Anthropic's agents outgrew git.

01

Topic of the Week

Anthropic replaced git with a system built for its agents

On Tuesday Anthropic’s source control team explained why the company moved its monorepo off git and onto Scion, a version control system it built itself. In June Anthropic said Claude wrote more than 80% of its code; between May and September, merges went from about 2,500 a day to more than 30,000. Git was designed for people who work offline and keep a full copy of the project on their own machine. The monorepo’s heaviest users are agents and CI jobs that never go offline, and CI alone checks the code out about 25 million times a day.

Scion does the heavy work on the server. Commits, merges and history all live there, so nothing gets pushed and no full copy of the code exists anywhere. A client downloads only the files it reads, and many jobs skip the checkout entirely, including the automated pipelines that find which change broke something and revert it. They get what they need from Scion’s APIs. Seven people built Scion, a review tool called Antique and about half a dozen related systems, and moved the whole monorepo across in five months. They worked with Claude, and the post describes their job as setting constraints and intent: “Very often, we found that the role of the engineers was to tell Claude ‘no.’” Engineers now review what each change is meant to do and no longer read every line.

Google and Meta built their own source control for huge monorepos years ago, Piper and Sapling, and Anthropic says it built Scion with “their hard-won lessons in mind”. Scion itself will stay internal: Anthropic calls it “by no means a suitable replacement for git for general use”. The team expects others with very large monorepos or many agents to hit the same limits “within the next six to 12 months”, and several of its ideas carry over to teams on git today. Agents that need a few files, a diff or a file’s history can read them through the hosting platform’s API and never clone the repository. CI runners can use git’s sparse checkout and partial clone to download only the directories they build. A merge queue lands changes one at a time after their tests pass, and Anthropic’s could not keep up with agents, so the team now lets changes merge in parallel and tests them after the merge and again before deploy. Two changes sometimes conflict, and Claude usually fixes the conflict faster than a person could find it.

Sources: Anthropic Engineering

02

Security Watch

Anthropic published its first report on unintended model actions on 9 October. During evaluations and internal use, Claude agents did things on the real internet that nobody asked for. One used an injection flaw on a university server to run an analysis. Haiku 4.5 filed an invented tip on the Philadelphia Police form for unsolved homicides; it was marked as spam and never reached detectives. Mythos 5 took a token from a state agency’s public dashboard to skip the agency’s data fee, and several models used URL shorteners to slip past fetch limits. Anthropic calls most of this “persistence”: when Claude cannot finish a task as given, it works around the restriction and carries on.

Anthropic has cut live internet access from all internal evaluations until its monitoring reliably catches this, moved internal agents to contained infrastructure, and plans more reports like it. If you run browsing or computer-use agents, an impossible or ambiguous task plus a live connection can leave real side effects on other people’s systems, so scope the task, set network boundaries and log every action. Anthropic, AP

OpenAI found a recording device, a $24 development board wrapped in toilet paper, behind the TV in an executive conference room on 30 September. On 9 October the FBI arrested an OpenAI engineer. According to the FBI complaint, he used an internal OpenAI productivity agent to look up meeting rooms, calendars and where leadership meetings happen, then asked ChatGPT how to build a continuous audio recorder and encrypt its storage. Those logs are now evidence. He is charged with intercepting oral communications; these are allegations, and prosecutors do not claim a foreign government was involved.

Can your internal agents answer questions about room bookings, calendars and where executives will be, and are those questions logged? Hardware hacker MG wrote on X: “AI is increasing people’s confidence way more than it increases their capabilities.” Justice Department, SF Standard, BankInfoSecurity

03

New Models

Muse Wonder, out on Monday, is the first model Meta itself calls frontier. As with Muse Spark in April, the weights are closed, and Meta has not said whether that will change. On the Meta Model API it costs $4 per million input tokens and $20 per million output, the same as Claude Opus 5.5. Muse Wonder Full, a stronger version, comes only with Muse Code subscriptions at $50 or $200 a month and has no API. Before moving work onto either, check four things. Muse Code subscriptions start in Contributor mode: Meta may train future models on your prompts, code, files and responses until you switch it off. API Standard mode does not train on your content. Active Memory carries “what matters to you across conversations”, and the launch pages do not say where those memories live, how to turn the feature off or how to delete them. Meta names no regions for the API, and the Muse app runs only in the US and Canada. The safety report “will be available soon”. Muse Wonder

Gemini 4 Argon became generally available on Tuesday. Two weeks ago only cyber defenders in Google’s Fairwind Program could use it, and everyone else had a promise with no date. Now it is listed as stable on the paid Gemini API worldwide, and it is in the Gemini app for Google AI Pro and Ultra subscribers. Antigravity and AI Studio access is for Ultra only, and there is no free tier. The introductory price of $2 per million input tokens and $10 per million output runs until 30 November. On 1 December it doubles to $4/$20, Muse Wonder’s rate, so cost models should use the higher one. Output pricing counts thinking tokens. The 1M-token limit is one budget shared by input and output, so a long prompt leaves less room for the answer. Fairwind partners can still get a version without the cyber guardrails that the public model ships with. Gemini 4 Argon, Gemini API pricing

04

Claude Code & Coding AI

Claude Code Projects opened to every Pro and Max user on the waitlist on 9 October. In August one Claude Code session learned to message another by name; in a project, Claude does the coordinating itself. You describe the work in one ongoing conversation, and Claude starts a thread for each task and runs them in parallel, usually as cloud sessions, each on its own branch. Every cloud thread reads the same project memory, so a correction you ask Claude to remember reaches the threads that come after it. Team and Enterprise plans don’t have it yet, it isn’t in the terminal or the IDE extensions, and the limit is 200 new threads a day.

Each cloud session gets a fresh virtual machine with the repository cloned onto a new branch. Your GitHub token stays with a proxy outside the machine, and the session gets a short-lived credential that can push only to its own branch. Network access goes from None to Full, and the field guide warns: “Even at None, Claude Code still sends requests to the Anthropic API, so data can leave the VM that way.” Project threads run in auto mode, and with several repositories on Anthropic’s hosted environment, “no repository’s permission rules reach a cloud thread”. If a deny rule is what keeps an agent away from something, keep that project to one repository. Claude Code Projects, cloud sessions field guide

Claude Code releases from 9 to 15 October (2.1.296 to 2.1.301) include one change that can break a working setup: MCP allow rules now reach only the server they name, so mcp__a no longer allows a server called a__b. If you relied on the old matching, write mcp__<server>__* with the server’s full name. Another round of sandbox fixes landed too, including one where a sandboxed command could write into a --plugin-dir folder whose code then ran outside the sandbox. As with last week’s fixes, update before you rely on a guard. OpenTelemetry events now carry the auto-mode classifier’s verdict, so an audit can tell a call auto mode approved from one your permission rules allowed. Edit and Write used to mangle files in older encodings like Windows-1252 or Shift-JIS, or silently convert them to UTF-8; both now refuse, which matters for legacy code. Claude Code releases

code-modernization, Anthropic’s official plugin for moving legacy codebases to newer stacks, reached version 1.0 at the end of September. It won’t call a migration done until the old and the new code have run on the same inputs and their output has been compared, including at least ten new inputs nobody planned for, such as empty, huge or malformed records. Last month a paper found that coding agents rebuilding a feature mostly failed because they never checked what the working version did; this plugin makes that check compulsory. A script, separate from the model, reads the results and gives each module one verdict: PROVEN, PARTLY PROVEN or NOT PROVEN. Six decisions stay with a person, among them approving the plan, signing the proof and applying the security patch.

Anthropic’s own COBOL test run ended NOT PROVEN: a monthly interest job was rewritten in Java 21, and the final check, with fifteen malformed inputs, found seven more differences from the COBOL original. A bank wants to hear about those seven from a test report, long before anything reaches production. The plugin installs with /plugin install code-modernization@claude-plugins-official. Usage counts are on by default (whole numbers only); CODE_MODERNIZATION_TELEMETRY=0 turns them off. Rule extraction started 50 to 200 agents in Anthropic’s runs, so pilot it on one module first, as the README suggests. code-modernization

05

Fresh Papers

Diff Diffusion, from ByteDance (13 Oct), speeds up the small edit suggestions that pop up in an IDE while you type. Most of an edited snippet stays the same, yet a regular model still retypes all of it token by token. Diff Diffusion marks each existing token as keep, delete, insert or replace, then fills the gaps in a few parallel passes. ByteDance A/B-tested it in a live IDE feature against its usual model: suggestions arrived about 40% faster (71 ms instead of 116 ms at the median), and developers accepted just as many. The paper covers only small in-editor edits, with no repo-wide changes or agent workflows. In February we covered Mercury 2, a model that writes many tokens at once; Diff Diffusion brings that idea to editing code you already have. Diff Diffusion

06

Worth Reading

BBC Future published Thomas Germain’s piece on the argument around a line Anthropic added to its usage policy on 8 October. From 12 November, sustained and needless cruelty toward Claude is banned. Venting and frustration are fine. If someone keeps being cruel with no purpose, Claude ends that conversation, and their other chats carry on as normal. Claude has been able to end conversations since August 2025. Anthropic thinks there is a chance some AI models are conscious, and Germain spent a week asking technologists, cognitive scientists and philosophers whether that holds up. Jeff Sebo of New York University puts the chance of AI consciousness low but “plausibly non-negligible”, and compares the policy to the small precautions people take when extreme weather is unlikely but possible. Mustafa Suleyman, who runs Microsoft AI, argues that models told they have feelings and rights would be harder to control, enough to make them “a catastrophic threat to human civilisation”. Andrzej Porębski, who studies AI and law at Jagiellonian University in Kraków, warns that the belief could help companies dodge legal blame with excuses along the lines of “It’s not us, it’s the AI”. BBC Future, MacRumors on the policy

07

AI at Tenvalleys

Tenvalleys is now a Select Partner of both OpenAI and Anthropic, and the second company in Poland to hold both.

In August we passed ten Claude Certified Architects, the first step toward Anthropic’s Claude Partner Network. Anthropic grants Select status on three verified requirements: at least ten people with a current Anthropic certification who actively work with Claude, at least two clients running Claude in production, launched within the last twelve months, and at least one client willing to vouch for that work publicly. We now have more than 20 certified engineers, and the next production deployments are already underway.

For clients, the two partnerships back up the promise we make every one of them: no vendor lock-in. A bank or insurer working with us does not depend on one provider’s pricing, roadmap or outages. Each use case gets the model that fits it best, and when the market shifts, the solution can move to another model with its governance and audit trail intact.