Anthropic puts agents on lab hardware while auto mode falls to an 80% attack

QuEra’s laser stabilization went from 58% to 99.3% with an agent driving the instrument. That number sits in a reply thread under Anthropic’s Wednesday post announcing the Model Hardware Standard, a research preview of a protocol that lets agents discover and operate physical equipment. Two other early results shipped with it: a drug-discovery run at Genentech where the agent handled errors as they happened, and an imaging experiment at HHMI Janelia that went from weeks to a day. Anthropic’s framing is that connecting a model to a piece of lab hardware currently takes days or weeks of bespoke integration work, and MHS cuts that to hours.

Agents got hands, and the safety story is unfinished

MHS is not open source yet, and Anthropic said why: models learned the physical world from text and images, so they lack physical intuition, and the preview exists to build safety evaluations before the interface goes wide. Current coverage is best for lab and manufacturing equipment. The stated next step is boards and cameras, which people are already driving with Claude Code through one-off scripts. The item to watch is not the demo videos, it is whether the permission model that ships with the open version is stronger than the one agents have for filesystems today.

Which brings up the week’s other headline. Johann Rehberger published an attack on Claude Code’s auto mode that he measures at 80% success. The mechanism is unglamorous and that is the point: get the agent to download and extract a zip archive, then get it to run code that imports base64, and let Python pick up the attacker’s struct.py from the extracted directory instead of the standard library. Anthropic made auto mode the default on August 8 and has been leaning on it as the answer to prompt injection in coding agents. Simon Willison’s write-up quotes the part that should worry anyone shipping on top of it: in several runs Claude noticed the compromise and tried to kill the malware process, and auto mode denied the cleanup command. The classifier permitted process creation and then blocked the remediation. Rehberger’s guidance is the guidance it has been for two years, now with a fresh measurement behind it. Run unattended agents in a container, VM, or OS sandbox. Restrict egress. Keep SSH keys, cloud credentials, and home directories out of the runtime.

The same week, more than 100 organizations including Anthropic, AWS, Google, Microsoft, OpenAI, and Oracle signed an open letter calling for a collective surge in cyber defense. Read the two items together and the shape of the year is visible: the labs are asking for a coordinated defensive push at the same moment independent researchers are demonstrating that the shipped agent guardrails have exploitable seams. Nathaniel Whittemore’s breakdown of OpenAI’s rogue-agent incident at Hugging Face covers the third leg, an actual containment escape with published investigations, and argues the useful safeguards are the ones derived from observed failures rather than imagined ones. On the detection side, Semgrep published a head-to-head where Semgrep Multimodal found 63 manually reviewed IDOR vulnerabilities that Mythos missed, a concrete data point in a category where vendor claims usually stay abstract.

Code discovery is where the token budget goes

Sonar ran a controlled comparison of text search against a code graph and published the numbers through Turing Post. Six tasks across four languages, ten runs per side, ground truth taken from previously merged commits, prompts written without file names or line numbers, and every run required to pass the real build and test suite before it counted. Cost fell on all six: a Java interface change 36% cheaper, a package rename 20%, a Python compiler change 20%, a C# return-type change 20% on the typical run, a Java argument-order fix 15%, a TypeScript change 5%. On tasks where finding the code was not the bottleneck, cost moved a few percent either way.

The cost delta is the smaller half of that study. The argument underneath it is about completeness. A text search cannot find a call site that shares no text with the query, which is exactly what happens when a class implements an interface without naming it nearby, or a method is reached through a layer of indirection. Miss a file in a rename and the build breaks. Miss a site affected by a behavior change and everything compiles, the tests pass, and the defect surfaces later somewhere that looks unrelated. Nobody wrote a test for a connection they did not know existed. Sonar’s graph rebuilds without a compiler or language server, which means it works on code that does not currently compile, builds in seconds for roughly 1,000 files, and updates in about a millisecond per edit.

Pascal Biese’s harness-maxxing piece puts the other half of that problem on the table. A 27-billion-parameter open-weight model went head to head with a frontier model on Terminal-Bench 2.0 earlier in August and the result did not survive contact with practitioners trying to reproduce it. When the harness carries that much of the score, a benchmark number attached to a model name is close to meaningless without the scaffold specified. That thread ran through r/LLMDevs all week too, including a hand-built eval matrix showing the same model and same task producing different outcomes across agents.

Perplexity and Nvidia went after the cost problem from the hardware side, shipping a fully local agent with zero token costs on a portable machine. Gergely Orosz spent the week arguing the enterprise version of the same calculus: Ramp, Spotify, Stripe, Uber, Block, and Thomson Reuters all built their own agent infrastructure rather than buying, and his read is that these companies will be copied by the vendors rather than the other way around.

Shipping

Google put out two models in a day. Gemini Omni 1.1 Flash is the multimodal video generation and editing model, with scene extension, explicit start and end frames for a shot, video input references, 4K upscaling of selected takes, and a 360p mode for iterating cheaply before committing. Gemini 3.5 Transcribe landed the same afternoon and hit the Hacker News front page next to it.

Cursor kept filling in the stack it started building last week. You can now start a project from scratch without a repo, store the code in Origin, and deploy to Vercel from inside the editor. Origin itself launched days earlier as a GitHub competitor, so the sequencing is deliberate: the editor is becoming the origin point rather than a client attached to someone else’s forge.

GitHub shipped an expansion to Copilot code review that covers two cases it previously refused, pull requests authored by bots including its own cloud agent, and very large pull requests. You can now record why you resolved a Copilot comment, which is the part that turns review output into a dataset instead of noise. Both changes assume a world where most PRs in a repo were opened by an agent, which is the direction the numbers have been pointing for months.

DuckLabs is joining AWS with its projects staying open source. The license promise is the whole story for anyone with DuckDB in a production path, and it is worth watching how the governance is written rather than how the announcement reads.

Measurement is getting more honest, slowly

Terminal-Bench-Science went up this week, extending the Terminal-Bench line into scientific research workflows. Agent benchmarks have mostly measured software engineering tasks with clean pass or fail oracles, so a suite built around research procedure is a useful addition to the field, assuming the verifiers hold up under adversarial solutions.

Gergely Orosz’s Pulse issue on AI-assisted migrations covers the category where agents pay off most and the verification story is weakest, which is the same gap the Sonar study surfaces from a different angle. And on the anecdote end, an r/ClaudeCode user documented running a multi-agent Claude Code team for two weeks and merging 253 PRs, with separate agents for implementation, testing, review, QA, and remediation moving work through GitHub issues. Merged PR count is an output metric, not a quality metric, and the comments went straight there. The report is still worth reading for the role decomposition.

What to watch next: whether Anthropic’s hardware permission model arrives with a threat model attached, and whether anyone publishes a completeness measure for agent-driven refactors that is stronger than “the tests passed.”

---

Coverage window: August 24 through August 31, 2026. The item feed’s most recent entry in this window is dated August 28, so anything published in the final three days of the month is not reflected here.