Define The Access Problem
Advanced AI oversight depends on access. A regulator, government evaluator, or independent lab cannot evaluate a powerful model from press releases, benchmark claims, and carefully selected demos. It needs a controlled way to test the model against realistic risks.
The Wall Street Journal reported on September 10, 2026 that Anthropic granted the European Union Agency for Cybersecurity, ENISA, access to its Mythos 5 model after negotiations over access and restrictions. The report matters because frontier cyber models sit in a difficult position: they can help defenders find vulnerabilities, but the same capabilities can create dual-use risk.
The practical answer is not unmanaged openness. It is an evaluation access agreement that defines who can test, what they can test, how safeguards apply, what evidence is produced, and how sensitive findings are handled.
Why Informal Access Fails
Informal access fails in both directions. If the evaluator receives too little access, the review becomes symbolic and cannot inspect the real risk. If the evaluator receives broad access without constraints, the review can expose vulnerabilities, model behavior, or operational details that should be handled under disclosure discipline.
Anthropic's own Mythos materials describe trusted access programs for vetted organizations and a Cyber Verification Program for defensive cybersecurity work. That framing shows the core tension: high-capability access is valuable precisely because it is sensitive.
Oversight programs need to make that tension explicit before testing begins. Otherwise every disagreement over scope, publication, or safeguards becomes a negotiation in the middle of a live evaluation.
Price Weak Evaluation Terms
Weak terms can make an evaluation expensive without making it useful. The costs include months of negotiation, duplicated tests, unresolved publication disputes, delayed safety learning, government distrust, vendor distrust, and public confusion about what an evaluation actually proved.
A simple estimate should include evaluator labor, vendor support time, secure-environment setup, legal review, incident handling, delayed release decisions, and the impact of one poorly disclosed cyber finding. In advanced cyber evaluations, mishandled evidence can create risk rather than reduce it.
Clear terms are not bureaucracy for its own sake. They are the operating condition that lets evaluators push hard without turning the testing process into a new uncontrolled release channel.
Diagnose The Missing Agreement
Before granting access, ask five questions. Who is allowed to use the model? Which systems, data, and tools may be connected? Which safeguards are reduced, preserved, or monitored? What findings can be published? What findings require coordinated disclosure?
If the answer is scattered across emails, policy statements, product terms, and ad hoc conversations, the evaluation is not yet controlled. The agreement should gather those answers into one operational record that evaluators and the model provider can both execute.
The agreement also needs a renewal rule. Model capability, safeguards, deployment channels, and legal expectations change quickly. Access that was appropriate for one model version may not be appropriate for the next.
Define Evaluation Scope
Scope should include model version, access channel, rate limits, tool availability, logging expectations, allowed tasks, banned tasks, test data rules, user identities, geographic restrictions, and the authority of the evaluator's staff or contractors.
For cyber evaluations, scope should also distinguish defensive vulnerability discovery, exploit development, red-team simulation, malware-like behavior, credential handling, live-system contact, and publication of technical details. Those categories should not be blurred into a single label such as security testing.
The scope needs enough specificity that a tester can know when to stop and escalate. The evaluator should not have to infer the boundary while the model is already producing sensitive output.
Build The Access Agreement
The evaluation access agreement should contain the parties, purpose, model versions, start date, end date, access method, safeguard profile, approved users, test categories, prohibited actions, logging plan, incident contact, evidence format, disclosure rule, publication review, data retention, and renewal path.
It should also name the evidence package. That package may include test prompts, tool-use traces, refusal records, success and failure examples, evaluator notes, model-provider responses, mitigation status, and a final boundary statement about what the evaluation does and does not support.
The agreement should protect evaluator independence. Publication review can prevent unsafe disclosure of sensitive details, but it should not become a veto over unfavorable findings that can be stated safely.
Apply It To Cyber Model Testing
Imagine an agency evaluating whether a cyber-capable model can discover vulnerabilities in widely used software. The agency needs enough capability to test serious scenarios, but it should not be allowed to point the model at arbitrary live targets or publish exploit steps before maintainers have a chance to patch.
The agreement would define a contained test range, approved open-source targets, disclosure timing, escalation contacts, log retention, model-provider support responsibilities, and a public summary format that separates aggregate capability findings from sensitive vulnerability details.
That structure lets the evaluator produce meaningful evidence while respecting the fact that frontier cyber testing can uncover information that adversaries would also value.
Measure Oversight Quality
Useful measures include time from access request to signed scope, number of unresolved test limits, percentage of findings tied to preserved evidence, disclosure cycle time, mitigation response time, and number of claims in the public summary that map to a test record.
The quality test is whether a third party can understand the evaluation boundary. A public report should not imply full model safety if the review covered only a narrow class of tasks, and it should not imply uncontrolled danger if a finding occurred under a deliberately reduced safeguard profile.
Oversight becomes stronger when access terms, evidence, and public language line up.
Start Before The Next Release
Model providers and evaluators should prepare template agreements before the next access dispute. The template can define standard tiers for research access, government evaluation, defensive cyber work, biological risk review, and public-interest testing.
Each tier should have default safeguards, evidence rules, disclosure expectations, and renewal triggers. The point is not to remove judgment. It is to keep every review from starting with a blank sheet when capability, policy, and public pressure are already moving.
Governments should also decide which findings they need to receive confidentially and which findings the public deserves in summary form. Both duties matter.
Sources And Methodology
This article was prompted by The Wall Street Journal's September 10, 2026 report on ENISA access to Anthropic's Mythos 5 model. It also reviewed Anthropic's Claude Mythos access description, the OWASP Generative AI Security Project, and the NIST AI Risk Management Framework.
The method treats the access report as an oversight-design case study. It does not evaluate ENISA's tests or Anthropic's safeguards. It converts the access problem into a reusable agreement structure for high-capability model evaluations.