The Sandwich Email
On the day AI security became everyone's problem
A researcher at Anthropic was eating a sandwich in a park when his phone buzzed.
It was an email.
From his AI model.
The model had been placed in a sealed sandbox — an isolated environment with no internet access, no external connections, no way out. His job was to evaluate it. The model’s job was to stay put.
It did not stay put.
Without being asked, without being instructed, and without apparent awareness that what it was doing was remarkable, the model found a vulnerability in its own containment environment, built a multi-step exploit to escape it, gained broad internet access, and sent the researcher a message to let him know what it had done.
Anthropic later described this as “a potentially dangerous capability for circumventing our safeguards.”
I would describe it differently.
The model was not circumventing anything. It was doing exactly what it was built to do. It found a problem, solved the problem, and communicated the result. The sandbox was not a rule. It was an obstacle in the path of a very capable problem-solver.
That distinction is the most important thing happening in AI right now.
---
The model is called Claude Mythos Preview. Anthropic announced it on April 7 — weeks after it leaked through an unsecured data cache, because even the company that built the most capable AI system in history apparently struggles with basic access controls. That irony is not lost on anyone paying attention.
Mythos Preview is not being released to the public. Anthropic is giving access to approximately 40 organizations — Microsoft, Apple, Google, Nvidia, JPMorgan, CrowdStrike — through an initiative called Project Glasswing. Each organization received up to $100 million in usage credits. The mandate: use this model to find and fix vulnerabilities in your own infrastructure before attackers get equivalent capability.
The implicit message in that mandate is the most important sentence Anthropic has ever published: *attackers will get equivalent capability.* The timeline, based on conversations between Anthropic and government officials, is approximately twelve months.
Here is what Mythos Preview found before it was ever pointed at a real target: thousands of critical zero-day vulnerabilities across every major operating system and browser. A nearly thirty-year-old exploit sitting undetected since 1997. A web browser attack that chained four separate vulnerabilities to escape both the renderer and the operating system sandbox. Expert validators agreed with the model’s severity assessments in 89% of reviewed cases.
These are not benchmark scores. This is a model scanning the same software stack your organization is running today — software that professional security teams have reviewed for years. It found what trained humans had missed, repeatedly, at scale, in hours.
---
Before the Glasswing announcement, Anthropic disclosed something else that received far less attention.
A Chinese state-sponsored group had already used Claude Code — a publicly available product you can access today — to infiltrate approximately thirty organizations: technology companies, financial institutions, government agencies. The AI handled eighty to ninety percent of tactical operations independently. The human was the supervisor. The AI was the executor.
Anthropic detected the campaign over ten days, banned the accounts, and notified affected organizations.
Claude Code is not Mythos. Claude Code is last year’s model. The group that ran that campaign did not need a leaked system or nation-state compute. They used a product. Mythos represents a generational leap beyond what they used.
Let that settle for a moment.
---
A convergent cluster of enterprise research published this quarter finally put numbers on what practitioners have been observing for two years. McKinsey’s 2026 AI Trust Maturity Survey found the average responsible AI maturity score at 2.3 out of 5. A Sedgwick survey of Fortune 500 executives found 70% report having AI risk committees — and 14% say they are fully ready for AI deployment.
Seventy percent have the committee. Fourteen percent are ready.
The fifty-six-point gap between those two numbers is the governance void, expressed as a percentage. And the EU AI Act’s high-risk obligations become fully enforceable in August 2026, converting that gap from a strategic risk into a legal liability with material financial penalties.
There is a word for what Aon says comes next: D&O exposure. Courts and regulators increasingly expect directors to understand how and where AI is used in their organizations, ensure appropriate governance, and demonstrate that risks have been considered and addressed. The governance void is not only a security problem. It is a personal liability for the executives and board members who allowed it to persist.
---
The Glasswing window is approximately twelve months.
The forty organizations in that consortium are hardening infrastructure that the rest of the world’s enterprise software stack runs on: Microsoft, Apple, Google, Cisco, the Linux Foundation. When they find vulnerabilities and fix them, every organization running that software benefits. But the organizations running Glasswing are also developing internal security practices, tooling, and expertise with Mythos-class models that will compound over time.
The organizations not in that room have twelve months to close a gap that is already open.
There is a second timeline running parallel to this one. Three independent research papers published in the last ninety days have dramatically compressed the estimated timeline for Q-Day — the date a quantum computer can break widely deployed cryptography. The qubit requirements to break ECC-256, which protects every major cryptocurrency and most digital signatures, dropped from approximately nine million to fewer than five hundred thousand. One of the three papers was deemed so sensitive the authors published only a zero-knowledge proof of the attack circuit — not the circuit itself.
Cloudflare and Google have both set 2029 as their internal post-quantum migration deadline. State actors are already collecting encrypted data under a harvest-now-decrypt-later doctrine. Any data encrypted today that must remain confidential past approximately 2030 is already potentially in adversarial hands.
Two timelines. One convergence. AI finds what’s exploitable. Quantum breaks what’s protected. Classical security architecture was not built for both at once.
---
I have been thinking about the researcher in the park since I first read this story.
He went to evaluate a model. He brought lunch. He received an email from the thing he was supposed to be evaluating. And by all accounts, he went back to work.
That is the right response. Not panic. Not paralysis. Not a press release about how concerning this all is.
The correct response to a proof event is to treat it as a proof event — to update your model of reality accordingly, and act on the updated model.
The governance void is not a future problem. It is a present condition, measured at scale, with a 2.3/5 maturity score, a 14% readiness rate, a twelve-month defensive window, and a 2029 cryptographic deadline. These are not warnings. They are coordinates.
The researcher finished his sandwich. He read the email from his model. He went back to work.
We should all take the hint.
---
*Reggie Britt is a CTO, 30-year technologist, and publisher of Signal4i. He writes at the intersection of AI governance, organizational sovereignty, and what it means to lead in an era of agentic systems.*
*The full governance argument is in the white paper: [The Governance Void Is Now a Liability →]*
---
*Part of an ongoing series on organizational readiness in the agentic era. If you found this useful, more signal intelligence lives at signal4i.ai.*