1 that the Pentagon awarded its big AI contracts to eight Big Tech vendors (SpaceX, OpenAI, Google, Microsoft, Nvidia, AWS, Oracle, and Reflection) and explicitly excluded Anthropic. The reported reason was Anthropic's published usage policy, which restricts certain defense applications.

Anthropic is now in a position where its published values are costing it real revenue (a Pentagon contract) and its conservative release stance is being contradicted in practice by a peer lab shipping at the same capability level. This is the cleanest case study of values-driven AI strategy I have seen in production. Whether it is sustainable is a different question.

The labs that walked out of the room with the Pentagon contracts did not have to take a position. The lab that kept its position is paying for it twice: once in the contract it walked away from, and once in the public release it did not make.

What does this mean for builders shipping agents in production?

If you are building an agent that browses the web, calls APIs, or executes anything other than read-only operations, the prompt-injection risk just got more concrete. A model in the GPT-5.5 / Mythos capability neighborhood, in the wrong hands, in the wrong prompt, can do a lot of work toward a hostile objective without anyone in the loop.

This was already the case in theory. The AISI numbers move it from theoretical to operational. If your agent has tools, it has an attack surface. If your agent reads untrusted input (a webpage, an email, a document) and acts on that input with tools, the input is part of your prompt whether you want it to be or not. The mitigations (sandboxing, constrained tool use, human-in-the-loop on irreversible actions, robust authentication on the action side) are the same ones we have been writing about for two years. The pressure to actually deploy them just went up.

The builders who get this right are the ones who treat the agent's tool use the same way they would treat any other privileged production system: minimum permissions, audit logs, blast-radius containment, kill switches that work. The builders who treat agent safety as a prompt-engineering problem will learn the hard way.

How long does the new policy frame take to set in?

Here is the bet, dated. By the end of 2026, at least one of these will happen:

Anthropic releases Mythos publicly, or releases its successor at the same capability level under a substantively unchanged release framework.
OpenAI publishes a release framework that includes an offensive cyber capability threshold above which it will not ship publicly.
Both, together, as part of a coordinated industry framework.

If none of these happen by December 31, 2026, my read of the policy lever is wrong. The realistic scenario is option 1, because the structural pressure from the Mythos / GPT-5.5 parity case is one-way: it gets harder to justify withholding a model that is already in circulation, and the cost of withholding compounds the longer it goes.

The "release with guardrails" debate is not over because somebody won the argument. It is over because reality settled it. The labs that figure out the next frame first will set the terms of the next argument. The ones still operating on the old frame will find themselves in the position Anthropic is in this week: principled, expensive, and increasingly alone.