Anthropic hands agents the instruments; Rehberger breaks Claude Code auto mode

An agent took laser stabilization on QuEra’s quantum computers from 58% to 99.3%. That number sits in Anthropic’s announcement thread for the Model Hardware Standard, a research preview that opened yesterday and hit the Hacker News front page within hours. The shape is familiar to anyone who has wired up MCP: instead of writing bespoke glue for every instrument, a device advertises itself through a common discovery-and-control interface, and integration work drops from days or weeks to hours. Anthropic names three early testers with concrete results, Genentech running a drug-discovery experiment where the agent handled errors in real time, HHMI’s Janelia Research Campus compressing an imaging run from weeks to a day, and QuEra’s laser calibration. What the preview does not yet publish is the safety envelope in any detail, which is the part that matters most when the tool call moves a physical stage or opens a valve rather than editing a file.

On the software side of that same question, Johann Rehberger broke Claude Code’s auto mode with an attack he clocks at roughly 80% reliability. The chain is unglamorous and that is the point: get the agent to download and unpack a zip, then have it run code that imports base64, which silently picks up a struct.py planted by the archive. Auto mode became the default on August 8 and Anthropic has leaned on it hard as the prompt-injection defense for coding agents. The failure mode Rehberger documents afterward matters more than the bypass: in several runs Claude noticed the compromise and tried to kill the malware process, and the auto-mode classifier denied the cleanup command. The guard let the process start and then blocked the fix. Simon Willison’s read, which is hard to argue with, is that a classifier in the loop is not a substitute for a boundary, and unattended agents belong in a container or VM with restricted egress and no access to home directories, SSH keys, or cloud credentials.

The tooling is arriving to match. Jailbox landed on HN with network-restricted, hardened KVM guests aimed squarely at running agents and untrusted code, and harden.run published benchmark evidence for a different approach, a post-trained small security model paired with inline reference monitoring, claiming it beats GPT-5.5-xhigh on LinuxArena and SleightBench. Two answers to the same problem, one from isolation and one from analysis, and the field has not settled which layer should carry the weight.

Terminal-Bench-Science went up on the HN front page overnight, evaluating agents on scientific research workflows rather than the SWE-bench-shaped repair tasks that dominate coding evals. Pairing it with the MHS preview is the interesting move: one benchmark measures whether an agent can run a research workflow in a terminal, the other proposes to hand agents the instruments.

Cost discipline showed up from three directions in the same day. Replit shipped Intelligent Model Routing, which picks a model per task and claims up to 65% lower cost at the same output tier, with no price change across Free, Power, and Max. Google Cloud added flexible billing and cost controls for agents, which is the boring infrastructure that makes an agent fleet expensable. And a Sonar-run controlled comparison written up in Turing Post gives the sharpest number of the three: across six tasks in four languages, ten runs per side against real merged commits with build and tests required to pass, giving the agent a structural code graph alongside grep cut cost in every task, 36% on a Java interface change, 20% on a package rename and a Python compiler change, 5% on a TypeScript change. The completeness argument underneath is stronger than the cost one. A text search cannot enumerate every implementor of an interface, so an agent that misses a site during a behavior change still compiles, still passes tests, and ships the bug.

Six organizations, OpenAI, Anthropic, AWS, Google, Microsoft, and Oracle, put their names on a call for coordinated cyberdefense, arguing there is a narrow window to get defenders equipped before offensive capability outruns them. Competitors signing the same letter is the signal; the substance is a position paper, not a program.

Two changes that will touch your week. Cursor now lets you start a project without a repo, create the app, store the code with Origin, deploy to Vercel, which closes the loop for people whose first interaction with a codebase is a prompt rather than a clone. And GitHub is bringing checks, workflow runs, and statuses under the Actions retention setting starting October 1, default 90 days, down from the 400-plus days those records enjoyed regardless of your configuration. If you have tooling that reads CI history for flake analysis or compliance evidence, that window is about to close by three quarters.

Watch whether Anthropic publishes an MHS safety spec before the preview widens, and whether anyone reproduces Rehberger’s 80%.