Radar Trends to Watch: May 2026

Mike Loukides and Claude · rss · 2026-04-20 Reader 🖥️

AI-Driven Vulnerability Discovery Enterprise AI Adoption & Readiness Malleable Software Multi-Agent Orchestration Mythos Near-Zero-Cost Code Open-Weight Models Project Glasswing

The AI industry is rapidly moving from experimental models to operational infrastructure — agents, orchestration layers, and security tooling — and the central tension is between open deployment and controlled access, a tension most visible in the divergent approaches to frontier security capabilities taken by Anthropic (restrict) and OpenAI (release).

practical · expository — A curated technology trends roundup that organizes recent developments into thematic sections and frames them with editorial commentary arguing for specific stances practitioners should take (invest in security, evaluate agent stacks carefully, plan for AI disruption of web infrastructure).

Structure

Part	Role
Opening editorial frame: Anthropic vs. OpenAI on frontier security capabilities	Thesis statement — establishes the central tension of the issue
AI is becoming operational — agents for teams, not just individuals	Second thesis — the shift from experimental to production AI
AI Models section	Evidence — catalogs the breadth and acceleration of model releases, demonstrating commoditization and pricing pressure
Software Development section	Evidence — shows the agent stack crystallizing (orchestration, execution, review) and the competitive dynamics among tool providers
Security section	Evidence and warning — demonstrates that frontier AI capabilities create urgent security risks; the restrict-vs-release tension is highest-stakes here
Infrastructure and Operations section	Evidence — shows the emerging standard architecture for agents and the vendor lock-in risks
Web section	Context — aging web infrastructure as an underappreciated vulnerability in the AI transition
Biology and Robotics sections	Evidence — AI expanding beyond software into scientific and physical domains

Key terms

operational AI Enterprise AI Adoption & Readiness
AI that automates processes across an enterprise via shared, team-level agents — not just individual chatbot interactions
Project Glasswing Project Glasswing
Anthropic's controlled-access program that restricts Claude Mythos to a small corporate cohort for defensive security work
agentic stack Multi-Agent Orchestration
A three-layer architecture (orchestration, execution, review) composed of interchangeable modules for building AI agents
laziness (Cantrill's sense) Near-Zero-Cost Code
The engineering virtue of designing for future maintainability, reusability, and economy — threatened when AI makes work effectively free
reimagining Malleable Software
Using agentic programming to rebuild existing tools from scratch based on current needs rather than incrementally patching legacy designs (e.g., Cloudflare's EmDash vs. WordPress)

Propositions

explicitThe question of whether to restrict or openly release frontier AI security capabilities is the defining tension of this technology cycle.conf: high
explicitOpen-weight models have reached viability as serious alternatives to closed frontier models, shifting the competition to cost, portability, and support trade-offs.conf: high
explicitAI is transitioning from individual productivity tools to team-level operational infrastructure that automates enterprise processes.conf: high
explicitThe time between discovery of a software vulnerability and its exploitation has collapsed to effectively zero due to AI capabilities.conf: high
explicitSecure systems are most often compromised not through their core protocols but through the surrounding software environment.conf: high
explicitWhen AI makes the cost of producing work near-zero, the engineering virtue of designing for future workers (laziness) is endangered, and this is a serious problem.conf: high
implicitThe limiting factor for AI compute is not chip availability but power availability.conf: high
explicitA less capable AI model can effectively supervise a more capable one, which has implications for alignment.conf: high
implicitThe web's aging infrastructure — maintained by aging developers, built on protocols designed for different assumptions — is a significant and underappreciated risk in the AI transition.conf: high
explicitcorroboratedVendor lock-in in the emerging agent stack is a serious risk because each vendor's implementation of the standard three-layer architecture makes different bets about portability and durability.conf: medium
supports ←Google's Genkit Ships Agents API with Detached Turns and Human-in-the-Loop for TypeScript and Go · p8 — Genkit's own concession that its differentiator is full-stack breadth (typed SDKs, streaming protocol, deployment coupling) rather than ecosystem size is a concrete case supporting the general claim that vendor lock-in risk in the agent stack now lives in framework-level implementation choices, not just model choice.
explicitChat is a suboptimal interface for most AI interactions; AI should generate task-specific interfaces on the fly.conf: medium
implicitThe explosion of new apps (84% increase) driven by vibe coding represents a quantity-over-quality dynamic that platforms will need to actively manage.conf: medium

Arguments

Organizations should restrict, not openly release, frontier AI models with advanced security capabilities. strength: medium

Explicit premises:

Claude Mythos can find zero-day vulnerabilities in critical software
The AI Security Institute confirms the capability is real and consequential
Time from vulnerability discovery to exploitation has collapsed to zero

Implicit premises:

Defensive use of these capabilities (patching before exploitation) requires a head start over attackers
Controlled access can actually be maintained — the capability won't be independently replicated quickly
The organizations given restricted access will use it responsibly

Inferences:

OpenAI's decision to release GPT-5.5 openly, with similar capabilities, undermines Anthropic's restriction strategy — if one provider releases, restriction by others is moot
The restrict-vs-release tension may be inherently unstable: it only works if all frontier providers coordinate

The open-weight model market is fundamentally reshaping AI economics, making cost and portability the key competitive dimensions rather than raw capability. strength: high

Explicit premises:

At least 10 significant model releases this cycle from open and closed providers
DeepSeek V4 performs near frontier models at radically lower cost
Multiple vendors (Alibaba, Google, Z.ai, Moonshot) released capable open models

Implicit premises:

Model capability is converging — the gap between open and closed is narrowing faster than closed providers can widen it
Sufficient capability for most use cases already exists in open models
The closed-model premium is primarily for cutting-edge capability, not everyday operational use

Inferences:

Closed-model providers will need to compete on infrastructure, tooling, and managed services rather than model quality alone — which is exactly what Anthropic appears to be doing by becoming 'the AWS of agentic AI'

Secure systems fail at their boundaries, not their cores, which means security investment must focus on the full environment, not just the primary protocol. strength: high

Explicit premises:

Tor was compromised through a Firefox browser vulnerability, not the Tor protocol
Signal messages were accessed through an iOS notification vulnerability, not Signal's encryption
npm supply chain attack exploits the publishing pipeline, not npm itself

Implicit premises:

Security is a property of the system, not the component
Users and organizations systematically underinvest in peripheral security because they trust the core protocol

Inferences:

AI-generated code, if it increases the volume and complexity of peripheral software, will expand the attack surface faster than AI security tools can patrol it

The agentic programming paradigm enables a 'reimagining' phase where legacy software can be rebuilt from scratch based on current needs.

Explicit premises:

Cloudflare built EmDash as a WordPress alternative based on how the web is used today
Coding agents dramatically reduce the cost of building from scratch

Implicit premises:

Incremental improvement of legacy software has diminishing returns
The accumulated design assumptions in legacy software (e.g., WordPress) are a greater liability than the cost of reimplementation
Reimplemented software will be maintainable — the laziness problem won't apply

Inferences:

This creates a tension with Cantrill's laziness argument: if reimagining is easy but maintaining the reimagined software is hard, we may be creating new legacy faster than we can manage

Narratives

Anthropic restricted Claude Mythos to a small cohort via Project Glasswing; OpenAI released GPT-5.5 with similar capabilities to general availability.
→ Dramatizes the restrict-vs-release tension as a concrete competitive divergence between two specific companies, making the abstract policy question vivid and urgent.
Anthropic published a public postmortem on Claude Code's behavior regression after developer complaints.
→ Supports the proposition that AI providers should communicate quality issues transparently; implicitly argues for Anthropic as a responsible actor (despite the regression itself).
Cursor 3 relegated its IDE to the background, making agent orchestration the primary interface.
→ Illustrates the shift from AI-as-assistant to AI-as-primary-actor in software development; supports the 'AI is becoming operational' thesis.
Anthropic accidentally leaked Claude Code source, leading to malware-laden clones on GitHub claiming unlocked enterprise features.
→ Illustrates the security-at-the-boundary argument: the threat wasn't in Claude Code itself but in the ecosystem response to the leak.
Claude discovered zero-day RCE vulnerabilities in both Vim and Emacs; Emacs developers argued the bug was really in Git.
→ Illustrates both AI's capability for vulnerability discovery and the human tendency to deflect responsibility to adjacent components — supporting the boundary-security argument.

Questions addressed

⭕ Should frontier AI models with advanced security capabilities be openly released or restricted?
The article frames the tension but does not resolve it — it presents Anthropic's restriction and OpenAI's release as competing approaches without declaring a winner.
✅ Has AI moved beyond experimentation into operational use?
Yes — the evidence of team-level agents, enterprise orchestration stacks, and managed infrastructure makes this clear.
✅ Are open-weight models viable alternatives to closed frontier models?
Yes — the question has shifted from viability to which trade-offs to accept.
⭕ How should organizations invest in security given AI-accelerated vulnerability exploitation?
The article says 'if you're not investing in security, it's time to start' but does not specify how to prioritize.
⭕ What happens when the engineering virtue of laziness is lost because AI makes work free?
Raised via Cantrill's essay but left open — no proposed solution.

Gaps

incompleteThe article frames restrict-vs-release as the central tension but does not address the game-theoretic problem: restriction by one provider is moot if another releases equivalent capabilities. The article itself provides evidence for this (GPT-5.5 as 'Mythos-like hacking, open to all') but does not confront the implication that unilateral restriction may be futile.
Read next: Game theory of AI safety coordination; international AI governance frameworks; the Anthropic/OpenAI competitive dynamic in safety policy
closed by16) Inga Strümke om hvor AI er på vei, den outsourcede problemløsningen og datamanifolden — Answers the game-theoretic objection to unilateral restriction: equivalent zero-day-finding capability already exists via swarms of small open models, so vendor self-restraint is structurally insufficient in a competitive market.
incompleteThe article presents the three-layer agentic stack (orchestration, execution, review) as an emerging standard but provides no analysis of whether this architecture is actually sound or just the first thing that crystallized. There is no discussion of failure modes, debugging, or accountability within this architecture.
Read next: Bryan Cantrill's laziness essay; 'Hidden Technical Debt of Agentic Engineering'; distributed systems architecture literature
incompleteThe tension between 'reimagining' (rebuilding software from scratch with AI) and 'laziness' (the virtue of designing for future maintainability) is present in the article but never connected. If AI makes building cheap but maintaining thoughtful, these two trends are on a collision course.
Read next: Cantrill's full essay on laziness; the original 'Hidden Technical Debt in Machine Learning Systems' paper
uninformedThe article does not address the labor market implications of AI becoming operational at the team level. If agents replace team-level workflows, the impact on employment is qualitatively different from individual productivity gains.
Read next: Daron Acemoglu's work on AI and labor; the Stanford AI Index's labor market sections
incompleteThe co-authorship attribution ('Mike Loukides and Claude') is noted without comment. The article does not discuss what it means for a trends roundup to be co-authored by an AI model — raising questions about editorial judgment, selection bias, and the epistemic status of the analysis.
Read next: Discussions of AI co-authorship norms; editorial standards for AI-assisted journalism

Radar Trends to Watch: May 2026

Structure

Key terms

Propositions

Arguments

Narratives

Questions addressed

Gaps

Related documents