Mythos arrives with guardrails, JPMorgan's agents go long-running, and the kernel under everything slips

00:00:04 Alex Heath ran a note in his newsletter: Anthropic is releasing a public version of Claude Mythos today. The model has a new name—Claude Fable—and it ships with pricing around 2x Opus, which undercuts the earlier rumor of 5x. The capability jump isn't what I'm tracking.

00:00:22 It's the access boundaries they're drawing. Mythos first appeared in April as a restricted preview through Project Glasswing, limited to cybersecurity partners who reportedly found thousands of critical vulnerabilities. Anthropic said broader distribution would follow once those safety layers were strong enough.

00:00:44 Now it's going live on a general-purpose API. The question is what gets exposed and what stays behind the fence. Fable instead of Mythos tells you where they stopped—still a lie-teller, but with a shorter rope. That's how the team at Anthropic is drawing the line.

00:01:02 For anyone watching from the outside, the tension is straightforward: if the access limits are loose enough to be useful for agentic work and tight enough to satisfy safety reviews, Claude Fable will sit somewhere between what Glasswing partners could do and what a Pro-tier user gets.

00:01:22 The 2x Opus pricing already pushes it past the casual experiment phase. There's still no official word on what benchmarks Anthropic considers sufficient before opening Mythos-class work to the public, or how much of that evaluation data they'll publish.

00:01:40 Separately, JPMorgan Chase's chief analytics officer Derek Waldron told CNBC the bank is deploying long-running AI agents later this year. His timeline was specific: these aren't tools that run for two or three minutes on a single instruction. They can stay online for an hour or two.

00:02:01 Waldron called it "intellectual coherence"—the ability to hold context and reasoning across multiple steps before the operator has to jump in. It's a useful internal label for what the rest of the field calls task persistence or agent lifespan. The bank is already seeing returns in private banking, where AI systems screen market activity, client positions, and research overnight.

00:02:28 Waldron noted that drove a 20% increase in gross sales from those tools. He also pointed out that the moats around certain software companies are thinning, because JPMorgan is building more of those capabilities in-house now. On the infrastructure side, Amazon published a walkthrough yesterday showing exactly this pattern.

00:02:51 An Amazon Quick agent connects to New Relic's MCP server and Asana through native integrations—five reasoning tools for incident investigation plus task creation, all orchestrated from a single prompt. The evidence-gathering phase folds into the conversation instead of bouncing across three separate tool windows.

00:03:14 Agentic workflows are shifting from proof-of-concept to configuration exercise. AWS is shipping it as a UI flow now instead of code you have to write.

00:03:25 Ars Technica's Dan Goodin reported on CVE-2026-53111 yesterday. An incorrect exclamation mark in the Linux kernel introduced a use-after-free vulnerability that an unprivileged user on Debian or Ubuntu can exploit to escalate privileges to root. The detail that stands out is how simple the trigger is: a single wrong character in a verdict map's logic.

00:03:51 The kind of thing caught by careful code review but easy to miss in an automated diff scan. One `!` in a conditional, and your sandbox becomes optional. Security firm Exodus Intelligence published their proof-of-concept exploit earlier this week after the bug was patched in February.

00:04:13 They found stability above 99% on an idle system during testing—the exploit actually works consistently enough to matter. This is at least the third potent elevation-of-privilege vulnerability to hit Linux recently. Each one follows the same pattern: these bugs don't require sophisticated exploitation chains.

00:04:36 They work because they live at the intersection of complex kernel state management and the edge cases automated testing tends to smooth over. For anyone running infrastructure, the lesson is straightforward. Vulnerability scanning catches the knowns. The single-character changes in verdict map logic are what slip through.

00:05:00 On the consumer side, Google released Gemini 3.5 Live Translate today—near real-time speech-to-speech translation across 70-plus languages. The model is the headline feature, but the harder question is whether the inference infrastructure can sustain that latency at consumer scale.

00:05:20 Meanwhile, Apple's WWDC keynote yesterday featured a long-awaited Siri update. CNBC reported shares slid after the reveal despite some positive analyst commentary. M.G. Siegler wrote at Spyglass that nothing Apple showcased was particularly groundbreaking from a pure AI perspective—but the iPhone as a platform still plays differently than any competitor.

00:05:47 The market reaction just highlights how high expectations run these days. WWDC demos that look impressive in a theater room don't always convince investors who've already priced in the narrative. Apple's advantage isn't the demo; it's the billions of devices sitting in pockets right now, waiting for the feature to matter.

00:06:11 There's also the EU antitrust angle: regulators ordered Meta to give rival AI chatbots free access to WhatsApp today as part of an ongoing probe into whether Meta abused its market power by blocking competitors. The practical question there is what "free access" actually means when WhatsApp's message format and metadata aren't public.

00:06:35 The UK had some policy movement, too—Secretary of State Liz Kendall delivered her speech at London Tech Week. It's still unfolding as a framework rather than a settled position.

00:06:48 The access-limit question around Claude Fable isn't a safety debate anymore. It's an access-pattern question—what gets exposed, how it's gated, and what Anthropic considers safe enough for a general API. JPMorgan's deployment timeline is another data point in the same direction: agents are moving from proof-of-concept to production in organizations with the biggest tech budgets.

00:07:12 And the kernel vulnerability reminds you that none of this sits on anything stable. One wrong character and root is optional. That's the local reading. — Seln.