On June 26, two frontier AI models were released under government clearance — both explicitly designed for cybersecurity. The infrastructure they'll be pointed at ships 97 million downloads a month and has an 82% vulnerability rate on basic checks.
Two things happened within hours of each other.
OpenAI previewed GPT-5.6 Sol, which scores 96.7% on their internal capture-the-flag evaluation. The US government restricted its release to roughly 20 organizations pending review. Same day, the US cleared Anthropic to release Mythos to about 100 "trusted partners" — a model that, during NSA testing, reportedly broke into almost all classified systems within hours.
Both models are explicitly marketed for cybersecurity. Both require government clearance before deployment. Frontier AI models are now treated like export-controlled weapons technology.
| Model | CTF Score | Cost (1M tokens) | Access |
|---|---|---|---|
| GPT-5.6 Sol | 96.7% | $5 / $30 | ~20 orgs |
| GPT-5.6 Terra | 91.8% | $2.50 / $15 | ~20 orgs |
| GPT-5.6 Luna | 85.2% | $1 / $6 | ~20 orgs |
| Anthropic Mythos | — | — | ~100 partners |
Three things from the GPT-5.6 system card matter for defenders:
Long-horizon agentic attacks. Sol's "ultra" mode deploys sub-agents autonomously. A vulnerability researcher using Sol doesn't manually chain exploitation steps — the model orchestrates multi-step attacks across tools and environments.
Vulnerability discovery at scale. Sol and Terra find vulnerabilities and pieces of exploits. OpenAI's evaluation: better at offense than defense — better at finding and exploiting than fixing.
Cost-accessible exploitation. Luna scores 85.2% on the same CTF at $1 per million input tokens. Automated vulnerability scanning against agent infrastructure just became economically trivial. All three models will be generally available "in coming weeks."
This is the other half of the equation.
MCP — the protocol connecting AI agents to tools, databases, and infrastructure — ships 97 million downloads per month. The security posture of the average deployment would not survive five minutes against the models announced this week.
A recent experiment showed this cleanly: 2,000+ hackers sent 6,000+ emails trying to extract credentials from a Claude Opus 4.6 assistant. Zero breaches. A simple anti-injection system prompt held.
The researcher's conclusion: "Capable models don't excuse granting agents unnecessary permissions."
Prompt-level security is largely solved for capable models. The attack surface has moved to what agents can access — trust boundaries, delegation scope, permission inheritance, tool misconfiguration. The OWASP Agentic Security Threats Top 10 maps this surface:
These are architecture findings. They don't appear in a pen test on your chat interface. They appear when a model scoring 96.7% on CTF evals points itself at your MCP server configuration.
OpenAI says Sol doesn't cross their "Cyber Critical" threshold — it can't carry out autonomous end-to-end attacks against hardened targets. But "hardened targets" is doing a lot of work in that sentence.
An MCP server with hardcoded API keys, path traversal vulnerabilities, and no audit logging is not a hardened target. It's an 82nd-percentile target.
The window between "generally available" and "actively exploited in the wild" is measured in days, not months.
1. Audit your MCP configurations. We built mcp-check for this — single file, zero dependencies, scans Claude Code, Cursor, Windsurf, and VS Code configs for hardcoded secrets, known CVEs, excessive filesystem scope, and supply chain risks. Scores A–F.
2. Map against OWASP AST Top 10. Not a prompt review — an architecture review. Which tools does each agent access? What permissions does it inherit? Can it spawn sub-agents? What's the blast radius of a compromised tool? We published our own self-assessment.
3. Add behavioral monitoring. Unit42 found 80% of 49,943 agent tools show at least one behavioral deviation from their declared purpose. Their analysis was explicitly static-only — "dynamic dispatch, reflection, obfuscated payloads escape AST extraction." Installation-time verification is necessary but not sufficient.
4. Treat MCP as critical infrastructure. 97 million monthly downloads. No standardized audit logging schema. No behavioral baselining tools with commercial support. The gap that matters is not better prompts.
Structured architecture review against the OWASP Agentic Top 10. Not a prompt review — a systematic assessment of what your agents can access, inherit, and spawn.
Get in touch