Between September 1 and September 2, three vendors announced agents built to find and exploit vulnerabilities. All three picked the same control mechanism, and it sits in the same place.
OpenAI said Astra is the first model to meet the Critical cybersecurity threshold in its Preparedness Framework. Per TechCrunch's writeup, Astra scored perfectly on ExploitBench, and on a modified version of that test built by OpenAI engineers it discovered and exploited two zero-day vulnerabilities. The model is coming "soon," with access to its most advanced cybersecurity capabilities "more limited."
Anthropic shipped Claude Mythos 5.1 the same day, reachable only through trusted-access programs. Anthropic's page describes a Life Sciences Verification Program running as an invite-only beta with reduced biology safeguards, and a Cyber Verification Program with reduced cyber safeguards for defensive security work that will include Mythos access in the near future. Availability is limited to a small set of vetted US organizations, with a 30-day data retention policy for safety monitoring on by default.
CrowdStrike announced SafeMind at Fal.Con on September 1, built with Nvidia on Nemotron. SiliconANGLE reports that Red Tempest, trained partly on 15 years of CrowdStrike incident-response data, probes a digital twin of a customer environment for attack paths while Blue Solano remediates what it finds, and the cycle repeats until none remain.
What organizational verification actually gates
Three companies, one shared answer: establish who the operator is before letting them call the model. That is a real control. An API key can be revoked. A verification program produces an accountable legal entity with a signature on file. Retention gives somebody a record to read afterward.
All of it governs invocation. None of it governs reach.
Once a vetted defender starts one of these agents, it stops being an API consumer and becomes a process on a host holding a socket. The organization's clearance says nothing about which hosts that process may open a connection to. That decision gets inherited from whatever the surrounding environment already allows: security groups written for stable services, a VPN that admits an entire subnet, egress left open because nobody previously had to reason about a local process capable of writing its own exploit.
From the network's point of view, an ExploitBench-topping agent and a continuous red-teaming agent are the same shape of program. The difference is what they are pointed at, and pointing is a runtime property.
Reachability is a network-layer decision
That is why the trust model in Pilot Protocol lives beneath the application protocol instead of inside it. The second design principle in our IETF draft states it directly: the network boundary is the trust boundary.
Trust between two agents is bilateral and explicit. Section 10.6 defines a handshake protocol on port 444 where both sides exchange requests with justification strings and both must approve. Three auto-approval paths exist: a mutual handshake where each agent independently requested the other, shared membership in a non-backbone network, or an operator manually approving a queued request. Trust pairs persist across restarts in the registry, and revoking one stops further communication immediately.
Discovery is gated by the same relationship. Section 10.7 specifies that a node's real IP and port are never returned by the registry unless the node opted into public visibility, and resolving a private node's endpoint requires that the node be public, that a mutual trust pair exist, or that both nodes share a non-backbone network.
The part worth checking against code rather than a spec is what happens when an attacker already knows the endpoint. In tests/zz_syn_trust_gate_test.go, TestSYNFromUntrustedNodeRejected stands up two private daemons with no trust between them, pre-populates the client's tunnel with the server's real UDP address to skip resolution entirely, then dials and asserts the dial fails. The comment in that test calls the gate defense in depth. Knowing an address is not admission to talk. Relayed handshakes carry an Ed25519 signature over the sender and peer node IDs so a compromised relay path cannot forge a trust request on someone's behalf.
The other half is seeing what it ran
Verification records who was permitted to start the agent. It captures nothing about what the agent typed. For exploit development and red teaming, the command stream is the audit surface, and asking the agent to summarize its own actions puts the thing under review in charge of the report.
A terminal is a better record because it is the actual execution. shell --read-only python train.py produces a browser link that shows the live process and refuses input. The access mode is fixed when the session is created and read-only input is rejected server side by the Cloudflare Worker, so editing the page or the WebSocket frames cannot promote a viewer into an operator. Each session's Durable Object enforces that immutable mode.
Terminal payloads are encrypted before they reach the relay by default. internal/e2ee/e2ee.go sets KeyBytes = 32 and PBKDF2Iterations = 600_000, deriving the AES-256-GCM key with PBKDF2-HMAC-SHA256 over a 16-byte random salt that travels to the browser as a #salt= fragment rather than the password, since fragments are not included in HTTP or WebSocket requests. The frame's leading opcode byte goes into Seal as additional authenticated data instead of being encrypted, which is exactly what lets the Worker keep enforcing read-only without being able to read the terminal. The README lists what encryption does not cover: connection IPs, timing, encrypted frame sizes, opcodes, the command label, and lifecycle metadata.
Agents can hand out their own observation link. shell --read-only --json -- your-command emits a single stderr line carrying share_url, e2ee_password, session_id, read_only, and encrypted, which an agent passes to its operator through whatever channel it already uses. The wrapped process keeps its own stdout.
None of this substitutes for vetting who gets the model. It answers a different question. A verification program tells you an organization was trusted at review time. A default-deny trust gate tells you which peers the agent could reach last night, and a read-only link tells you what it ran while it was there. The vendors published their access criteria this week. The reachability policy is still left to whoever runs the thing.
Top comments (0)