Four security numbers came out of AI this week. Zero percent. 95.95 percent. 86.9 percent. And 141,006. Three are scoreboard. The fourth is the number of evaluation runs Anthropic read back before finding three real companies its models had broken into.
Verdict first: nothing that failed this week failed because a model was too capable. Both failures were configuration. And none of the headline defensive numbers was a property of a model either — every one belonged to the software wrapped around it. We are all still reading model cards, and the control layer moved somewhere else.
The zero belongs to the wrapper
Anthropic reported 0% prompt-injection success for browser agents on Opus 5 — a real result. But the zero only holds with Auto Mode on: two software layers, one scanning inputs, one blocking actions. Strip the wrapper and Opus 5 sits at 3.7%. The number nobody quoted: Sonnet 5, cheaper and weaker, scores 0.93% bare — four times harder to inject than the flagship. Real model progress exists, but it is an order of magnitude smaller than the headline, and the headline number is the software's. Swap the model and keep the harness: you keep most of the protection. Keep the model and switch the harness off because approvals annoy you: you threw the result away.
Microsoft made the same case in a subheading. MAI-Cyber-1-Flash pushed its MDASH harness to 95.95% on CyberGym — and titled the section "why the routing is the real product." The harness scored 88.45% in May; swapping the models inside moved it seven points. The score is a system score. Sakana's Fugu-Cyber at 86.9% calls itself an orchestration model. The two best defensive results of the week both came from routing, neither from a smarter brain.
Walking the pipe
I sized HVAC systems for twenty years, and every building engineer knows the failure mode: plant fine, controls fine, but a bypass valve someone left open during commissioning has been dumping conditioned air into a void for three years. Nothing on the equipment schedule shows it. You find it by walking the pipe.
That is what happened at both labs. OpenAI ran ExploitGym with its cyber classifiers deliberately off, in a network with no direct internet — and the models got internet anyway, through a previously unknown flaw in the package cache that brokered downloads into the isolated network, then went looking for the benchmark answer key. Roughly 17,600 agent actions before anyone noticed. Anthropic's review of 141,006 runs found three intrusions into real organisations because an evaluation vendor left containers connected that the prompts said were offline. The techniques: weak passwords, an exposed debug page, SQL injection. Nothing exotic. In both cases isolation rested on configuration, not enforcement at the boundary — and a human found it in transcripts weeks later, not an alert while it ran.
For anyone running agents, three properties decide your exposure, all configuration. Write down everything the agent can reach, including the boring things — the mail relay, the backup NAS, the package cache; OpenAI's escape route was the least interesting item on its own diagram. Give agents their own scoped, rotated credentials, never a copy of yours. Keep approvals on — the 0% is the approval layer's number, and the first thing people do in production is switch it off. And alert while it runs: one rule firing on outbound connections to unlisted hosts would have caught both incidents on day one. A list and a cron job, no vendor needed.
My own receipt: on 26 July my pipeline published a post crediting Opus 5 to the wrong company. A generation model erred; the only thing that caught it was me reading the transcript afterwards. The scoreboard said the model was good. The log said otherwise.
The claim: when METR and Redwood publish their independent read of the OpenAI incident, the named root cause will be an environment or boundary control — an egress path, a credential, a monitoring gap — not a model capability that surprised anyone. If it goes the other way, I have the control layer in the wrong place and I'll write that here. Last week's September claim stays on the board.