Restricted model access failed at a vendor boundary just as Mozilla disclosed a large defensive Mythos run. The pairing makes the tradeoff concrete: more capable scanning expands both credential value and the validation queue. Politics, image generation, and data-connected research agents widened the same question from cyber access to government procurement and enterprise data paths.
1. Mythos access leaks through a vendor as Firefox findings pile up
Members of a private forum reportedly accessed Anthropic's restricted Mythos model through a third-party vendor environment. Anthropic said its own systems appeared unaffected. In separate security research, Mozilla said Mythos identified 271 Firefox 150 vulnerabilities before release.
The two disclosures expose opposite ends of the same pipeline. Third-party credentials can bypass a provider's front door, while hundreds of candidate bugs can overwhelm human triage. Ars supplied no severity breakdown for the 271, so the count tracks review volume, not 271 exploitable zero-days.
Sources: TechCrunch on the reported access · Bloomberg's original report · Ars Technica on Mozilla's findings
2. Trump reopens the door to a Pentagon-Anthropic deal
President Trump said Anthropic was "shaping up" after White House talks and that a Pentagon deal was possible. The department had designated Anthropic a supply-chain risk after a dispute over limits on domestic surveillance and autonomous weapons.
The remark changes negotiating leverage without changing the formal status. A renewed contract could restore access to classified demand while testing whether Anthropic's deployment restrictions survive procurement pressure. Litigation and the supply-chain designation remained live at publication.
Sources: Reuters on Trump, Anthropic, and the Pentagon
3. GPT Image 2 brings editing and batch generation to the API
OpenAI introduced ChatGPT Images 2.0 and released GPT Image 2 through its API. The model supports generation and editing, flexible dimensions, high-fidelity input images, token-based pricing, and asynchronous jobs through the Batch API.
Batch support shifts the product from interactive creation toward production pipelines. That raises the cost of a systematic defect: an identity drift or failed edit can propagate across a large job before review. The launch materials show selected outputs, so batch acceptance rates are the missing operational metric.
Sources: OpenAI on ChatGPT Images 2.0 · OpenAI API changelog
4. Deep Research Max joins web and private MCP data
Google released Deep Research and Deep Research Max in paid Gemini API preview. Both can combine web search, uploaded files, connected stores, and arbitrary remote MCP tools; Max spends additional test-time compute on asynchronous reports.
The consequential change is source mixing. A single report can now blend public claims with proprietary records and render charts that conceal which source supports each point. Page-level citations and a saved research plan become part of the artifact, especially when a remote MCP result can change after the run.