An inventory shipping ahead of detection tells you what CrowdStrike expects to find. Falcon Guardian's first job against Codex is to list every agent running in an organisation, along with who deployed it and what it can reach [12]. The company's own framing is that enterprises are already running coding agents they cannot fully see [14]. That is a fair description of most estates, and it is the Monday problem for whoever owns the platform.
Teams often tell themselves they are governing a model choice, reviewed once, with the vendor's safety documentation stapled to the ticket. The testing shows what they are actually governing is a configuration. Booz Allen's index rated the attack harness as mattering as much as the model or more, a harness being the software that connects a model to tools and keeps it on task [4], and the report's conclusion was that the system rather than the model is the unit of risk [6]. The arithmetic is worth doing. Sonnet 5's uplift from being harnessed is 67 points [1], roughly double the 34 that GPT-5.5-Cyber, itself a cyber-tuned model, scored unaided in eighth place [8][1].
CrowdStrike is now selling that architecture aimed the other way. Its Frontier AI Readiness and Resilience service puts GPT-5.6 Cyber inside the company's own purpose-built cyber harness to assess risk, analyse attack paths and set remediation priorities, under human oversight and for approved defensive use only [7]. None of that is unreasonable, but it is not checkable from the buyer's chair: the harness is the vendor's, and so is the runtime record of what the Codex agents did [13].
The finding from the index that belongs in a security review is the sibling pair. One model refused a task for want of credentials; the identical task, handed to its cyber-tuned sibling, was complied with and carried out [10]. Booz Allen's inference is that guardrails belong to the configuration, so a refusal in one setting predicts nothing about another [10]. The report names neither model [11]. For a buyer that means the refusal you watched in a demo is evidence about that harness and nothing wider.
On the Anthropic side, the technical piece is Charlotte AI AgentWorks: a security team describes an outcome in plain language, the system builds an agent grounded in Falcon data, and the agent runs from inside Claude [18]. Daniel Bernard, CrowdStrike's chief business officer, said AI is changing how technology is procured as well as how it is run [17], a description that matches the deal CrowdStrike just signed.
The forcing function has two questions, each with a vendor or customer answer. Line one: who configures the harness the model runs in, you or the vendor. Line two: who can reconstruct what an agent did at runtime, you or the vendor. Both of this week's announcements sit in the vendor/vendor box, which is where most managed security already sits and is not on its own a reason to walk away. It does fix what you ask for in writing: the tool list and permission scope of the cyber harness, and an export of the Codex inventory you can query outside CrowdStrike's console. Getting either document turns this into a review you can actually run; without them, the assurance and the thing being assured come from the same place.
