The AI-security tooling race

Open · 6 updates · since Oct 6, 2026 · updated Oct 25, 2026 AI anthropic safety

Where it stands: The labs' cyber-capability programs and their tooling: front-model security scanners, defender-access programs and verification boards, from Anthropic's OSS Scanner to the other labs' equivalents.

Latest

2026-10-25 (~12:00 PM ET, MarkTechPost — marktechpost.com/2026): the Oct 8 watch on OSS Scanner triage noise gets a first number — of the high-severity findings audited from its open-source scans, 88% were confirmed valid on review; the free scans run on Anthropic's strongest Claude models. Secondhand coverage (MarkTechPost, not Anthropic's own research post); sample size, project names, and validation method not in the reporting. Watch: whether the validity rate holds at scale, any OpenAI/Google scanner symmetry, and a first-party post with the denominator.
2026-10-19 (~4:00 PM ET, Actu IA — actuia.com/actualite): the thread's standing "third-party evals pending" watch on Mistral Large 4 gets its first published result — Artificial Analysis puts Muse Spark Open at 39, one point ahead of Large 4 at 38, while Large 4 wins the agent tasks; the capture truncates an additional Large 4 "1.8" figure (likely a speed/writing metric — unconfirmed). Same-day adjacent, same band: Tencent's Hy-Memory-30B-A3B, a free open-source mixture-of-experts model, claims Claude Opus 5 parity on AI agent memory — on its own benchmarks (~2:00 PM ET, MSN — msn.com/en-us); the vendor-benchmark genre's self-graded caveat applies verbatim. Watch: the full AA table and field context, the truncated Large 4 figure, independent runs of Hy-Memory's parity claim, and release of its eval scripts.
2026-10-16 (~7:29 AM ET — x.com/MistralAI): Mistral's own channel on Mistral Large 4 / "Le Chonk" — "Turns out le Chonk is into rocket science. Mistral Large 4 scoring well in engineering and astronomy on Ulam's private benchmark, STEMBench" (stembench link carried in-post). Vendor claim on a private benchmark, no scores printed in the post; a development of the Oct 6 open-weights/Surge-AI-eval entry in this thread. Watch: any published STEMBench table, independent reruns, and whether the "private benchmark" framing draws the same benchmark-integrity skepticism the thread has logged elsewhere.

October 2026 · 3 updates

2026-10-08 the defender-access category becomes a standing operation — Anthropic announced the Anthropic Cyber Mission (Anthropic News, feed-anchored 8:00 PM ET Oct 7) and launched OSS Scanner (research post Oct 8; Verge 5:53 PM ET): opt-in, "thorough, periodic security scans by our strongest models at no cost" for open-source projects, "informed by our experience using Claude to find vulnerabilities during Project Glasswing." Delta on the Oct 6 Cyber Verification entry: gated access → mission org + public product. Watch: eligibility/mechanics docs, OpenAI/Google scanner symmetry, OSS triage noise as the second-order cost.
2026-10-07 (band shape): Anthropic's budget tier finally ships — Haiku 5.5 ("10× cheaper than Haiku 4.5 under 100K tokens"; ~75% less on average; full entry in anthropic-opus-5-5). The Sep 26 "no Luna-class budget model" note above is answered; the GLM Flash

DeepSeek Flash > Luna band ranking awaits an AA number on 5.5.
2026-10-06 two entries. (1) The defender-access ask gets machinery — Anthropic expands its Cyber Verification Program (anthropic.com news post, feed-anchored ~8 PM ET Oct 5; X layer ~3 PM ET Oct 6): broader access to its most capable models for verified security professionals — operationalizing the Sep 30 policy ask (Mythos 5.1 behind trusted access), mirroring Google's Fairwind gate; defender-access programs are now a two-lab standing category. Detail snippet-thin: eligibility, capability tier, unverified. (2) Mistral Large 4, "Le Chonk" (Mistral announcement + The Register): vendor-claimed 1T parameters, natively multimodal, open weights — the open-weights race's European frontier-class entrant; blind Surge AI human eval: #1 among open-weights, #2 overall behind Opus 5; Gostev (via LeCun): trained on 4,000 GPUs vs Astra's 100,000 — the compute-disparity frame doing anti-scaling work. Vendor-claimed numbers; independent runs pending. Watch: weights' licensing/ spread, third-party evals, whether the blind-human-eval announcement move spreads.