OpenAI’s Daybreak puts that question into practice. In Patch the Planet, OpenAI and Trail of Bits describe a workflow in which models help locate possible weaknesses, security engineers reproduce and validate them, and engineers work with maintainers on tested fixes. Maintainers decide which changes to accept and deploy. The model can speed up the investigation, while people still decide whether a report is real and whether a patch belongs in the project.
Those stages need different permissions. An agent searching a codebase may need repository access. One reproducing a suspected flaw may need to run tests in an isolated environment. A patching agent needs permission to change files. When one agent holds broad credentials for all three jobs, a mistake, a compromised account or hostile text inside a repository can reach far beyond the original task. A system built to find vulnerabilities could expose data, alter production code or test a system it was never authorized to touch.
The model cannot be trusted to enforce these boundaries on its own. A repository, log or issue description can contain instructions written to redirect an agent. The model may also misunderstand what a test environment allows or report a plausible weakness as a confirmed one. The controls belong in the surrounding system, in the form of restricted credentials, isolated test systems, explicit scope, monitored tool calls and approval before consequential changes. Researchers at Google and ETH Zurich made a related case in CaMeL, a 2025 design that treats the model as an untrusted component and enforces policy when tools are called.
Daybreak Blue and Daybreak Red show how access can be tiered. Blue gives approved defenders access to general-purpose models for work such as vulnerability discovery, code review, malware analysis and incident response. Red adds purpose-trained cyber models for authorized vulnerability research, exploit validation and security testing. OpenAI says GPT-5.6-Cyber, its newest Red model, is trained to reduce refusals on some higher-risk, dual-use tasks. In an internal evaluation involving requests such as exploit-chain development, authentication bypass and privilege escalation, OpenAI reports a 95 percent completion rate for GPT-5.6-Cyber, compared with 1.5 percent for GPT-5.6 Sol and 2 percent for Sol with Blue access. That is a measure of how often the models answered, not whether the answers were correct or safe to deploy. The stronger model may help a researcher test a real flaw, but it also raises the cost of a mistaken grant or compromised account. OpenAI uses identity checks, account security, monitoring and legal attestations, and requires hardware security keys for individual Daybreak accounts. It also recommends isolated environments, scoped permissions and an auto-review mode that checks elevated actions before they run.
Anthropic’s Cyber Verification Program takes a more explicit tiered approach. Project Glasswing began in April 2026, giving selected organizations that secure critical software access to Claude Mythos Preview. On October 6, Anthropic brought Glasswing and its earlier Cyber Verification Program together in a three-tier offer. Defense Access covers defensive work such as incident response, malware analysis and vulnerability validation. Red Team Access adds authorized penetration testing, while retaining real-time blocks on actions that could cause physical harm or mass disruption. Specialized Access is reserved for a smaller group authorized to test systems such as power grids, telecom networks and interbank infrastructure, and Anthropic says it reviews those organizations with the US government. Anthropic says participating organizations must generally allow data retention for misuse monitoring, although some eligible zero-retention customers qualify for exceptions. Its Claude Code Security product keeps a developer in the approval path before a suggested patch is applied.
Google DeepMind’s CodeMender focuses on the patch itself. It checks proposed changes with static and dynamic analysis, fuzzing and a separate critique tool that looks for regressions. The agent can correct problems found during testing, but its work still goes to human researchers. DeepMind says every CodeMender patch is reviewed before submission to an upstream project. That review matters because a patch can remove one flaw and introduce another, or fix the wrong cause altogether.
These programs do not use the same control. Daybreak governs access to models and recommends safeguards around the customer’s environment. Anthropic combines access tiers with action-level blocks for some high-impact activity. CodeMender places validation and human review in the path from generated patch to upstream code. Each addresses a different point where an agent’s authority can exceed its task. None replaces the organization’s own controls over credentials, networks, repositories and production systems.
AC-6, Least Privilege, in NIST SP 800-53 and its Canadian counterpart, ITSP.10.033, limits each account and process to the access its assigned task requires. A test agent should not inherit production credentials. A patching agent can prepare and verify a change, while a maintainer approves its release. The organization should also record what the agent read, proposed, ran and changed so investigators can reconstruct its actions if something goes wrong.
The published results show why people must own the handoff from discovery to repair. OpenAI says Patch the Planet researchers validate and deduplicate both findings and patches before they reach maintainers, who set their own priorities and disclosure processes. In its early report, OpenAI said the first sprint surfaced hundreds of issues for review and merged dozens of patches, with more under way.
Anthropic reports that Glasswing partners found at least 129,000 verified vulnerabilities between April and July 2026, with another 5,500 found through Anthropic’s own open-source scanning. Those figures come from different programs and reporting periods. Anthropic says its totals draw on partial partner reports, and fewer than half of partners disclosed how many findings had been patched. Discovery counts show what the programs surfaced, but they do not show how many fixes reached users or how safely they were adopted.
The first novel in the Mobius Nexus Cycle turns on a mind that signs a treaty without knowing it has done so. Agent permissions carry a quieter version of that risk. A configuration can grant authority through a setting that no operator recognizes as a decision. The safeguard is to make each grant visible, narrow and owned by someone who understands what it permits.
An organization evaluating an agent should ask what it can read, change and execute, which systems it can reach, who approves consequential actions, and how the team can revoke access or reverse a change. Faster discovery can help defenders, but speed alone does not make software safer. Each agent needs an owner, bounded credentials and an auditable path from its suggestion to the change that enters production.
RECORD RETAINED / SOURCE INTEGRITY UNCONFIRMED