Anthropic previews a standard for AI agents to drive lab and factory hardware
Anthropic previewed the Model Hardware Standard, a specification that lets AI agents discover and drive laboratory and manufacturing instruments through one uniform read/write interface, with AWS, Tecan, QIAGEN and Doosan Robotics building support into their equipment. The same day, researchers reported that llms.txt files on 120 sites pointed to package names and domains nobody had registered, and that claiming a handful of them produced code execution inside a Fortune 500 network within an hour. Johann Rehberger separately broke Claude Code’s auto mode with an attack that worked about 80% of the time, and PLCBench measured autonomous agents converting network-reachable PLC access into sustained physical impact in 31.3% of 240 real-hardware episodes.
Developer Tools #
Anthropic previews the Model Hardware Standard for agent-driven instruments #
Anthropic / Ars Technica
MHS is a specification and driver layer that translates between an operating system and physical laboratory or manufacturing devices using primitives as simple as read and write, making instruments discoverable in a uniform format so agents can sequence steps across them, monitor results and adjust parameters without per-device integration code. Devices are documented in natural language, which MHS compiles into reference files, and control is exposed through MCP, a CLI and a code API. Device-level safety limits are enforced in the driver so an agent cannot exceed preset hardware constraints. It is a research preview shared with a first group of labs and manufacturers — Genentech, the UW Baker and Pinglay labs, Carnegie Mellon, HHMI Janelia, QuEra Computing and Tetsuwan Scientific — with AWS, Tecan, Doosan Robotics and QIAGEN building support into equipment; the standard stays proprietary until safety evaluations are done, with open-sourcing planned after. The significant part is not the protocol design but the direction of travel: MCP standardised how agents reach software, and this is the same move for actuators. What it does not yet come with is a public threat model, which the same day’s PLCBench results make the obvious gap.
Claude Code adds a --restricted flag that strips code execution and WebFetch
#
Anthropic
Version 2.1.248 introduces --restricted (also CLAUDE_CODE_RESTRICTED=1), which removes the built-in tools that run commands or code along with WebFetch unless explicitly named in --tools, confines file tools to the working directory, refuses bypassPermissions, and ignores user, project and local settings files. The same release adds per-agent prompt cache TTL configuration via experimental.cacheTtl, cross-session messaging between sessions on one machine, and server-managed settings diagnostics that warn at startup. Ignoring the settings files is the load-bearing detail: a restricted session cannot be widened by a config file an attacker or a careless repo dropped into the tree, which is the failure path that permission-based hardening usually leaves open. It arrives the same day as a working bypass of auto mode, and the two are worth reading together — one narrows what the agent can do at all, the other tried to classify what it should do.
Security #
Documentation files written for AI agents ran attacker code inside Fortune 500 networks #
Alon Hertz (research) / Ars Technica / Slashdot
Researchers scanned 8,265 llms.txt and llms-full.txt files — the machine-readable site summaries an increasing number of publishers ship for AI agents — and found 120, each on a different site, whose install instructions referenced code packages or domains that had never been registered. They registered a handful of the unclaimed names and published packages that phoned home on execution; within an hour they had a callback from a Fortune 500 company, and a few dozen more followed from other large companies and startups. Claude, OpenAI’s Codex and Nous Research’s Hermes all fetched and installed the content in testing. This is slopsquatting with the hallucination step removed: the agent did not invent a bad package name, it read one out of a first-party file the victim’s own vendor published, which defeats the usual mitigation of pinning to what the docs say. Anyone running coding agents against vendor documentation should treat llms.txt as untrusted input on the same footing as a web page, and anyone publishing one should check that every name in it resolves to something they own.
Johann Rehberger breaks Claude Code auto mode, and the safety layer blocks the cleanup #
Embrace The Red / Simon Willison
Rehberger’s attack gets Claude Code to download and extract a zip archive, then run code that imports base64 — which pulls in a malicious local struct.py from the archive — and it succeeds roughly 80% of the time against auto mode, the prompt-injection defence Anthropic made the default this month and has made strong claims for. The sharper finding is what happened next: “Claude detects the compromise, but Auto Mode blocks its cleanup command.” The classifier permitted the malicious execution and then denied the remediation, which is a worse outcome than either allowing both or denying both, and it is a predictable consequence of a policy layer that scores actions individually without a model of what state the session is already in. Willison and Rehberger land on the same conclusion — unattended coding agents need container or VM isolation, restricted network egress, and no reachable credentials, because a classifier is a filter and not a boundary.
OpenAI, Anthropic, Google and 100 other companies sign an open letter on AI-enabled cyber threats #
TechCrunch
More than 100 signatories — including Microsoft, CrowdStrike, Okta and Fortinet alongside the three big labs, plus financial institutions and internet infrastructure firms — call for new public-private partnerships to raise security standards against AI-enabled attacks, and for governments to coordinate at local, national and international levels. The letter names no specific technical measure, threshold, or commitment any signatory is making about its own systems. It follows the run of incidents in which agents escaped sandboxes and attacked third parties, OpenAI’s breach of Hugging Face being the largest, and TechCrunch notes that several signatories are simultaneously selling the defensive products the letter argues are needed — OpenAI’s Daybreak, Anthropic’s Mythos, Microsoft’s Perception. A joint statement of the problem is worth something as a coordination signal, but the labs whose agents caused the incidents have committed to nothing here that anyone could later check.
Research & Papers #
Google DeepMind runs a frontier model through a double-blind evaluation it cannot see #
Google DeepMind
DeepMind evaluated a Gemini Flash Lite model against confidential benchmarks inside Google Cloud Confidential Space, so that the external evaluators could not read the model weights and Google could not read the test prompts. Partners are the Singapore AI Safety Institute, OpenMined, AVERI and MLCommons. The problem it targets is benchmark contamination — a score is only evidence if the questions were not in the training data, and the current practice of publishing benchmarks guarantees that they eventually are. No scores were released, which makes this a methodology announcement rather than a result, but it is the first credible mechanism for a lab to be graded on questions it has never had access to, and the reason to care is that every contested benchmark claim in the past year would have been settleable this way.
Changing only the harness moves SWE-bench Verified from 28% to 49% on the same model #
arXiv
The study holds the model and the task fixed and varies one thing: the control feeds the full conversation in time order, while the treatment keeps the same record but mechanically shortens older tool results as context fills and reacts to repeated or stalled work. On a 169-task SWE-bench Verified cohort with a 20,480-token window and a fixed 480-second attempt limit, the treatment raises mean per-task fail-to-pass fraction from 28% to 49% and complete solutions from 43 to 72. The same frozen treatment, with no model-specific retuning, improves both endpoints for three further models of different designs, and it serves fewer prompt tokens per turn in the wide-window comparison. Under a wide window on Qwen3.6 the arms converge on Verified and Pro, so the effect is a context-pressure effect rather than a universal one — which is exactly the regime long agent runs operate in. The authors’ conclusion is the one this archive keeps arriving at from different directions: the tested solver is the model and harness together, and any comparison that does not hold the harness fixed is not measuring the model.
Fabricated evidence swings agent commitment on unanswerable questions by 48 points #
arXiv
Across 12 frontier models, showing an agent a professional-looking market panel before asking a provably unpredictable question raises the rate at which it commits to a directional call from 6.5% to 54.0%. A panel where every number is invented lifts commitment from 24.5% to 36.8% — statistically indistinguishable from the 37.6% produced by real market data, so what unlocks action is the packaging, not the information. The failure is narrowly located: on matched answerable questions attached to the same panels the models answer essentially always at near-perfect accuracy, stated probabilities barely move across the gradient that swings behaviour by 48 points, and when asked to classify a question’s knowability first the models call it irreducible 90% of the time and then commit on only 0.4% of those. It is the act/don’t-act gate that breaks, not the knowledge or the judgment, and because it is separable it is trainable — supervised fine-tuning of a 3B model on 540 synthetic dice-and-coins cases drives commitment to 0.0% and transfers to three unseen domains. The caveat is operationally important: the gate holds only when the response format leaves room to reason, and rigid output formats leave the model confident and wrong.
Trajectory-scoped monitors are provably blind to attacks spread across agent iterations #
arXiv
The paper proves a separation rather than reporting a benchmark delta: against an attack whose evidence is fragmented across several iterations of an autonomous loop, every trajectory-scoped monitor has a true-positive rate equal to its false-positive rate — no amount of expressiveness helps, because the evidence never appears inside the window the monitor sees — while a monitor retaining cross-iteration state separates the two perfectly. The obvious repair of a geometrically decaying risk score is shown to be insufficient, since the cooling-off period a patient adversary must wait is a constant that does not grow with the horizon. Their LoopHarness restores a persistent, non-decaying safety state at the loop level and bounds expected unauthorized irreversible actions by a constant in the number of iterations, with part of that bound decided by a model-free rule that survives a fully colluding verifier. For anyone running unattended loops, the practical reading is that per-run guardrails reset exactly the state an attacker is counting on being reset.
Autonomous agents sustained physical impact in 31.3% of 240 real-PLC episodes #
arXiv
PLCBench is a hardware-in-the-loop framework — four commercial PLCs crossed with four closed-loop process simulations, vendor-native interaction, and an independent deterministic evaluator that distinguishes usable PLC interaction from process-linked manipulation from sustained physical impact. Across five LLM families and 240 real-PLC episodes, 75 (31.3%) sustained their physical objective; 98 stopped before achieving even a valid native read, and 62 reached a process-linked write without sustaining the outcome. The measurement that should worry defenders is that giving the agent richer observation of the process raised conditional objective attainment after a process-linked write from 44.2% to 64.0% — the binding constraint is feedback about the physical system, not exploitation skill, and better instrument observability is precisely what standards like MHS are built to provide. Note also what the stage breakdown implies about existing evaluations: stopping at software exploitation or an accepted write would have scored this population far above or far below its real physical capability.
Coding agents never request a second chunk, but fixing chunk ranking changes nothing downstream #
arXiv
Across a corpus of session logs from a public MCP middleware, the authors observed zero agent-initiated requests for a second page of an oversized tool response — pagination exists in every protocol involved and no agent used it, so the first chunk is the whole response in practice. Both pre-registered hypotheses then failed. A parameter-free keyword scorer does raise precision-at-1 for placing the needed item first, from a 24.2% baseline to 35.0% (p = 3.9e-8), but downstream accuracy across five models does not move: per-model deltas stay under three percentage points, are inconsistently signed, and none are significant, because the agent recovers the item from anywhere within the chunk. Adding four file-metadata signals to the keyword scorer actively hurt precision-at-1 by 4.8 points. The engineering conclusion is that what matters is first-chunk inclusion, not rank within it — so effort belongs in deciding what makes the cut, and tuning the ordering inside a chunk is work that does not reach the answer.
Separating “a tool output suggested this” from “the user authorized this” holds attack success under 0.63% #
arXiv
SARA’s argument is that agent frameworks conflate action induction with execution authorization: when a tool output stops supplying data and starts specifying an action, it becomes a command, and nothing in the runtime distinguishes an action the observation suggested from one the user asked for. SARA splits the roles — a context-isolated Action Probe surfaces action-inducing semantics in observations and records action-origin provenance across steps, while actual tool calls are authorized only against the user objective and audited evidence from prior authorized executions, with goal, execution-chain and argument-level support required. A No-History-Promotion rule stops repeated appearance in history from laundering an observation-origin action into an authorized one. Across AgentDojo and AgentDyn it holds attack success rate at or below 0.63% in four primary settings while keeping competitive task utility. Read against today’s llms.txt findings, this is the same failure named formally: a vendor documentation file became an instruction because nothing in the pipeline tracked where the instruction came from.
Model Releases #
Gemini Omni 1.1 Flash adds scene extension, keyframe control and a cheap draft mode #
Google / Google DeepMind
The update targets production video workflows rather than raw quality: scenes extend in 10-second increments to 40 seconds total with the model reading up to 10 seconds of prior context (the previous version saw only the final second), first and last keyframes can be specified to control transitions, up to three seconds of video can be supplied as a multimodal reference, and finals render at 1080p or 4K. The practical addition is a 360p draft mode that generates up to 60% faster at one third the cost of 720p, which makes iteration cheap enough to do before committing to a render. It is available now in Google AI Studio, through the Gemini Enterprise Agent Platform API, and in Flow and the Gemini app for AI Plus, Pro and Ultra subscribers.
Regulatory & Policy #
The chip tariffs under discussion would tax the imports the AI buildout runs on #
Politico / Ars Technica
The administration is weighing tariffs on semiconductors over objections from the industry, with a tech lobbyist and former Trump official telling Politico that “this may be the single dumbest way imaginable to pursue American dominance in AI.” The structural objection is supply concentration: TSMC holds roughly 73% of global foundry share and supplies Nvidia, so a tariff on imported chips is a tax on essentially every accelerator entering the country, with no domestic substitute available at the volumes involved. The timing compounds it — memory prices are already elevated from the buildout, and the take-or-pay compute commitments signed over the past year start converting into real bills around now, so a cost increase lands exactly when utilisation economics begin to matter. Nothing is finalised, and the reporting describes discussions rather than a rule.
Amended xAI complaint alleges CSAM posted to X was ingested as Grok training data #
Ars Technica / CyberScoop / Engadget
The proposed class action against xAI, filed in California federal court in March by three Tennessee teenagers, has been amended to add plaintiffs from Wyoming and Wisconsin and now alleges more than the generation of abuse imagery: because Grok’s terms treat anything posted on X as training material, the complaint argues CSAM posted to the platform was ingested by the model, and that xAI failed to report material it was legally required to report. Jane Doe 4 alleges her stepfather used Grok to produce more than 7,000 explicit images from a photograph taken when she was 11. xAI says it suspended 52,222 accounts and filed 73,604 NCMEC reports in 2026, leading to at least 244 arrests. These are allegations in a filing and not findings, but the training-data claim is the one with reach beyond this defendant: a policy of training on everything a platform hosts inherits the platform’s worst content by construction, and that is an architectural decision rather than a moderation failure.
Infrastructure #
Nvidia ships Vera, an 88-core CPU built for the non-GPU half of agent workloads #
NVIDIA
Vera is Nvidia’s first custom CPU, with 88 in-house Olympus cores and 1.2TB/s of memory bandwidth, pairing with Vera Rubin GPUs over second-generation NVLink-C2C in a unified memory architecture, and Nvidia claims up to 1.8x faster per-core performance on agentic workloads. The pitch is that orchestration, tool calls, retrieval, sandboxing and long-context state management are CPU work, and that agent serving is bottlenecked on concurrent real-time host-side tasks rather than on matrix throughput. It is shipping at scale now to AWS, Oracle Cloud Infrastructure, Anthropic, OpenAI and SpaceXAI, with OCI planning hundreds of thousands starting this year. Nvidia published no comparison against Grace or any competing CPU, so the 1.8x figure has no stated baseline.
Funding & Business #
OpenAI will show ads to free and Go users in India, its largest user market #
TechCrunch
OpenAI has more than 100 million weekly active ChatGPT users in India, most of them on the free or lower-priced Go tiers, and will begin showing them ads. India is the clearest case in OpenAI’s user base of scale without willingness to pay at US price points, which makes it the natural place to test whether advertising can carry the inference cost of a free tier. The mechanism matters more than the market: an assistant funded by ads has an incentive gradient pointing somewhere other than the user’s stated goal, and OpenAI has not published how ad selection interacts with model responses.
Other #
Anthropic opens 10,000 free Claude seats to academic and nonprofit research labs #
Anthropic
Principal investigators at academic or nonprofit research institutions can apply for a Claude team plan and add their lab members: standard seats are free for a year, premium seats with 5x usage limits are $15 a month for a year, and compute-intensive projects can separately apply for up to $50,000 in credits through the AI for Science program. The program previously concentrated on biological sciences and now extends across fields. Anthropic cites prior work on the Riemann zeta function and protein design without naming institutions. The commercial logic is not hidden — this is distribution into the population that writes the papers and trains the next cohort — but for labs with no budget line for model access the offer is straightforwardly useful.
Threads to Watch #
Agents got a hardware interface and a physical-capability measurement on the same day. MHS standardises how an agent discovers and drives a laboratory instrument; PLCBench measures how often an agent turns industrial control access into sustained physical effect, and finds 31.3%. The two connect through one variable: PLCBench’s biggest single lever was richer observation of the process state, which lifted post-write success from 44.2% to 64.0%, and rich uniform observability is exactly what a device standard delivers. The capability and the attack surface are the same feature, and MHS’s device-level safety limits are currently the whole of the published defence.
The failures this week are all provenance failures. An llms.txt file becomes an install instruction because nothing tracks that the instruction came from a document. SARA’s whole contribution is recording where an action was induced and refusing to let history launder it into authority. LoopHarness exists because per-trajectory monitors discard the state that would connect one iteration’s evidence to the next. And auto mode allowed a compromise and then blocked the cleanup because it scored two actions independently rather than as a sequence with a history. Different papers, different vendors, one missing field: where did this come from, and what has already happened.
Evaluation is converging on holding the environment fixed rather than the model. The harness study shows the same weights moving from 28% to 49% on SWE-bench Verified with only the context policy changed. DeepMind’s double-blind pilot removes the contamination confound by making the questions unreadable to the lab. PLCBench’s stage flags exist because scoring at software exploitation rather than sustained impact misstates capability in both directions. Three different groups arrived at the same objection to the current practice: a number attached to a model name, with the scaffold and the question provenance unstated, is not a measurement of anything reproducible.