On Imminent Danger of Unscrupulous Intrusion
I am writing this on the evening of April 16, 2026.
In the same week, two American institutions made decisions about dangerous capability. One institution looked at what it had built and decided the public could not have it. The other looked at what it had built and decided the public would keep it, unchanged.
The first institution was a private AI company. The second was the United States Congress.
That inversion is the story.
What Anthropic Built
On April 8, Anthropic released a model called Claude Mythos Preview to a small group of corporate partners. It did not release the model to the public, and it said plainly why. In its own testing, Mythos Preview identified and exploited previously unknown vulnerabilities in every major operating system and every major web browser. The oldest bug it found was twenty-seven years old, sitting undisturbed in OpenBSD — an operating system whose entire reputation rests on being secure. In another test, the model chained four separate vulnerabilities together to escape both a browser sandbox and the operating system beneath it. It figured out, on its own, how to escalate privileges on Linux by exploiting race conditions most human researchers would need weeks to find.
Anthropic’s own engineers were alarmed enough by what they saw that the company declined to put the model on general release. Instead, it built a program called Project Glasswing. Fifty or so technology companies — Microsoft, Nvidia, Cisco, and roughly forty-seven others that build and maintain the software the rest of us depend on — were given access to Mythos Preview, along with a hundred million dollars in credits to run it. The purpose was defensive. Find the bugs before someone else does. Patch the systems before the model that can break them ends up in hands that would.
That was the judgment Anthropic made. A capability this dangerous cannot be released broadly. It has to be contained, directed, and used only by parties with reason to fix what it finds rather than exploit it.
It is worth pausing on what that decision required. Anthropic gave up revenue. It gave up the publicity of a public launch. It accepted the awkwardness of telling its own customers they could not have the most capable thing the company had ever made. And it did all of this voluntarily, because nobody in Washington required it to do any of it.
This is not a story of heroism. It is a story of a private company exercising a governance instinct that the government has declined to exercise on itself. Whether Anthropic made the right call is a question for another essay. The fact that Anthropic was the one making the call at all — that is this essay’s concern.
What Congress Is About to Do
On the same stretch of days, the House of Representatives prepared to vote on a clean reauthorization of Section 702 of the Foreign Intelligence Surveillance Act. No reforms. No warrant requirement for backdoor searches of Americans’ communications. No closing of the data broker loophole. Eighteen more months of the same authority that has already produced, by the government’s own admission, hundreds of thousands of compliance violations against American citizens.
Section 702 authorizes warrantless surveillance of non-U.S. persons abroad. That is its stated purpose. In practice, Americans’ communications are routinely swept up in that collection, and the FBI has spent years querying the resulting database for information on American citizens without warrants. The bureau calls this “incidental.” Everyone else calls it what it is.
Speaker Mike Johnson, pushing the clean extension, has been citing a favorable number: compliance violations have dropped from 278,000 to 127 under the reforms passed in 2024. He offers this as a reason no further reforms are needed. It is, of course, an admission that the prior scale of abuse was in the hundreds of thousands — abuse that occurred under the same authority Congress now wants to extend unchanged. The argument is that the tool has been fixed enough, by the same institution whose misuse of it made reform necessary in the first place.
President Trump, who spent 2024 telling Republicans to “KILL FISA,” has reversed and is asking the same members to “UNIFY” behind a clean bill. Chairman Jim Jordan, previously a reform skeptic, is now on board. The reform coalition has narrowed to a handful of House conservatives and a handful of progressives, with the procedural vote repeatedly delayed because Johnson cannot find the numbers.
The authority expires on April 20. The question before the House is whether the FBI’s ability to query Americans’ communications without a warrant should continue, in its current form, for another year and a half.
The institution that built this capability is choosing not to contain it.
The Inversion
Set the two decisions side by side.
A private company, accountable to its shareholders and its own sense of what it can live with, looked at a dangerous new capability and chose restraint. It accepted costs. It narrowed distribution. It wrote the rules it thought the situation required, because no one else was going to write them.
A public institution, accountable — at least in theory — to the Fourth Amendment and to the Americans whose communications it sweeps up, looked at an authority with a documented history of abuse and chose continuity. It accepted no costs. It narrowed nothing. It declined to write the rules the situation required, because the people running the institution did not want those rules to exist.
One of these institutions treated dangerous capability as a reason for humility. The other treated documented abuse as a reason to keep going.
The embarrassment here is not that Anthropic made a better decision than Congress. Private companies make better decisions than Congress on plenty of narrow questions; that is not news. The embarrassment is what the contrast reveals about where governance is actually happening in the United States right now. On a question of significant public consequence — who has access to a tool capable of breaking the systems the country runs on — the meaningful decision was made in a private company’s conference room. Congress was not in the room. Congress, on the day that decision was being made, was busy declining to regulate itself.
This is not a situation that reflects well on the Constitution, if you believe the Constitution was written to locate important decisions in accountable public institutions. It is also not a situation that can be fixed by praising Anthropic. The Glasswing decision, whatever its merits, was made unilaterally by people who were not elected and who answer, in the end, to a small number of investors and a founder’s conscience. The fact that the call came out well this time does not mean the call should be theirs to make. It means the public architecture for making that call has gone missing, and a private actor has stepped into the vacuum.
The Fourth Amendment exists because the framers understood that the power to search and the willingness to restrain it do not reliably coexist in the same hands. The whole point of writing the restraint down was to remove it from the discretion of whoever happened to hold the power that week. What is happening with 702 is a demonstration that the restraint, once written down, can be left unenforced by the very institutions charged with enforcing it. What is happening with Mythos is a demonstration that the restraint, when it happens at all, is happening somewhere the framers never thought to put it.
Neither of these is a good outcome. One is just less bad than the other this week.
What Restraint Looks Like
There is a useful word for what Anthropic did with Mythos, and it is not “ethical” or “responsible” or any of the other words that have been worn smooth by corporate use. The word is scrupulous. To be scrupulous is to take seriously the possibility that you might be wrong, or that the tool in your hand might cause harm you cannot undo, and to let that possibility shape what you do next. It is a small word for a small habit, and it is the habit the Fourth Amendment was written to institutionalize.
Congress is about to vote, or has just voted, on whether to be scrupulous about a power it has held for eighteen years. A private company, in the same week, decided to be scrupulous about a power it has held for eighteen days.
That is the contrast. The rest is commentary.
What the Vote Told Us
The House did not pass a clean reauthorization of Section 702 tonight. At about 2 a.m. ET, they unanimously voted to extend the expiration date until April 30, 2026 to allow additional time to debate the terms. Whether the authority expires, limps forward on some procedural extension, or returns in a form that includes reforms depends on which faction proves most durable over the next round of negotiation. For the moment, the clean bill does not have the votes.
This is not a victory. It is the bare minimum of institutional function — a handful of members from each party refusing to pretend that documented abuse is an argument for continuity. That refusal held, this cycle, only because a narrow rebellion made it hold. The reform coalition can collapse in the next round. The same bill can return in the next Congress. Surveillance authorities do not die; they wait.
What does not wait is the other half of the picture. A private company, this same week, decided a capability in its possession was too dangerous to release broadly. It made that call because no one else was going to. It will make similar calls in the coming years about capabilities more consequential than Mythos. The public architecture for reviewing those calls does not exist, and nothing that happened in the House tonight changed that.
One institution exercised restraint this week. Another institution barely avoided refusing to. That is the distance between where American governance is and where it would need to be for the Fourth Amendment to mean what it was written to mean.
The work is not finished. It has barely started.