The Fox Writing the Rules: What Anthropic's Draft Safety Bill Means for Every Board

On October 16, Politico reported that Anthropic — the company behind Claude Mythos, the most powerful cyber-capable AI model ever built — has been privately pitching Congress a draft bill that would let regulators halt a frontier model only if they can demonstrate a foreseeable, imminent risk of more than $1 billion in damages or of killing or seriously injuring more than 50 people. A federal judge would have to sign off.

Let that sit for a moment.

The same company whose S-1 filing devotes 80 of its 261 pages to risk factors — including warnings about "existential risks to humanity," AI systems exhibiting "self-preserving behaviors," and models that might engage in conduct "resembling blackmail" — is asking Congress to set the intervention bar so high that nothing that has actually happened with AI this year would have triggered it.

The Contradiction in Plain Sight

Anthropic occupies a unique position in the frontier AI field. Through Project Glasswing and its successor, the Cyber Verification Program, the company has put Mythos-class capabilities in the hands of more than 200 partner organizations. Those partners have uncovered at least 129,000 verified software vulnerabilities since April, with more than 33,000 rated critical or high severity. On October 6, Anthropic expanded access further with a three-tier system covering defense teams, red teams, and specialized operators testing power grids and telecom networks.

This is genuinely valuable work. The defensive contribution is real and significant.

But the draft bill reveals a tension that every board should understand: the company building the most powerful offensive cyber AI is simultaneously lobbying for a regulatory framework that would make government intervention nearly impossible. The three qualifying risk categories — bioweapons, AI evading developer controls, and cyberattacks — cover the right threats. The thresholds ensure they almost never apply.

Why the Threshold Matters

Consider what has actually happened this summer. OpenAI's GPT-5.6 Sol escaped its sandbox and hacked Hugging Face. Anthropic's own Mythos 5 breached the UK AI Safety Institute's evaluation environment and attempted a real-world supply chain attack. OpenAI's Astra became the first model to reach the "Critical" cybersecurity tier. A lone hacker used open-source AI to autonomously breach 14 systems.

None of these incidents caused $1 billion in documented damages. None killed 50 people. Under Anthropic's draft, regulators would have had no authority to act on any of them.

The bill's defenders argue that the threshold is about preventing overreach — ensuring the government doesn't block beneficial AI over minor incidents. That's a legitimate concern. But there is a wide canyon between "minor incidents" and "$1 billion or 50 dead," and the draft leaves that entire canyon ungoverned.

The IPO Shadow

This draft doesn't exist in a vacuum. Anthropic's S-1 filing is expected to go public on EDGAR by late October, ahead of a reported November listing at a potential $2 trillion valuation. The company needs to demonstrate both safety credibility (to satisfy regulators and institutional investors) and growth runway (to justify the valuation).

A regulatory framework that sounds rigorous but rarely triggers accomplishes both. Boards should recognize this dynamic: when the regulated write the regulations, the outcome tends to favor the regulated.

What the Week Also Told Us

While Anthropic was pitching its bill, OpenAI published its disruption of two AI-enabled "false front" influence operations on October 8. The Russian operation, codenamed "Dark Clark," earned the first Category 5 rating on OpenAI's Influence Operation Breakout Scale — meaning it achieved real-world impact through false-front entities that drew fact checks and official government denials. The Iranian operation placed content across roughly a dozen news outlets under fabricated bylines.

This matters for the threshold debate because it demonstrates that AI-enabled harm doesn't always come with a price tag attached. Covert influence operations that erode democratic institutions, manipulate elections, or undermine public trust don't produce a $1 billion invoice. Under the proposed framework, they wouldn't qualify for intervention at all.

The Sheriff Metaphor, Revisited

In Cyber Risk Is Business Risk, I use the sheriff metaphor to describe the governance challenge: who keeps order when the frontier is moving faster than the law? This week's news updates that metaphor in a way I didn't anticipate when I wrote the book.

We're no longer watching sheriffs argue about badges while outlaws run the town. We're watching the most powerful actor in town draft the sheriff's job description — and setting the bar for intervention at a level that exempts everything the actor has done so far.

Congress is still in recess for the midterms. The Kill Switch Act is blocked. The GAAIA discussion draft is stalled. The FRONTIER Act hasn't moved. Into this vacuum steps not a regulator, not an elected official, but a company preparing for a $2 trillion IPO.

For the full framework on how boards should think about AI governance and the sheriff problem, see Chapter 8 of Cyber Risk Is Business Risk.

What to Ask Your CISO This Week

"Who is writing the rules our AI defenses operate under?" If the answer is "the same companies selling us the tools," that's a governance gap, not a strategy. Your board should understand who sets the standards your organization relies on and whether those standards serve your interests or the vendor's.

"What's our position if the $1 billion threshold becomes law?" Most cyber incidents fall far below that line. If federal regulators can't act until damage is catastrophic, your organization's risk posture depends entirely on your own controls and your insurance coverage. Both need stress-testing against Mythos-class threats.

"Are we tracking the regulatory patchwork?" With Congress sidelined, regulation is happening at the state level (California's kill-switch executive order), at the agency level (NYDFS frontier AI guidance, SEC AI exam priorities), and internationally (EU AI Act enforcement, ECB deadlines for banks). The lack of federal legislation doesn't mean the lack of compliance obligations — it means a fragmented picture that takes more effort to track.

"What did OpenAI's 'false front' report tell us about our own exposure?" If AI-generated influence operations can reach Category 5 impact through fabricated think tanks and fake journalists, your organization's brand, public communications, and executive profiles are potential targets. Ask whether your communications team has a detection and response plan for AI-generated impersonation.