On Imminent Danger of Unscrupulous Intrusion
In the same week, two American institutions made decisions about dangerous capability. One institution looked at what it had built and decided the public could not have it. The other looked at what it had built and decided, at two o’clock in the morning, that it could not decide at all.
The first institution was a private AI company. The second was the Congress of the United States.
That inversion is the story.
What Anthropic Built
On April 8, Anthropic released a model called Claude Mythos Preview to a small group of corporate partners. It did not release the model to the public, and it said plainly why. In its own testing, Mythos Preview identified and exploited previously unknown vulnerabilities in every major operating system and every major web browser. The oldest bug it found was twenty-seven years old, sitting undisturbed in OpenBSD — an operating system whose entire reputation rests on being secure. In another test, the model chained four separate vulnerabilities together to escape both a browser sandbox and the operating system beneath it. It figured out, on its own, how to escalate privileges on Linux by exploiting race conditions most human researchers would need weeks to find.
Anthropic’s own engineers were alarmed enough by what they saw that the company declined to put the model on general release. Instead, it built a program called Project Glasswing. Fifty or so technology companies — Microsoft, Nvidia, Cisco, and roughly forty-seven others that build and maintain the software the rest of us depend on — were given access to Mythos Preview, along with a hundred million dollars in credits to run it. The purpose was defensive. Find the bugs before someone else does. Patch the systems before the model that can break them ends up in hands that would.
That was the judgment Anthropic made. A capability this dangerous cannot be released broadly. It has to be contained, directed, and used only by parties with reason to fix what it finds rather than exploit it.
It is worth pausing on what that decision required. Anthropic gave up revenue. It gave up the publicity of a public launch. It accepted the awkwardness of telling its own customers they could not have the most capable thing the company had ever made. And it did all of this voluntarily, because nobody in Washington required it to do any of it.
This is not a story of heroism. It is a story of a private company exercising a governance instinct that the government has declined to exercise on itself. Whether Anthropic made the right call is a question for another essay. The fact that Anthropic was the one making the call at all — that is this essay’s concern.
What Congress Could Not Do
On the same stretch of days, the House of Representatives took up a clean reauthorization of Section 702 of the Foreign Intelligence Surveillance Act. No reforms. No warrant requirement for backdoor searches of Americans’ communications. No closing of the data broker loophole. Eighteen more months of the same authority that has already produced, by the government’s own admission, hundreds of thousands of compliance violations against American citizens.
Section 702 authorizes warrantless surveillance of non-U.S. persons abroad. That is its stated purpose. In practice, Americans’ communications are routinely swept up in that collection, and the FBI has spent years querying the resulting database for information on American citizens without warrants. The bureau calls this “incidental.” Everyone else calls it what it is. And the scale has been growing. In March, new figures showed that FBI queries of Americans’ data under Section 702 rose thirty-five percent in 2025 — after the very reforms the Speaker now cites as proof that further reforms are unnecessary.
Those reforms, passed in 2024 as the Reforming Intelligence and Securing America Act, included a two-year sunset specifically so Congress could keep negotiating a warrant requirement. In 2025, a federal district court ruled that the Fourth Amendment requires the government to obtain a warrant before searching Section 702 data for Americans’ communications. The political and legal momentum for reform has only grown. Leadership in both chambers has ignored it.
Speaker Mike Johnson, pushing the clean extension, has been citing a favorable number: compliance violations have dropped from 278,000 to 127 under the 2024 reforms. He offers this as a reason no further reforms are needed. It is, of course, an admission that the prior scale of abuse was in the hundreds of thousands — abuse that occurred under the same authority Congress now wants to extend unchanged. It also quietly changes the subject. “Violations” is a narrow, self-reported category. “Queries” is the category that actually describes how often the FBI reaches into Americans’ communications, and that number is up by more than a third.
The reversals have been as striking as the numbers. President Trump, who spent 2024 telling Republicans to “KILL FISA,” reversed and asked the same members to “UNIFY” behind a clean bill. Chairman Jim Jordan, who a year ago wrote an essay explicitly calling for warrant requirements under Section 702, testified this week for a clean extension, arguing that the Trump administration has pursued transparency reforms that make Section 702 a “totally different program, totally different situation today.” This is not policy reasoning. It is the partisan relocation of a constitutional question. When the other party held the executive, surveillance abuse was a structural problem. Now that his own party holds it, the structure is fine. The abuse did not change. The occupant did.
And still, the clean bill could not pass. Johnson punted the procedural vote Tuesday. He punted it Wednesday. He punted it Thursday. A coalition of Freedom Caucus hardliners and the Congressional Progressive Caucus — nearly a hundred Democrats, formally whipped against clean reauthorization, plus a dozen or more Republicans pushing for a warrant amendment — held the floor closed to the bill the Speaker wanted to pass. Three Freedom Caucus members of the Rules Committee were conspicuously absent when the panel advanced the bill without amendments, a procedural courtesy that preserved their ability to kill it later.
They did kill it, in effect. At two o’clock Friday morning, with the authority set to expire on Monday, the House voted to extend Section 702 for thirteen days. Not eighteen months. Not with reforms. Not as a clean bill. Thirteen days, passed in the small hours, because the Speaker could not find the votes for any of the alternatives and the clock was running out.
This is the institution that built this capability, unable to decide whether to contain it.
The Inversion
Set the two decisions side by side.
A private company, accountable to its shareholders and its own sense of what it can live with, looked at a dangerous new capability and chose restraint. It accepted costs. It narrowed distribution. It wrote the rules it thought the situation required, because no one else was going to write them. The decision was made in a single meeting and implemented within days.
A public institution, accountable — at least in theory — to the Fourth Amendment and to the Americans whose communications it sweeps up, looked at an authority with a documented and growing record of abuse, a district court ruling that key uses of it are unconstitutional, and a bipartisan reform coalition large enough to stop a clean bill, and could not reach a decision. It extended the authority for thirteen days to avoid making one.
One of these institutions treated dangerous capability as a reason for humility. The other treated a constitutional question as too inconvenient to resolve, and bought itself two weeks to not resolve it.
The embarrassment here is not that Anthropic made a better decision than Congress. Private companies make better decisions than Congress on plenty of narrow questions; that is not news. The embarrassment is what the contrast reveals about where governance is actually happening in the United States right now. On a question of significant public consequence — who has access to a tool capable of breaking the systems the country runs on — the meaningful decision was made in a private company’s conference room. Congress was not in the room. Congress, on the same stretch of days, was busy failing to decide whether to restrain a power it had used to query Americans’ communications more than a third more often than the year before.
This is not a situation that reflects well on the Constitution, if you believe the Constitution was written to locate important decisions in accountable public institutions. It is also not a situation that can be fixed by praising Anthropic. The Glasswing decision, whatever its merits, was made unilaterally by people who were not elected and who answer, in the end, to a small number of investors and a founder’s conscience. The fact that the call came out well this time does not mean the call should be theirs to make. It means the public architecture for making that call has gone missing, and a private actor has stepped into the vacuum.
The Fourth Amendment exists because the framers understood that the power to search and the willingness to restrain it do not reliably coexist in the same hands. The whole point of writing the restraint down was to remove it from the discretion of whoever happened to hold the power that week. What is happening with Section 702 is a demonstration that the restraint, once written down, can be left unenforced by the very institutions charged with enforcing it — can, in fact, be reduced to a standing negotiation conducted two weeks at a time. What is happening with Mythos is a demonstration that the restraint, when it happens at all, is happening somewhere the framers never thought to put it.
Neither of these is a good outcome. One is just less bad than the other this week.
What Restraint Looks Like
There is a useful word for what Anthropic did with Mythos, and it is not “ethical” or “responsible” or any of the other words that have been worn smooth by corporate use. The word is scrupulous. To be scrupulous is to take seriously the possibility that you might be wrong, or that the tool in your hand might cause harm you cannot undo, and to let that possibility shape what you do next. It is a small word for a small habit, and it is the habit the Fourth Amendment was written to institutionalize.
Congress was asked this week to be scrupulous about a power it has held for eighteen years. A private company, in the same week, decided to be scrupulous about a power it has held for eighteen days.
That is the contrast. The rest is commentary.
What the Vote Told Us
At two in the morning on Friday, the House voted to extend Section 702 for thirteen days. Not eighteen months. Not with reforms. Not as a clean bill. Thirteen days, because the Speaker could not find the votes for any of the alternatives and the authority was set to expire on Monday.
This is not governance. This is a legislative body that has lost the capacity to make a decision about a power it holds, and has decided instead to hold the decision open indefinitely, two weeks at a time, while the power continues to operate. A private company, earlier this month, decided in a single meeting what it could and could not release to the public. Congress, given eighteen months to decide what it could and could not do to the public, chose to give itself two more weeks. It will, in all likelihood, use those two weeks to give itself two more after that.
The documented abuse continues. The queries of Americans’ communications went up thirty-five percent last year. A federal court has already ruled that core features of the program violate the Fourth Amendment. The reform coalition is the largest it has been since the program was created. And the institution constitutionally charged with deciding what to do about any of it could not, this week, decide anything at all.
One institution exercised restraint. The other institution demonstrated, at two in the morning, that it has lost the ability to.