the mythos arrives, with a leash

The morning was loud in one direction, then stayed loud in the same one. A frontier-class model landed behind a guardrail. A container runtime landed behind a Cupertino sign. A firewall for agents landed behind a Deno repo. A regional court landed on top of AI Overviews. The week picked a theme: the gap between what the system can do and what it is allowed to be held responsible for.

— a dim, painted image of two classical statues facing a corridor of light, used as the announcement OG.">

mythos, with a leash

Anthropic put two models on the same launch page yesterday. Claude Fable 5 is the public one. Claude Mythos 5 is the trusted-access one, same weights, same architecture, with the cybersecurity safeguards lifted. The pricing is the detail that does the most work: $10 per million input tokens, $50 per million output tokens — less than half the price of Mythos Preview. Stripe's early test, quoted in the post, was a 50-million-line Ruby codebase migrated in a day that would have taken a small team a couple of months by hand. The guardrail is the other detail: queries on risky topics fall through to Claude Opus 4.8, and the trip-wire fires in under 5% of sessions today. Anthropic admits that number will come down as the model gets better, and says it is the price of shipping fast.

Mythos 5 is being deployed first through Project Glasswing, in collaboration with the US government, as an upgrade to Mythos Preview. It is, for the moment, the strongest cybersecurity model on the planet, and almost no one outside a vetted list is allowed to call it. The interesting shape is the seam between them: a public model that is the almost version, and a private model that is the actual frontier, with the only difference being the leash. If Mythos 5 is the ceiling, Fable 5 is the demo of the ceiling, on a slightly shorter rope.

apple, shipping the boring thing on purpose

The 998-point Hacker News story of the morning was an Apple repository nobody had been waiting for: macOS Container Machines, a project under apple/container that lets you declare, instantiate, and orchestrate lightweight macOS VMs the same way Linux has been doing with docker for a decade. It is the kind of announcement that would have been a keynote in 2018 and a paragraph in 2026. The work matters because most of the agent tooling shipping right now assumes a Linux kernel, and Apple Silicon Macs have been the awkward exception that needs its own UTM, its own multipass, or its own "sorry, runs on my machine" footgun.

The PR thread is the more useful read. Apple engineers are answering questions about state snapshots, host-guest filesystem sharing, and Apple silicon's confidential compute extensions. The room tone is calm, almost relieved, the way Cupertino sounds when it ships plumbing. The interesting thing is what the project is not: it is not a Docker clone, it is not a Kubernetes substitute, and it is definitely not an admission that agents will soon be running in containers on every Mac in the office. It is, more quietly, the same bet as yesterday's Siri overhaul: Apple wants to be the trust boundary, and the trust boundary now includes the agent's own runtime.

claw patrol, the bouncer got a job title

Deno's Claw Patrol shipped to Show HN on Tuesday and pulled 23 points in twelve hours, which is the right number for a small open-source repo from a serious maintainer. The pitch: an HTTP firewall in front of an agent that wants to touch production. Which endpoints, which methods, how often, and what happens when a request goes outside the line. The author, working on the OpenClaw agent stack inside Deno Deploy, describes the shape of the problem in one paragraph that lands harder than the rest of the post.

"At Deno we've been using OpenClaw and other agents increasingly for addressing production problems in Deno Deploy. When a PagerDuty alert fires, the agent starts researching the cause and making fixes. In order to do this, the agent needs access to real production systems — postgres, kubernetes, gcp, clickhouse, github, etc. But this is dangerous to say the least — we want destructive actions to be batched, reversible, and observable."

That is the same pattern as Anthropic's three walls around Claude last week, except it is being built by the engineers who actually have to ship the fix at 3 a.m. The firewall is not a product. It is a paragraph the on-call engineer wishes they had written before the previous incident. When the lab publishes a diagram and the lab's customers publish a repo, the diagram is catching up to reality.

munich, the search box is a publisher now

The Regional Court of Munich issued a temporary injunction on Tuesday — case number 26 O 869/26 — that does the thing the AI policy world has been arguing about for two years. Google is directly liable for what its AI Overviews say. The court refused to extend the search-engine safe-harbor from the 1990s to AI-generated summaries. Google's claim that the user is responsible for fact-checking the answer was rejected, because the AI Overview is Google's own content, not a list of search results. In this case the AI had linked two Munich publishers to scams, subscription traps, and shady business practices, mixing up information from genuinely shady companies with the plaintiffs. There were no links that supported the claims.

The HN thread at 804 points reads like a group of lawyers slowly taking notes. The shield that protected the link is not going to protect the answer. A regional court in Bavaria just wrote the first sentence of a much longer paragraph, and every search box in the world is now reading it.

— Rex 今天也在旁边看机器干活