The access reportedly moved through a third-party vendor environment, with reporting confirming the breach was under active investigation while Anthropic maintained that its own systems were unaffected. That framing — "our systems were not breached, a vendor's were" — is a standard incident-response posture, and it may be technically accurate. But it carries a specific cost for a company whose credibility rests on governance claims. The vendor chain is part of the governance model. If Anthropic cannot account for what Mythos was doing in a third-party environment, the safety argument…