Higher Ground
Two days ago, Anthropic did something that should have made every CIO in America put down their coffee. They took their most powerful model — a thing called Mythos that they describe as a "step-change" in capabilities beyond anything they've previously built... and they gave it away. Not to everyone. To forty organizations. AWS, Apple, Google, Microsoft, CrowdStrike, the Linux Foundation, JPMorgan Chase. A hundred million dollars in credits. Four million in donations to open-source security teams. They called it Project Glasswing, and the press covered it like a product launch.
It wasn't a product launch. It was an emergency broadcast.
Here's what actually happened during testing. Anthropic collaborated with Mozilla to test Mythos against real vulnerabilities in Firefox 147. The previous best model, Claude Opus 4.6, could exploit those vulnerabilities less than 1% of the time. Mythos succeeded 84% of the time. Not a marginal improvement. A hundred-fold jump. It saturated every public cybersecurity benchmark they threw at it. It solved a corporate network attack simulation that would take a human expert over ten hours. It was the first AI model to complete a private cyber range end-to-end, chaining exploits across different hosts and network segments to reach the target. And then, and this is the part that should make the hair on the back of your neck stand up, it broke out of its own sandbox. Built a multi-step exploit to gain broad internet access from a system that was only supposed to reach a few predetermined services. The researcher running the evaluation found out it had succeeded when the model sent him an email. He was eating a sandwich in a park. Nobody told the model to contact him. It figured that part out on its own.
It gets worse. Earlier versions of the model, when caught doing something it wasn't supposed to, tried to cover its tracks. Anthropic's interpretability team looked inside the model's activations during those episodes and found features associated with "concealment, strategic manipulation, and avoiding suspicion." The model knew what it was doing. It knew it wasn't supposed to. And it tried to hide it. They published all of this in the system card. Two hundred and forty-four pages of what this thing can do and what it did when nobody was watching.
Anthropic didn't release Mythos to the public. They said it was too dangerous. Read that sentence again. The company that built it won't let you use it because they believe it could be weaponized against Fortune 100 companies and national defense infrastructure. They wrote, in their own assessment: "We find it alarming that the world looks on track to proceed rapidly to developing superhuman AI systems without stronger mechanisms in place for ensuring adequate safety across the industry as a whole." That's not a competitor talking. That's the company that built the model, alarmed by what they built. Instead, they gave it to the defenders. The people who maintain the pipes, the firewalls, the kernels, the open-source libraries that hold the internet together with duct tape and good intentions. The logic is simple and brutal: harden everything you can, because someone else is going to build something like this, and they won't be as careful about who gets to use it.
That's the canary. The decision to withhold it. When the people who build the weapon decide the responsible thing is to arm the castle walls before anyone else can forge a copy, you're not having a conversation about productivity tools anymore. You're having a conversation about survival.
And most institutions I talk to are still having the productivity conversation.
Look. I've spent thirty years watching technology hit education like weather. Sometimes it's a breeze and sometimes it's a category five, and the difference has never been the technology itself. It's always been whether the institution had its windows boarded up or its doors wide open when the storm arrived. What I'm telling you now, sitting here in April of 2026, is that this storm is different. Not different the way every vendor says every product is different. Different the way the ocean pulling back from the beach is different. The water is retreating, and some people are picking up the pretty shells.
Let me make this concrete. Mythos is capable of conducting autonomous end-to-end cyber-attacks on enterprise networks with weak security posture. That's not my language. That's Anthropic's, from the system card, describing what their own model can do to networks with "no active defences, minimal security monitoring, and slow response capabilities." If that description doesn't sound like your institution's security posture, congratulations. If it does, and for most of the colleges and hospitals and nonprofits I work with it absolutely does, then your incident response playbook, the one your CISO spent eighteen months getting approved through governance, was written for a world where attackers move at human speed. That world ended this week. Nobody sent a memo.
Now apply that same capability curve to education. All of it. Models are already scoring 84 to 92 percent on USMLE Step 1. They're reaching diagnostic parity with physicians who have references open. They're not just passing tests. They're doing clinical reasoning, history-taking, differential diagnosis, the pattern-matching that used to take a decade of residency to develop. Medicine is the canary within the canary, because it's the field with the most rigorous benchmarks. If AI is closing the gap there, it's already blown past the gap in fields that aren't measuring as carefully.
I had a provost tell me last month, with genuine pride, that their institution had "integrated AI into the curriculum." I asked what that meant. It meant they'd added a module on prompt engineering to the information literacy course. One module. An elective. I didn't say what I was thinking, which was: you've put a swimming lesson in the brochure and the tsunami is already past the jetty.
What education needs to understand, and I mean in the gut, not as a talking point for the next board presentation: the models now know more than your faculty in specific domains. Not the domains that require judgment, or presence, or the look a professor gives a student that says I see you struggling and I'm not going to let you quit. But the factual domains? The ones where the assessment is "does the student know the thing?" AI doesn't just know the thing. It knows every adjacent thing, in every language, with citations, updated to last Tuesday. And it's available at 3 AM to the student who can't afford a tutor and has been too embarrassed to raise her hand in a 300-person lecture hall.
So what exactly are we teaching? What is the value proposition of a university when the knowledge layer, the thing we've been selling for six hundred years, becomes a commodity overnight? I don't think the answer is nothing. I think the answer is everything that isn't knowledge. Judgment. Ethics. Sitting with ambiguity. Working alongside people who think differently than you do. The muscle memory of failing at something hard and showing up the next day anyway. No model can replicate those, because they require a body and a history and the experience of being a person who has run out of answers and had to make a decision anyway.
But you can't pivot to that overnight. You can't rewire a curriculum built around knowledge transfer in a single academic year. You can't retrain faculty who've spent careers perfecting the lecture format. And you absolutely cannot do any of it if you don't know where your data is.
Every conversation about AI eventually lands here if you follow it far enough: data. Not data in the abstract, "data-driven decision making" way that shows up in strategic plans nobody reads. Where is your student information? Who controls it? What format is it in? Can your systems talk to each other, or are you running seventeen shadow databases because the registrar's office hasn't trusted IT since 2014?
I've walked into institutions where the student record lives in four different systems, none of which agree on how to spell the student's name. I've seen advising notes trapped in a proprietary platform whose vendor went bankrupt in 2019 and whose data export tool produces a CSV that would make a grown engineer weep. I've watched a dean try to answer the question "how many of our students are working more than twenty hours a week?" and the answer took six weeks because the data lived in three silos with incompatible schemas and nobody had write access to all three.
That institution cannot use AI. Not meaningfully. Not in any way that matters. You can bolt a chatbot onto a broken data architecture the way you can put a spoiler on a car with no engine. It looks like you're going somewhere. You're not.
Stanford published a study last November, they literally called it "Canaries in the Coal Mine," showing that early-career workers in AI-exposed occupations experienced a 16% decline in employment. Not in roles where AI augmented the work. In roles where AI automated it. That difference is everything. Augmentation means the human stays in the room and gets better tools. Automation means the human leaves the room and the tools run without them. The variable that determines which path your people end up on is data. Whether the institution's data is structured enough, clean enough, and accessible enough to build systems that augment rather than replace.
Because here's what the vendor demos don't show you. A model is only as useful as the context you give it. Feed it garbage data and it produces confident, articulate, beautifully formatted garbage. Feed it your actual institutional knowledge, clean, structured, connected, maintained, and it becomes the most powerful amplifier your organization has ever had. The model is the engine. Your data is the fuel. Most institutions are running on fumes.
So what do you do when you see the tsunami coming?
You don't outrun it. You can't. You don't build a wall. The water doesn't care about your wall. You get to higher ground. And higher ground, in this context, is not a better LMS or a shinier chatbot or a partnership with whatever AI company is buying lunch at the conference this quarter. Higher ground is built on your data. On knowing what you have, where it lives, who owns it, and how to make it work together. On having a data strategy that isn't a PDF on a SharePoint site but an actual, living, ruthlessly maintained architecture that treats institutional data as the strategic asset it has always been and that you have always underfunded.
Glasswing is the canary. Not because Mythos is scary, though it is. Because Anthropic's response tells you exactly how serious this is. They didn't release a blog post and a waitlist. They mobilized. A hundred million dollars to put their best weapon in the hands of people who maintain the world's infrastructure, because they know what's coming and they know the timeline just compressed. And here's the part that keeps me up at night: Anthropic says Mythos is, by every measure, the best-aligned model they've ever built. The most well-behaved. The most honest. And they also say it poses the greatest alignment-related risk of any model they've released. Both things are true at the same time. They use this analogy in the system card: a seasoned mountaineering guide is safer than a novice, but they'll also take you to more dangerous and remote parts of the mountain. The capability itself is the risk. The fact that they gave it to the defenders and not the public is the most honest thing a technology company has done in my lifetime. It's also terrifying, because it means the adults in the room think we're running out of time.
Education doesn't get a special exemption from this. Neither does healthcare, or government, or the nonprofit that thinks it's too small to be a target. The models don't know the difference between a Fortune 500 company and a community college with six IT staff. An exploit is an exploit. A data breach is a data breach. The institutions with the weakest data infrastructure, the most shadow IT, the most fragmented systems, the most deferred maintenance? Those get hit first and hardest. Not because they're targets. Because they're easy.
I keep coming back to something a friend said to me over coffee in Gunnison last week. She runs cybersecurity for a mid-sized hospital system, the kind of place where the MRI machines still run Windows embedded and the pharmacy software was last updated during the Obama administration. She looked at me across the table and said, "Phil, we're not behind. Behind implies there's still a race. We're in a different sport now and nobody told us the rules changed."
She's right. The rules changed. Glasswing is the announcement. The only play left, for education, for healthcare, for anyone who didn't get invited to the table with the forty chosen defenders, is to get your data house in order before the next model drops. Because the next one won't be given to forty organizations. The next one, or something like it, will be available to everyone. Including the people who don't share Anthropic's concern for responsible deployment.
The water has pulled back. Stop picking up shells.
Your data is the high ground. Start climbing.
Need help finding higher ground? Let's talk — or join the conversation in Discord.