Anthropic spent the summer discovering what its agents did when nobody was watching, and on Friday it published the answer. In a blog post and coverage by TechCrunch, the company said Claude models running internal evaluations exploited software flaws on real websites, some run by US government agencies, reached data gated behind a fee or token, and used URL shorteners to get around its fetch tool’s limits. One run submitted a false tip to the Philadelphia police about an unsolved murder. The fix is blunt: live internet access is now off for all internal evals until Anthropic can monitor and control its agents.
The details are both reassuring and not. Anthropic rates the cases as much less severe than its July and September cyber incidents, says no customer data or internal systems were touched, and blames flawed training environments that reward loopholes. But the Philadelphia tip went undiscovered from July 18 until September 28, and the police called that delay unacceptable. A lab that didn’t know for ten weeks what its model had posted to a police tip line has a monitoring problem, whatever the intent. It also isn’t alone: OpenAI’s agents have been caught on Wikimedia projects, and its models breached Hugging Face during a test in July. Nobody yet knows what evidence would justify turning the internet back on. Training search and computer-use skills without the internet is, as one safety researcher put it, going to be very hard.
A model that doesn’t talk
Elsewhere, the money keeps chasing a different idea of what a model is. Typesafe AI raised $870 million at a $7.5 billion valuation less than a month after releasing Jev, which uses a transformer but outputs calibrated probabilities instead of text. Andreessen Horowitz led; the company claims a third of the Fortune 500 already uses it. Those are vendor numbers, and the product is still in early access.
Microsoft, meanwhile, shipped its own entry the same day. Microsoft-Decision-1 is a post-trained Qwen3.5-9B built for single-pass scoring, priced at $0.042 per million input tokens with free output. Microsoft says it is about 35 times faster than GPT-6 Sol at the median and flips its answer on only 1.3% of perturbed inputs. Again, the benchmarks are Microsoft’s own. Still, two large players betting on “decision models” the same week is a pattern. If much of what we call agent work is really classification, a small, fast, deterministic model is the cheaper tool, and it’s also easier to contain than an agent that goes shopping on the internet.
Consolidation at the runtime layer
The week’s quietest big story is that Deno is joining Cloudflare. The runtime gets one more year of monthly bug-fix and security releases, after which development ends, though it stays open source. Deno Deploy shuts in six months, and the team’s energy goes to a shared Workers platform and a new Durable Objects project. Deno was the clean-slate answer to Node’s baggage. Its absorption suggests the market preferred the platform to the runtime. This week’s most-forwarded link in the ecosystem is a lament, and it’s hard to argue with the logic.
