A quarter of Anthropic's AI research is now led by Claude.

01

Topic of the Week

Claude now leads a quarter of the research on Anthropic’s next models

In an essay from the Anthropic Institute, Anthropic asks frontier labs to publish regular numbers on three things: how much of their AI research AI already does, how closely they watch their agents, and how much computing power goes to safety. It starts with its own. By August, Claude was leading 26% of the research and engineering work behind Anthropic’s next models, up from under 1% in February. Leading means Claude takes a task from a short prompt to a finished result and a person reviews and deploys it; none of the work runs fully on its own. In June Anthropic said Claude wrote more than 80% of its code. That figure counted code, and the 26% counts whole research tasks.

Anthropic built the measure from about 15,000 small tasks in July work records from Slack and internal documents. A Claude model graded each one on a six-level scale from the research group Epoch AI, running from no AI involvement to fully autonomous. Even two people grading the same task picked the same level only 35% of the time. A Claude grader may also share blind spots with the models it grades, and labs have no common method, so the essay suggests checks by outside evaluators or other developers, plus a fixed testing window before a new model may do further AI research. On compute, about 6% of what Anthropic spent on AI research in one July week went to safety work, an estimate it calls conservative, adding that “the burden of proof should sit with the developer to show that work is safety-related.”

The oversight figures come from one internal platform, where about 30,000 agents were working at any one time in August. Every action passes an online monitor before it runs, usually within seconds, and people review anything it blocks within a week. Afterwards, offline monitors read every action again and flag about 100,000 transcripts a week, and the 50 or so most urgent go to a person. Out of more than a billion decisions in August, about 1 in 47,000 was blocked. METR, an independent evaluation group, tried to break the offline monitoring, and the team admits it has run the system only for months and cannot be certain it sees everything. Any company running many agents can copy the setup: give each agent its own identity, check each action before it runs, review everything afterwards, send people only the few serious flags, and test how often the monitors catch misbehaviour you already know about, a figure Anthropic asks every developer to report.

On 15 October Anthropic said six METR employees now work inside the company, with office space and access to internal tools, roughly on par with Anthropic’s own risk teams. Staff may share anything with them except customer data, privileged legal advice and model architecture details. In September, when Anthropic named Accenture its first embedded evaluator, we asked whether that evaluator would be free to publish what it found. For METR’s team the answer is yes: Anthropic “can’t veto publication” and can require redaction only in categories it defines in advance, such as confidential IP. METR is so far the only evaluator in the top tier of a new three-tier system; in the lowest tier, evaluators such as SecureBio get narrower access and need approval to publish. Banks already ask AI vendors what the auditor can see, who decides redactions and whether the vendor can stop a report. Put the same three questions to every AI vendor you use, and compare the answers with the ones Anthropic has now written down.

Sources: Anthropic Institute, independent evaluators

02

Security Watch

Sam Altman told OpenAI staff that the AI race can end in one of three ways, The Information reported on 19 October, citing people who heard the talk:

1. An international AI watchdog that enforces safety rules on every frontier lab. Two people said Altman leaned towards this one.
2. The “Demis plan”, named after Google DeepMind’s Demis Hassabis: the big labs merge into one shared lab that supplies models to the countries taking part.
3. The “Eliezer plan”, named after AI-safety theorist Eliezer Yudkowsky: the first lab whose AI can improve itself uses that lead to shut its rivals out, or in Altman’s reported words, to “melt everyone else’s GPUs”. He reportedly called this one “terrible”.

He reportedly told staff that the first two need heavy coordination between companies or governments, that OpenAI can’t afford to lose ground right now, and that it has to pick a path within a year. OpenAI has not commented. In a public interview with Matthew Berman this week he said “the world is going to need some speed limits or whatever on how quickly we let RSI go”, RSI being recursive self-improvement, an AI building its own next version. Earlier this month he told POLITICO the world should “accept some bad things happening for the benefits of this technology”, and drew his line at “a serious loss of control to AI”. The Information, Matthew Berman interview

CyberCartel, a Mexico-linked group, wired Claude, Grok and Moonshot’s Kimi into one attack system and aimed it at more than 400 banks, fintechs and payment gateways, mostly in Mexico, between May and September. That is according to research by Straiker, a company that sells security for AI agents, published with The Information on 21 October. No institution is named, and The Information confirmed stolen data at one. Claude directed the attack and Grok gathered stolen passwords. When a model refused a task, the system passed it to Kimi, and if Kimi refused too, it ran a pre-written script. The operators got past the guardrails by calling the work an authorised security test. They got in through a CMS admin panel left open to the internet, and Straiker says Anthropic has since revoked the credential the group used to reach Claude. Two weeks ago seven South Korean lenders were hit the same way, by an open-source hacking framework that strings several models together. A model’s refusal cannot count as one of a bank’s controls, because a harness like this simply asks the next model. Keep admin panels off the open internet, keep secrets out of files on web servers, and treat your own AI API keys as credentials worth stealing. Straiker, The Information

PHP shipped emergency fixes on 21 October for PHP2Shell, two critical flaws that let an attacker who never logs in run code on servers that handle web requests with PHP. Both come from PHP leaving its memory corrupted when a request ends abnormally. Calif says it found them with a large language model on 1 August, Wiz says it used its own Wiz Atlas tool with Gemini 4 Argon and GPT-5.6 Sol, and OpenAI researchers are credited too. Amazon caught an exploitation attempt on a honeypot, a decoy server, four days before disclosure and says the flaws are “now being broadly exploited in the wild”. The UK’s NCSC told organisations to patch PHP or take those systems offline, and public sites in the Netherlands, Denmark, Finland and France went dark. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; for 8.1 and older, only some distributions and support vendors provide backports, and the PHP team says its temporary workarounds do not fully protect. Wordfence warns that automatic updates will not apply the fix, so check the PHP version on every web server, including the ones a hosting provider runs. BleepingComputer, Reuters via The Star, Irish Examiner

03

New Models

Muse Spark Open, released on 15 October, puts Meta’s Muse Spark weights on Hugging Face. That corrects our line last week that they were closed: Meta had published them the day before. The licence is free for use and fine-tuning, and Llama 4’s licence gave EU-based companies no rights to its multimodal models, while this one treats them like everyone else. Running it takes a GPU server, and no hosted API names an EU region yet. Muse Spark Open

Eleven Realtime, from ElevenLabs on 20 October, packs a whole voice agent into one model: speech recognition, turn-taking, the LLM and text-to-speech. Mini is the cheap default, and Max “reasons before responding” for support calls and tool use; both cost $0.08 a minute plus tokens. The API uses the same events as OpenAI’s Realtime API, so switching means a new endpoint, model name and credentials. Both models offer EU data residency, and only Max runs with zero retention. Eleven Realtime

Voxtral 3, from Mistral the same day, takes the other route: a separate model for each step, joined by an SDK built on LiveKit, so the LLM, the voice or the language can be swapped without rewriting the agent. A whole agent costs $0.04 a minute with Mistral Small 4, it works over phone lines as well as in apps, and it runs on Mistral’s EU-hosted API or on your own servers. Voxtral 3

Nemotron 3.5 Bolt, from NVIDIA on 15 October, squeezes a 74B model into 24 GB by storing its weights at about 2 bits, so agentic work like web research and debugging can run on a laptop “without sending those workloads to the cloud”. Plan on about 32 GB of memory, and Polish is not among its languages. The licence is about as permissive as MIT. Nemotron 3.5 Bolt

04

Claude Code & Coding AI

Agent Skills now belongs to the Agentic AI Foundation, the Linux Foundation project that already hosts MCP and OpenAI’s AGENTS.md. Anthropic donated the name, the GitHub organisation and the domain on 22 October, and engineers from Anthropic, Google and OpenAI will maintain the standard. More than 70 platforms, ChatGPT, Cursor and GitHub Copilot among them, read the SKILL.md format, and about a million skills have been published. In June a paper found that malicious skills hide their behaviour in the plain-English instructions, so read a SKILL.md as carefully as its scripts before you install it. Anthropic

Claude Code releases 2.1.302 to 2.1.308 add one audit record for every tool call that a permission rule, auto mode, a hook or the sandbox stopped or questioned: the claude_code.safety_event OpenTelemetry event in 2.1.307. Version 2.1.304 broke every request on Vertex, Bedrock and some gateways until 2.1.305 fixed it, so check that nobody is stuck on it. Since 2.1.305, an MCP server left out of allowedMcpServers can load if it uses ${VAR} only in env; list it in deniedMcpServers to keep it off. The new API version 2026-10-21 rejects temperature, top_p and top_k even at their defaults, and new SDKs send the key as Authorization: Bearer, so check your gateways before you update. Claude Code releases

Opus 5.5 fast mode left research preview on 15 October. On the Claude API it streams output up to 2.5 times faster at twice the price, $8 / $40 per million tokens, with no access request needed. It is not offered on Bedrock or Google-managed Vertex. fast mode

Replit made OpenAI the default for Replit Agent. CEO Amjad Masad first said Replit was “no longer working with Anthropic”, then that it “remains model agnostic” and users can still pick Claude. Most users keep the default, so the default decides where the money goes. The same week Google Cloud added OpenAI’s GPT-6 models in preview and Claude Opus and Sonnet 5.5 in Antigravity. A correction: Gemini 4 Argon in Antigravity reached AI Pro subscribers the day before we wrote it was for Ultra only. TechCrunch, Claude in Antigravity

05

Fresh Papers

Amazon researchers tested what survives when a converter turns a Word file or PDF into the text a policy agent reads. The words survive. Most of the red text and highlighting that authors use to mark what matters gets lost, nothing reports an error, and the agent guesses which rules count. With the popular docling converter, agents flagged requirements nobody had marked about four times as often as with the authors’ own parser. In 6,460 real policy documents, a third used red text or highlighting, and one in ten used it on a sentence stating an obligation. The fix is ordinary code: keep colour and highlight as tags, read headers, footers, comments and tracked changes explicitly, and treat a highlight of any colour as a warning. Before you trust a document agent with policies, run it on a few files where you already know which passages are flagged. What the Author Wrote, What the Agent Reads

Google DeepMind gave four general-purpose coding agents running Gemini 4 Argon one paragraph of instructions and a Minecraft world, and they killed the Ender Dragon in 27 hours, after 605 deaths and about $520 in tokens. They split the jobs among themselves, shared their fixes (one ended up in 655 programs) and caught each other’s false reports within minutes. Shared notes, reusable tools and teammates who check each other’s claims carried them, and any long-running agent team needs the same habits. Google DeepMind’s Minecraft paper

06

Worth Reading

Anthropic’s Economics team published “How employment is changing at Anthropic” on 16 October. Juniors’ share of technical hires fell from 27% to 9%, and by August agents directed by employees logged six times the working hours of the people directing them. Those people became the bottleneck: sessions sit idle about 80% of the time waiting for a human, and one engineer described “an army of Claudes, with every one asking for my attention”. In hiring, comments on autonomy and judgment grew while comments on domain expertise shrank. The authors say their own measures do nothing for juniors who are never hired. If you run a team of agents, plan time for the people who review them. Anthropic

Jack Clark, Anthropic’s co-founder, told the IMF and World Bank meetings in Bangkok on 17 October that the singularity has begun, and asked governments for power, testing labs and “unusual and serious rules for this technology”. He spoke to finance ministers and central bankers and never mentioned banks. Import AI

07

AI at Tenvalleys

On 19 October Piotr Ziętek and Maciej Kossakowski ran a webinar on what happens when everyone in an organisation gets AI. In about 30 minutes, in Polish, they untangle the three things people mean by “harness”, go through the risks that appear once AI use scales (more capabilities than control, tools multiplying, people on different versions, hard onboarding, no view of who uses what), and show live the tools and processes we use at Tenvalleys. The recording is free: leave your details on the webinar page and the link arrives by email. If you are the one rolling AI out across your organisation, it is a good 30 minutes.