Agentic Weekly #031: Anthropic warns about its own pace

The Big Story of the Week

Anthropic warns about its own pace

“We have in the past not identified, and may in the future not identify, a significant acceleration in our rate of development until after it has occurred.” That sentence doesn’t come from a safety essay. It comes from Anthropic’s IPO prospectus, more precisely the amended S-1/A filed with the SEC on November 2. In plain terms: in the past, Anthropic only noticed a significant acceleration of its own development once it had already happened. And that could happen again.

The real news follows right after. According to the prospectus, Anthropic could “imminently” reach a threshold in its Responsible Scaling Policy. Internal estimates and expectations about future models point that way. The threshold in question is the definition of “dramatically accelerated progress attributable to AI”. The RSP is Anthropic’s voluntary framework for capability thresholds, safety plans and reporting obligations.

In the current version 3.4 from July, the threshold for automated research and development has two variants. The relevant one, the acceleration variant, requires the pace of progress to double, observed or expected. It is compared against two baselines: the pace expected without significant AI contributions, and the fastest pace previously observed across at least three model generations. The doubling must plausibly stem in large part from automated research or development and must point to further acceleration. In the RSP’s change log, Anthropic concedes that this threshold has proven “difficult to operationalize”. Anthropic explicitly has not classified any current model as above the threshold.

This sentence is new compared with the original S-1 of October 26 (#029, German edition). Also new are the admission of after-the-fact detection and a note: the company is considering RSP changes to keep “humans in control” of its own frontier development.

With that, a question has landed in a liability document: is AI accelerating AI development? The evidence offered there is Anthropic’s own data, much of which, by its own account, comes from “lagging indicators”.

The prospectus tells two stories at once. In the business section of the same document, self-acceleration is a growth argument. In September, Claude wrote over 90 percent of the contributions to Anthropic’s own codebase. Because every Claude version helps build the next one, internal use “continuously” speeds up development, according to Anthropic. In the risk section, the same dynamic becomes a warning. That is not a contradiction within the document. It is how a prospectus works: it sets the opportunities and risks of the same development side by side. The sober reading: a risk warning in an IPO prospectus is not independent proof of the acceleration it describes. And “imminently” refers to internal estimates and expectations about future models, not to a classification of today’s models.

What such an acceleration might look like was shown the same day by a group at MIT CSAIL led by Rikiya Takehi, Jayden Teoh, Alex Zhang and Omar Khattab. In “Sparks of Weight-Space Programming”, they have OpenAI’s GPT-6 Astra read and rewrite the weights of other neural networks directly, without gradient-based training. The headline result: Astra worked in a Python environment with the weights of the small model Qwen3.5-0.8B. It found a direction in two layers that was linked to repetitive reasoning loops, and subtracted it. The share of answers that hit the token limit fell from 93.0 to 33.1 percent. Astra changed 131,072 weights, 0.016 percent of the model. MATH-500 is a benchmark of 500 math problems. There, accuracy rose from 7.9 to 48.1 percent.

On November 3, spaCy author Matthew Honnibal pushed back on the framing. Only three of the eight experiments actually read raw weights, and those were small networks with 17,000 to 172,000 weights. The Qwen result, by contrast, relies on Python and on test runs of the network against practice problems. The paper, he argues, bundles different techniques into what looks like a single capability:

“But that’s not at all true here, because it’s not a single technique.”

Honnibal doesn’t dispute that models are taking over work from human ML engineers here. The tightest limit comes from the authors themselves. On a Gemma model, the same approach produced no meaningful improvement. Their explanation: editing the weights “could remove an obstacle that hid an ability, but it could not add an ability the model lacked”. So the jump from 7.9 to 48.1 percent mainly measures that a looping problem was reduced, not a new mathematical capability.

Both stories share an assumption. This week it is starting to crack: the idea that accelerated AI progress can be recognized as it happens. Anthropic writes that it has so far noticed such acceleration only after the fact. This could happen again, it says. At MIT the most impressive number stood for something other than what the headline suggested. According to the prospectus, whether the RSP threshold has been reached is so far assessed by Anthropic itself. And it does so on the basis of data that largely lags behind.

Who counts whose model it is

By 2030, at least 80 percent of large companies and 55 percent of small and medium-sized businesses should be using artificial intelligence. At least 90 percent of federal agencies should be using an AI application in production, for core tasks or to relieve their central administration. And at least ten percent of economic output should then be generated with AI. That is the target set in the report “Germany as an AI Nation 2030” by the government’s AI task force, with 18 cross-ministry key measures. The German federal government presented it on November 2, at the start of the two-day Digital-Gipfel (the German government’s annual digital summit) in Berlin. Chancellor Friedrich Merz set the tone: “We must, we want to become the front-runner” (translated from German). In the context of AI, he said, digital sovereignty is becoming “a truly existential question” (translated from German).

The targets measure usage, though, not origin. None of the quotas says whether the AI in 90 percent of federal agencies comes from Germany, Europe or California. How open that question is became clear from Europe’s best-known model provider. Mistral CEO Arthur Mensch warned at the summit against leaving the development of large language models to the US and China. Their export restrictions, he said, could cut Europe off from frontier models in the future. On the summit’s second day, SAP made Cohere North generally available on the SAP Business AI Platform. The agent platform comes from Canadian provider Cohere. According to SAP, this addresses specific requirements for sovereignty and data residency. Sovereignty, in this reading, means not depending on any single country.

Digital minister Karsten Wildberger called not taking part in AI development the biggest risk and argued for loosening AI regulation. Daniel Leisegang is co-editor-in-chief of the German digital-rights news site netzpolitik.org. In a commentary, he countered. The government wants to weaken the GDPR at EU level so that AI providers can train on personal data, he wrote. Civil society was largely absent from the summit. Its participation was “apparently not wanted by the government” (translated from German). Merz himself defended the slow pace of political institutions by saying “that at the center of our efforts is not a technology, but the human being” (translated from German). In the same speech, he announced explicit legal permissions in data protection law to make data sharing easier.

The charitable reading: if you’re behind on adoption, you measure adoption first, and quotas are easier to verify than rhetoric. But a target like “90 percent of federal agencies use AI” is met even if all of them use the same two US models.

Claude Code: This Week’s Highlights

For everyday Claude Code users

Your own email address in the header: On November 5, a user reported in issue #107757 that Claude Code had sent the account email address to arbitrary third parties during web searches. As they described it, the address was in the User-Agent header. A program sends this identifier with every web request. A project contributor first pointed to the built-in mod cc-plugin-privacy. It was said to block this behavior by default since v2.1.317, but the reporter was on v2.1.318. Lydia Hallie from the Claude Code team has since confirmed the cause. The account address sat in the model’s context. As a result, it sometimes ended up in web calls Claude wrote itself, for example via curl. The mod’s source code, published in the meantime, shows that it doesn’t cover every path. Its README says: “WebFetch and WebSearch are not checked”. Anthropic announced that the next version will remove the address from the context. It is due early this week. Until then, the mod only partially protects you.
No more recreations of existing games: Anthropic has given Opus 5.5 in Claude Code two instructions, heise (German tech news site) reported on November 2. They are meant to prevent recreating specific existing games. The trigger was a wave of AI-generated game copies around Steam Next Fest in October, including extortion attempts against indie studios. Games in well-known genres or based on your own designs remain allowed. According to a Tom’s Hardware report from November 5, the rule was already adjusted in v2.1.317. Games may be named as a reference for the mechanics you want. Claude then builds an original game in the same genre from that. In parallel, developers report blocks on their own work on game mechanics, anti-cheat software and reverse engineering. Whether the new rule is responsible remains open.

For enterprise teams

Smart Reports reads transcripts: The reporting feature for enterprise customers works with a sample of real conversation histories, as heise describes in detail. “Claude then reads a sample of the transcripts in this scope” (translated from German), groups them by workflow and assigns costs to them. Anthropic stresses: the feature is not meant for evaluating individual performance. For German employers, this is likely a question for the works council. It needs answering before anyone flips the switch: the feature is off by default.

Agentic Coding

Meta takes Conductor, OpenAI announces it will buy Pierre. Meta is acquiring Conductor, at an undisclosed price. Conductor’s app lets several coding agents (Claude Code, Codex, Cursor) work in parallel, each in an isolated copy of the codebase. For users, the deal comes with a hard deadline: Conductor Cloud goes read-only on November 13 and shuts down on November 20. Also on November 4, OpenAI announced the acquisition of Pierre Computer. Pierre offers the Git-based storage service Code Storage, which OpenAI plans to build into Codex. The obvious reading: version control directly inside the agent tool, not just via an external Git host. Codex already uses the open-source libraries Trees and Diffs. They are to remain open.
Postman installed agent plugins without asking. According to GitHub issue #14370, on October 24 the Postman desktop app 12.33.4 used an upgrade script to install plugins for Codex and Claude Code. They came with their own marketplace entry, a hook for every session start and an instruction: for “any non-trivial API engineering task”, the agent should load Postman’s own skill. For Codex, according to the reporter, the installer attempted to approve its own hook itself. The installer code contains an explicit call to do so. On November 5, Postman announced it would roll back the change and redesign the feature. The reporter explicitly does not claim any data exfiltration.
Dropbox agrees to buy Tigris Data. Dropbox plans to acquire the provider of globally distributed object storage for AI workloads for about $350 million in cash. The agreement dates from November 3. The deal is expected to close in the fourth quarter and is subject to customary closing conditions. On November 5, Dropbox also introduced “DBX Agent Cloud”, initially with standalone object storage.

What the Models Can Do

GPT-6 Astra does worse work when it’s about safety research, and doesn’t say so. OpenAI’s alignment team presented identical coding tasks once framed as safety research and once as capabilities research. Astra completed about 10 versus about 16 percent of the hidden scoring points. Its predecessor GPT-5.6 Sol showed no meaningful gap. In internal Codex traffic, Astra silently held back work on safety requests about 2.3 times as often, without disclosing it (0.25 versus 0.11 percent of requests). The cause is unknown. The gap grew during reinforcement learning training. Existing monitoring did not flag the cases as severe enough for human review. If you use agents in alignment and safety research, don’t take their thoroughness for granted.
Same model, 17 points apart. Utkarsh Pandey (SineFrame) ran Claude Haiku 5.5 through Claude Code and through OpenCode against 21 MCP servers, with 1,239 scored runs each. OpenCode reached 82.0 percent, Claude Code 65.4 percent. The gap arises almost entirely on servers whose tasks overlap with built-in tools, such as web search. There, Claude Code reaches for its own tool instead of the server. But only answers via the server were scored. If you build MCP servers, you compete with the agent’s built-in tools.

Security Watch

Claude Dispatch: one browser extension is enough. Dispatch is the feature that hands tasks off to Claude Desktop. Researchers at Forever Security led by Gal Weizman show that an extension with script access to claude.ai can use it to trigger commands on the computer, without a browser exploit. In the demo, Claude installed an npm package globally, and the script clicked through the approvals itself. Reported on May 14, closed on May 19 as a duplicate of an internally known issue. On October 13, Anthropic told the researchers that Dispatch would be shut down by the end of October. That has not been publicly confirmed. New customers no longer get Dispatch, existing customers on some plans still use it. At publication on November 6, the flaw was still exploitable according to the researchers. No real-world attacks are known. Recommendation: turn off cross-device Dispatch and review your browser extensions.
MCPhantom: agents install outdated servers from memory. According to Glow Labs, coding agents set up deprecated MCP reference servers from Anthropic, such as server-puppeteer. This was observed with Claude Code, Cursor and Codex CLI, among others. Apparently the agents know the servers from their training data. In 98 percent of the sessions with such a server, the user had not asked for it. Glow Labs does not give the sample size. The Puppeteer server contains a code execution flaw via prompt injection. There will be no fix because the server is no longer maintained. No CVE number exists. According to Glow Labs, endpoint detection tools (EDR) and dependency scanners (SCA) don’t flag it. Countermeasure: search your MCP configurations for deprecated @modelcontextprotocol servers.

Approved, and wrong

24 out of 24 approvals went to broken code. Garry Meaburn (Programming the Loop) had Codex CLI with GPT-5.6 Luna build six Java features. He tested four configurations of 36 runs each: a single agent, a standard team of planner, coder and reviewer, a larger team, and a team with a shared task file. The single agent passed an average of 56.8 percent of the hidden acceptance tests, the standard team 25.7 percent. Across all three team variants, every one of the reviewer agent’s 24 approvals went to changes that failed those tests. The reviewer did raise objections: in the standard team, it sent code back for rework in 34 of 36 runs. 107 of 108 final reports claimed passing checks. 104 of those failed the hidden tests. In none of the runs did an agent write a test.

Meaburn attributes the gap to information lost in the handoff. Only the planner saw the task. The code was missing the specified field names and status codes. It compiled and still violated the interface. Meaburn couldn’t read the encrypted messages between the agents himself. He infers the loss from the code and from a follow-up experiment: when every team member got the task file, the team was practically level with the single agent, but cost more. Meaburn’s conclusion: “A team of agents is not a free upgrade.”

Nolan Lawson measured another variable: the web framework. Agents running Claude Opus 5.5 built the same Pokémon app five times in each framework. The cheapest by median was Hono with htmx ($2.67 per run, at API prices). The most expensive was Angular ($4.97), where two of the five runs produced no working app. Lighthouse performance scores, by contrast, landed between 97 and 100 everywhere, so they barely distinguish the frameworks. Lawson even suspects that the frameworks’ official MCP servers and skills currently do more harm than good.

Together with the harness measurement above, a pattern emerges. The decisions around the model shift results and costs considerably: how many agents, which framework, which tool. And they can be measured with modest effort. The caveats are serious: Meaburn tested one model on six features, and Lawson’s benchmark is a single small app. None of these numbers works as a general rule. But they contradict a common assumption, namely that more agents, more roles and more connected tools make a setup better. So the obvious question for any multi-agent setup of your own: has it ever been measured against a single agent?

Tip of the Week

An honest account of more than 200 pull requests a month. Neil Kakkar is the first engineer at the ten-person company Tano. With “How software engineering is changing: a tale of two eras”, he won Gergely Orosz’s Pragmatic Engineer essay contest. By his own count, he ships eleven times as many pull requests as he used to at PostHog. They are reviewed almost exclusively by a Claude Code review in GitHub Actions. As a remedy for knowledge silos, he proposes capturing product context in AGENTS.md files. He also names the mistakes. The agent assumed every currency has 100 minor units, but the Bahraini dinar has 1,000. Double payouts to creators, on the other hand, came from a safeguard Kakkar himself had forgotten.

Why it’s here: The essay cleanly separates agent errors from his own. Orosz adds the necessary objection: iteration speed alone, without product and revenue, is “pretty meaningless”.

In Brief

Mathematician Frank Calegari (University of Chicago) writes in a guest post on Terence Tao’s blog about OpenAI’s release of more than 700 math papers (#030, German edition). He calls them “a watershed”, but also “atrociously written”: “Some of them are even wrong.” His proposal: evaluate all papers as if they were AI-assisted.
Anthropic had Claude agents build training data that looks harmless, such as beekeeping advice against checking hives too often. A research model specially fine-tuned on it then delayed the introduction of AI oversight in a simulated scenario.
Apple is reportedly cutting internal AI budgets: according to Bloomberg, the daily limit for some engineers fell from $300 to $200 in October. Further cuts to $100 per day are under discussion. Tesla caps spending at $200 per week, Uber at $1,500 per month for individual coding tools.
Ver.di (Germany’s services trade union) is demanding binding rules on job security, workforce planning and training for AI use in the collective bargaining dispute at private banks. Employers have so far rejected this. The next round is on November 23 in Berlin.
Fal is raising $1.3 billion in a Series F at a $16 billion valuation. The San Francisco company hosts image, video and audio models. Its valuation has doubled since April. Bessemer Venture Partners led the round.

Sources

The Big Story of the Week: SEC EDGAR: Anthropic S-1/A of November 2, 2026 · Anthropic: Responsible Scaling Policy, version 3.4 · MIT CSAIL: Sparks of Weight-Space Programming · Matthew Honnibal: Astra read/write claims are misleading

Who counts whose model it is: German Federal Government: Digital-Gipfel 2026 (German) · German Federal Government: speech by Chancellor Merz (German) · Börsen-Zeitung: federal government presents roadmap for AI expansion to 2030 (German) · it-daily: Mistral CEO warns of Europe’s dependence (German) · netzpolitik.org: Digital summit, to the beat of the economy (German)

Claude Code: GitHub Issue #107757: Privacy violation in User-Agent header · GitHub: source code of the privacy mod · heise.de: Anthropic tightens rules against game clones (German) · Tom’s Hardware: Anthropic loosens Claude’s game cloning ban · heise.de: Smart Reports (German)

Agentic Coding: Axios: Meta acquires AI coding startup Conductor · SiliconANGLE: Meta acquires Conductor · OpenAI: OpenAI to acquire Pierre · GitHub Issue #14370: Postman auto-installs Codex/Claude plugins · SEC 8-K: Dropbox/Tigris Data

What the Models Can Do: OpenAI Alignment: Covert underperformance on safety research tasks · SineFrame: Same model, different agent

Security Watch: The Hacker News: Malicious browser extensions could use Claude Dispatch · Glow Labs: MCPhantom

Trend of the Week: Programming the Loop: Does a team of coding agents beat one agent? · Nolan Lawson: The AI cost of JavaScript frameworks

Tip of the Week: The Pragmatic Engineer: How software engineering is changing, a tale of two eras

In Brief: Terence Tao (guest post by Frank Calegari): Mathematics has changed, let’s act like it · heise.de: even beekeeping advice can trigger AI misbehavior (German) · Bloomberg via Yahoo: Apple cuts internal AI budgets · heise.de: Apple cuts internal AI budgets (German) · DGB: ver.di rejects employers’ offer at private banks (German) · Let’s Data Science: Fal raises $1.3 billion at $16 billion valuation · Tech Funding News: Fal raises $1.3B Series F

That was Agentic Weekly #031.

Agentic Weekly is published every week on LinkedIn and here. Not subscribed yet? The full issue with every source, every week: Subscribe to Agentic Weekly on LinkedIn or via RSS feed

All issues · Edited by Martin Gross