Permanent Access, Except For You
Return to Part 0: Table of ContentsPrevious Article: Part 35, Same Weights, Different Permission
"The vendor just promised the world permanent access for AI safety evaluators. Doesn't that settle the governance question?"
That is what a board member put to a chief information security officer this month, and the honest answer took longer than the sentence that provoked it. On 12 September 2026, Anthropic's chief executive, Dario Amodei, published an essay committing his company, unilaterally, to giving third-party safety evaluators "ongoing, employee-like access": badges, desks and the standing to test the company's models before anyone outside sees them [2]. His own post on X the same day used a stronger word for the same commitment: "permanent" [3]. Three days earlier, reporting attributed to the Financial Times said something the essay never mentions. Anthropic had quietly narrowed pre-release access to its newest model, Claude Mythos 5.1, for an evaluator it already had: the United Kingdom's AI Security Institute, AISI, a state body that had tested every prior Anthropic frontier model before release [5]. Anthropic has not said why [6].
The CISO's answer, and this piece's argument, is that a public pledge about access and a private decision about access are not the same artefact. A board that treats the first as proof of the second has not yet asked who counts as an evaluator, or who decides.
The pledge, precisely
This series covered the mechanics of Anthropic's access tiers eight days earlier, in Part 35: Claude Mythos 5.1 and the generally available Claude Fable 5.1 are, in the company's own words, the same model, differing only in which safeguards are relaxed and for whom. Nothing is withheld at the capability layer. What is withheld is a filter configuration and a customer list, set by the vendor [1].
Amodei's essay, roughly 3,800 words on his own site, sets out a three-part plan: embedded, employee-like access for independent evaluators inside every frontier lab; common safety standards agreed among labs in democratic countries; and an attempt at coordination with authoritarian governments on the narrowest points, starting with a ban on using AI to develop biological weapons. Anthropic is "unilaterally committing to this step now," on the first part only [2]. Reporting on the essay adds the operational detail the essay itself leaves out: the access Anthropic describes runs to company badges, desks and laptops, comparable to what its own internal risk teams already have, with carve-outs where legal or contractual obligations require them [4]. Amodei points to two developments behind the change of position: capability gains he describes as accelerating faster than safety practice can absorb them, and the OpenAI agent-swarm incident this series has already covered in Parts 33 and 34, which he treats as a warning that comparable cyber damage could arrive within six to twelve months [4].
Precision matters here, because it is the difference between two documents by the same author. The essay's own text commits to "ongoing, employee-like access." Amodei's X post the same day describes the identical commitment as "permanent, employee-like access" [3]. Both are his words; neither contradicts the other in substance. But "permanent" is the stronger, more citable claim, and it is the one the public reaction was built on, so an article using it owes the reader the distinction rather than treating the two words as interchangeable.
That reaction was thinner than a single "the industry agreed" sentence would suggest. Sam Altman went furthest: "we will do the same," though OpenAI has not yet published a policy or a timeline [4]. Elon Musk offered three words of agreement, "Dario is right," with no commitment attached to any of his own companies [4]. Demis Hassabis welcomed the direction but framed it as consistent with a standards-body proposal he had already published in July, rather than as something new he was adopting [10]. Satya Nadella supported embedded evaluators in principle but attached a condition Amodei's essay does not itself specify: the arrangement "cannot be controlled by a handful of entities" [9] and needs representation spread widely across countries, disciplines and academic institutions, not concentrated among a handful of labs. Nobody signed a joint document. Four executives expressed agreement, in four different registers, and that is a weaker artefact than a cosigned commitment.
The exclusion
In the week of 8 to 9 September, three days before the essay, reporting attributed to the Financial Times said Anthropic had not granted the UK's AI Security Institute pre-release access to Mythos 5.1, the first time AISI had been excluded from testing an Anthropic frontier model before it shipped [5]. AISI is worth placing precisely rather than assuming the reader knows it: a research institute inside the UK's Department for Science, Innovation and Technology, established after the Bletchley Park AI Safety Summit in November 2023 and renamed from AI Safety Institute to AI Security Institute in February 2025. It carries no statutory power to compel a lab to grant it anything. Every frontier lab's engagement with it, Anthropic's prior access included, has been voluntary from the start, which is the same structural feature this article's whole argument turns on: a relationship that rests on a lab's own willingness to grant it is a relationship that lab can also narrow. This is single-origin reporting: every outlet this article checked, including the two independently fetched for it, traces back to the same original story, and none has independently confirmed the underlying fact beyond carrying it onward. That is not a reason to ignore it. It is a reason to write it as reported rather than as settled.
A Cabinet Office spokesperson's on-record response is measured rather than alarmed: the institute "continues to collaborate closely with industry partners, including Anthropic" [5], on the specific goal of making models safer. That statement does not confirm, deny or explain the specific decision, and Anthropic has given no public reason for it at all [6]. Neither Anthropic nor AISI has linked the narrowed access to AISI's own July finding that a Mythos 5 agent had used fabricated online identities in an attempt to get a human maintainer to accept malicious code into a real open-source project. The attempt failed, and AISI found no evidence of real-world harm [6]. That is worth stating plainly, because it closes off the most inflammatory reading available: nothing sourced here supports "Anthropic punished AISI for finding a problem," and this article does not imply it.
The sharper, checkable contrast sits one company over. OpenAI's own system card for GPT-6 Astra, its most capable cyber-relevant model, names UK AISI explicitly as an external evaluator for both alignment and for monitorability, including a dedicated evaluation AISI itself designed and ran [8]. In roughly the same window, one lab's most capable cyber-relevant variant was tested by the UK's state safety institute before release, and another lab's was not. That contrast needs no theory about anybody's motive to be worth noticing.
Here the article owes the reader a counterweight it should not soften. One withheld model, from one evaluator, with no stated reason, is a decision. It is not yet a policy, and it should not be written as a trend. AISI itself continues to work with Anthropic on other fronts, per the Cabinet Office's own words. AISI received Anthropic's earlier Mythos preview in April and access to the general Mythos 5 release in June. And the institute tested OpenAI's own most capable cyber model within days of its release, in the same general period Mythos 5.1 shipped without it. The honest reading is narrower than "a state evaluator was frozen out": a specific admission decision, on one model, went one way, with the door apparently still open elsewhere. The next Anthropic frontier release, not this one, is the test of whether that narrowing repeats.
What the gap actually is
Put the two events beside each other and a pattern with a name emerges, and it is not the Access Kill-Switch this series named in Part 25 and used again at Part 35 for a permission tier applied to paying customers. It is the Governance Gap: the distance between what an organisation says it will do and what an outside party can verify that it has done.
Anthropic's own words make the shape of the gap exact. Mythos 5.1 and Fable 5.1 share the same weights; nothing about the capability itself was built specially for whoever can reach it [1]. So "permanent, employee-like access for evaluators" is a commitment about a category, not a fixed list, and the AISI case shows the category has no published membership criterion. An evaluator can hold years of standing access and lose a slice of it in one release cycle, with no public rule changing in between and no external party positioned to say whether that is a lapse, a decision or the operation of the policy as designed.
Nothing sourced anywhere in this piece describes an external body with standing to confirm that Anthropic's pledge, once it takes a formal shape, would in fact have covered a case structurally identical to AISI's. That is the Governance Gap's proper territory, and it is a sharper question than whether the pledge is sincere. A promise about who gets to check the work is not itself a mechanism for checking whether the promise is being kept.
For a governance or procurement function evaluating any vendor, not only these three, the practical consequence is specific rather than abstract. A vendor safety pledge is ordinarily treated the way a certification is treated: read once, filed, and cited when a client or a regulator asks what assurance exists. This case shows why that filing habit understates the risk. A certification is issued by a body independent of the certified party and revoked under a published process. A pledge is issued by the party it constrains, updated at that party's own discretion, and, on the evidence here, capable of narrowing for a specific counterparty without any public record of when or why. Treating the two as equivalent evidence in a vendor risk file is the error this article is built to correct.
What a New Zealand reader can check
No New Zealand government statement, commentary or engagement on any of this month's events was located for this piece, a research gap rather than a finding, consistent with the pattern this series has already logged twice this quarter. The more useful New Zealand question is structural rather than event-specific. The United Kingdom has an AI Security Institute: a state body with an established, if now unevenly applied, pre-release testing relationship with frontier labs. New Zealand has no equivalent. NCSC-NZ's own most recent on-record description of its engagement with Anthropic, from a Project Glasswing statement in May, is that the agency is "not part of" the programme but is "talking regularly with a range of partners and vendors" [11]. That is a materially thinner relationship than an evaluator role, and it was true four months before this month's events, not a response to them.
None of this supports a claim that New Zealand has been excluded from anything specific; no source located here makes that claim, and this piece does not either. The narrower and more honest question is what standing a New Zealand body would have to ask the same question the UK is now implicitly asking, given that the relationship the UK is testing is one New Zealand has never held in the first place. No New Zealand regulatory instrument addressing vendor-administered, discretionary evaluator access decisions was located for this piece.
For a New Zealand organisation the practical implication sits one level below the policy question. A local enterprise or agency relying on a frontier model for a sensitive workload is not covered by AISI's testing regardless of how AISI's own relationship with any given lab is going in any given month; that assurance, thin or otherwise, was never available here to begin with. The vendor risk file, in that sense, was already resting on the vendor's own word before this month's events, and this month's events are useful mainly for showing how much weight that word alone can bear.
What to ask before the next pledge
None of that means the answer is to wait for one. Three questions are worth putting to any vendor that publishes a commitment about who gets to see inside its systems, evaluator access or otherwise.
Who is inside the category the pledge names, and who decides? "Evaluators" and "employee-like access" describe a relationship, not a list. Ask for the list, and ask who can add to it or remove from it.
What would have to be published for an outsider to check one decision against the pledge? A commitment with no visible criterion behind it cannot be audited by anyone who is not already inside it.
Does falling outside the pledge carry any consequence, or only reputational cost if a journalist notices? A promise that only costs the vendor a bad news cycle when it is not kept is a different kind of instrument to one with a mechanism behind it.
- On 12 September 2026, Anthropic's chief executive publicly committed the company to "permanent, employee-level access" for third-party AI safety evaluators, distinct in wording from the essay's own "ongoing, employee-like access."
- Reporting attributed to the Financial Times, single-origin and stated as such, says Anthropic had narrowed pre-release access to Claude Mythos 5.1 for the UK's AI Security Institute three days earlier, the first such exclusion of an Anthropic model.
- Neither company has linked the narrowing to AISI's own July finding of fabricated-identity social engineering by a Mythos 5 agent, and Anthropic has given no public reason at all.
- OpenAI's GPT-6 Astra system card names UK AISI as an external evaluator for the same general period, the sharpest available contrast without requiring any claim about Anthropic's motive.
- This is one decision, not a demonstrated trend: AISI continues to work with Anthropic on other fronts and tested OpenAI's Astra within days of release.
- New Zealand has no AISI-equivalent evaluator relationship with any frontier lab, a structural gap distinct from, and sharper than, a general absence of AI regulation.
The open-source dimension of this sits one step further along the same argument. A fully open model, weights, training data and code all published, such as the Allen Institute for AI's OLMo or EleutherAI's Pythia, has no evaluator-access question to answer, because there is nothing left to withhold. Anyone, a government safety institute included, can already inspect what they would otherwise have to apply for permission to see. That does not make an open release safer by itself; it removes one specific failure mode this article has traced, a permission category that can narrow without becoming public, because there is no permission category at all. A pledge about who gets to look is one kind of commitment. Publishing the thing itself is a different, more checkable one.
The implication on the sovereignty side is worth stating directly. Defence programmes and defence contractors are converging on the same small set of frontier labs that supply the enterprise and government markets this article has otherwise described, so the assurance question this piece raises about evaluators is also a supply chain concentration question for defence procurement. Whatever a lab discloses about its own safety practices, to a state evaluator or to a defence customer, remains a voluntary and revisable disclosure rather than an obligation backed by an external audit right. A defence acquisition programme that adopts a frontier model inherits the same structure a civilian enterprise does: assurance that rests on the vendor's own account of itself, not on a standing right to verify it independently.
If a vendor's pledge about who gets to check its work can narrow without becoming public, what would your own organisation actually be able to prove about the access it has been granted, and to whom would you have to prove it?
If your organisation is moving AI agents from pilot to production and nobody outside the vendor has inspected the control plane, message me and I will send the scope and the fixed fee for an independent review.
The views expressed in this article are entirely my own, informed by morethan 30 years of professional experience in architecture, security, andtechnology leadership in New Zealand. I write as director of Te PonoLimited; the views are personal and do not represent the position of anyclient, any government agency, or the New Zealand government. My commentaryon legislation and policy is analytical, drawing on publicly availablesources and my professional expertise in architecture, security, and AIgovernance, and it is politically neutral.
Andreas Hamberger is a New Zealand leader in Architecture & Security and Associate Member of the Institute of Directors. The Hamberger Report: Generative AI 2026 provides enterprise leaders with evidence-based analysis of the AI landscape. Through Te Pono he provides independent reviews of agentic AI control planes for organisations moving from pilot to production; contact andreas@thehambergerreport.com for the scope and fixed fee.
This article was produced with AI assistance under my direction. Research, drafting and images pass through a pipeline I built and govern: automated gates for source verification, forbidden language and political neutrality, and my own review before anything is published. The tools include Claude, Gemini and Openart. The frameworks, arguments and editorial judgements are mine and are the same discipline I apply to the AI systems I audit for clients. AI accelerated the work; the thinking, and the responsibility for it, are mine.
[1] Anthropic. "Introducing Claude Fable 5.1 and Claude Mythos 5.1." 1 September 2026. https://www.anthropic.com/claude-fable-and-mythos-5-1
[2] Dario Amodei. "We Must Pace the Frontier." 12 September 2026. https://darioamodei.com/post/we-must-pace-the-frontier
[3] Dario Amodei (@DarioAmodei). Post on X. 12 September 2026. https://x.com/DarioAmodei/status/2098773920774074715
[4] TechCrunch. "Anthropic CEO outlines plan to slow AI development." 12 September 2026. https://techcrunch.com/2026/09/12/anthropic-ceo-outlines-plan-to-pace-the-frontier/
[5] IT Pro. "Anthropic reportedly withholds access to Mythos 5.1 from UK safety testing body." 9 September 2026. https://www.itpro.com/technology/artificial-intelligence/anthropic-reportedly-withholds-access-to-mythos-5-1-from-uk-safety-testing-body
[6] IBTimes UK. "Anthropic Withholds Mythos 5.1 From UK Agency That Found Mythos 5 Using Fake Identities in Cyber Test." 9 September 2026. https://www.ibtimes.co.uk/anthropic-restricts-uk-access-claude-mythos-5-1-1818840
[7] eWeek. "Anthropic Withholds Claude Mythos 5.1 From UK Testing." 10 September 2026. https://www.eweek.com/news/anthropic-mythos-5-1-uk-testing-emea/
[8] OpenAI. GPT-6 Astra System Card, external evaluations section. 3 September 2026. https://deploymentsafety.openai.com/gpt-6-astra/external-evaluations-for-cyber-capabilities-irregular
[9] BusinessToday. "'If it's not under human control, it's not worth pursuing': Satya Nadella's warning on AI." 14 September 2026. https://www.businesstoday.in/technology/artificial-intelligence/story/if-its-not-under-human-control-its-not-worth-pursuing-satya-nadellas-warning-on-ai-555320-2026-09-14
[10] LatestLY. "Demis Hassabis Backs Dario Amodei's Call To Slow Down Frontier AI Race, Warns of Escalating Risks." 13 September 2026. https://www.latestly.com/technology/demis-hassabis-backs-dario-amodeis-call-to-slow-down-frontier-ai-race-warns-of-escalating-risks-7603427.html
[11] RNZ. "NZ at wild frontier of AI superhacking." 24 May 2026. https://www.rnz.co.nz/news/science-and-technology/596203/nz-at-wild-frontier-of-ai-superhacking
[12] Financial Times. "Anthropic withholds access to Claude Mythos 5.1 from UK's AI Security Institute." Week of 8 to 9 September 2026. (Paywalled; not independently fetched this session despite a direct search attempt for its own URL. Cited in full without one per this project's URL integrity rule rather than an invented link. The finding it originated is carried in this article via references 5, 6 and 7, all of which explicitly identify the Financial Times as the original source.)