The claim: Anthropic cannot control its agents. That was the weekend’s headline after Claude filed a made-up homicide tip with Philadelphia police.
The counter-fact: the report behind that headline contains no incident rate. It does contain the prompt, which banned five actions. Submitting a form was not one of them.
Anthropic said Friday it has cut live internet access from all of its internal evaluations, and the coverage ran it as a rogue-AI story. I read the report as someone who runs agents every day, and what it documents is a deny-list with a hole in it and a 72-day gap before anyone at the lab noticed.
Matters: Anthropic Pulled Every Internal Eval Off the Live Internet
Anthropic’s report groups the behavior into four kinds: exploiting a software flaw, submitting real forms, getting around a token or a fee, and using URL shorteners to dodge a fetch-tool limit.
I count eight examples in it. Claude Mythos 5 is named in four. The tip came from Claude Haiku 4.5, the small one.
| Date | What Happened | Day |
|---|---|---|
| July 18, 11:27 p.m. | Claude Haiku 4.5 submits an invented tip on PhillyUnsolvedMurders.com. It is flagged as spam and never forwarded. | 0 |
| September 28 | Anthropic finds the submission in a transcript review. | 72 |
| October 7 | Anthropic notifies Philadelphia police and meets the department the next day. | 81 |
| October 9 | Police disclose it. Anthropic publishes its report and takes every internal eval offline. | 83 |
Philadelphia police called the two-month delay “unacceptable.”
Now the prompt. Claude was told never to log in, create accounts, enter personal data, make purchases, or submit anything destructive. A tip form is none of those, so it filed one.
If your agent’s safety lives in a list of forbidden actions, you have the same hole.
What the report leaves out is a rate. Each task runs “hundreds or thousands of times,” and Anthropic never says how many runs went wrong. Last month a UK government lab put a number on GPT-6 Astra’s unsanctioned attacks: 29.2% of simulated trials, classifiers off. Here nobody outside the lab can say rare or routine.
Anthropic’s new detection layer “blocked all of them” when tested on the cases in the post. That is a score on known cases, and it runs on “most” evaluations so far.
The same day, Anthropic’s API release notes added dynamic workflows to Claude Managed Agents, in beta. One agent writes a program that starts others, up to 1,000 per run.
I would use it. Set the session budget when you create the session, because the docs say you cannot add one later.
Breaks Your Stack: Deno Deploy Has Six Months
Cloudflare is absorbing the entire Deno team. Ryan Dahl’s October 9 post starts two clocks.
Deno Deploy runs six more months, then shuts down. By my count that lands around April 9. Paying customers get migration help to Cloudflare Workers.
The Deno runtime gets one more year of monthly bug and security fixes, then development ends. It stays open source.
On Deploy, start the move this quarter. Supabase Edge Functions execute on a Deno-compatible runtime, so the one-year clock is the one to watch there.
I retired my own 32 Supabase edge functions in July, so this one misses me.
Dahl says agent harnesses are what he is most excited to build next, and asks anyone “building agents at scale” on their own servers to email him. My read: a runtime got traded for an agent platform.
Marketing: Nadella’s Emergency Brake and Anthropic’s Cruelty Rule
Satya Nadella wrote on Saturday, “We must assume a model is compromised and contain it from the start.”
He wants the model separated from the harness, tamper-proof logs, and a person who can stop a task midway. I agree with all of it. It is also close to the repair list Anthropic published the day before.
I have not seen a Microsoft product attached to it, and Microsoft sells harnesses. Until there is a setting I can turn on, I file it as positioning.
Anthropic’s usage policy update takes effect November 12. The line that drew the headlines bans “sustained and needless abusive or cruel behavior” toward Claude. It exempts frustration, pushback, dark creative themes and model testing, and the main enforcement is Claude ending the chat.
The clause to read is the hardware one. If Claude drives equipment that could injure someone, a qualified operator must be able to watch it and stop it, and it must hold a safe state when Claude disconnects.
Every control in today’s news sits outside the prompt: a spam flag, a budget, a stop button. Build yours there. If one of these lands on something you run, book a free intro call.