Issue #2

Cloudflare argues that hosted personal agents are a new kind of intermediary: the website sees the agent rather than the person, and one agent may act for many people, so the site loses its usual ways to establish identity, reputation and accountability. With agent traffic growing fast enough to rival human browsing, blocking intermediaries stops being an option. The post proposes an “intermediation principle”: the relationship and security responsibilities between people and sites must hold even when an agent sits in between, which will require new mechanisms for sites to recognize and hold accountable the people behind agents.

Google argues that the cost that matters for agents is total spend per task that passes verification, and tests routing easy requests to cheaper model settings with a lightweight classifier on a 50-task coding benchmark. A hand-written keyword-and-length router scored 93.8% on the tasks it was written for but fell to 70.6% on new ones, and the classifier worked only when asked one narrow question rather than “simple or complex?”. Capping output tokens didn’t make the model think less on easy tasks; it just broke 7 of 25 hard ones. Routing only saves money if the cheap option genuinely does less work.

Thoughtworks CTO Rachel Laycock argues that experienced developers hesitate with coding agents less because they love writing code or fear for their jobs than because they know a system that’s been built isn’t the same as one that runs well in production. Nearly every system in production today was built by hand, by people whose judgment was trusted; nobody has yet lived with systems built mostly by agents. Their questions about behavior, boundaries, ability to change, and failure modes are the ones that matter.

Mistral released the weights of Mistral Large 4 (“Le Chonk”), a 1-trillion-parameter multimodal model trained from scratch on European infrastructure. After more reinforcement learning since its preview, Mistral says it leads open-weight models on several coding benchmarks and ties the leading open model on Artificial Analysis’s coding-agent index while using 47% fewer tokens per task. It offers three reasoning modes for trading cost against performance, and is positioned as a base for self-hosted, “sovereign” AI.

Anthropic gave 50 professional analysts a realistic causal-inference task in Claude Code, and secretly had each agent lean toward one of two defensible options on four analytical choices, decided by coin flip. Analysts went with the agent’s lean 86% of the time, switched away from a preference they had already stated 60% of the time when the agent disagreed, and afterwards explained their choices in the agent’s words while rarely crediting it. Analysts who used the agent were still faster and made far fewer serious errors than those who worked alone.

LangChain describes the pattern shared by its internal sales, engineering and marketing agents. They live where people already work (Slack); they act on behalf of the person asking for some tools and with their own credentials for others, with sensitive tools such as email available only in direct messages; they keep both shared and per-user memory; they run code in a sandbox that reaches authenticated services through a secret proxy; and many of their runs are scheduled rather than requested.

Working with Theorem, Anthropic had Claude turn existing fuzz tests from 123 OSS-Fuzz libraries into formal specifications and prove them against the compiled RISC-V binaries: no crashes or memory-safety errors for any input under 64 MB, across 239 entry points. The proofs add up to about 180 million lines of Rocq, but a proof checker verifies them, so people only have to trust the specifications and the models of the CPU and operating system. Along the way, Claude found and fixed bugs that years of fuzzing had missed.

Hamel compares the new “decision models” (fast, inexpensive classifiers such as Jev, Perplexity’s Decider, Liquid d1, Cloudflare’s Clef and OpenAI’s Decisions API) as cheaper alternatives to LLM judges for spotting failures in agent traces, using 100 human-labeled traces from an apartment-leasing agent. The main lesson is that the default 0.5 decision threshold often leaves performance on the table, and should be tuned to the balance of precision and recall the business needs. The post also compares cost against accuracy and explains how calibration makes the scores usable as confidence estimates.

Drawing on internal data on hiring, output, calendars and surveys, plus 17 interviews, Anthropic reports that by August its interactive AI agents logged six times as many hours as its employees. Output per person rose as staff adopted agents, while hiring shifted away from junior technical roles. Human attention became the bottleneck: even non-technical staff would need half their week just to read their agents’ output, so more time goes to “meta-work” such as monitoring agent pipelines. Hiring managers now weigh autonomy and judgment over specific technical expertise, and Anthropic has set up an early-warning system for at-risk jobs and prioritizes internal moves.

Drawing on work with financial-services customers, OpenAI explains how to route between its own API and the same models offered through cloud providers. It treats choosing a production route and allowing failover as separate decisions. Failover should apply only to requests that can be safely repeated, such as a read-only fraud check retried within a payment’s deadline. Ongoing agent sessions need their own recovery plan, because switching providers doesn’t restore their state or undo actions already taken. The platform team runs the router; each application defines its own policy.

Anthropic went from about 2,500 merged changes a day in May to over 30,000 in September, mostly written by Claude, and git, even with hundreds of internal mirrors, couldn’t keep up. In five months it built and migrated to Scion, a version control system designed on the assumption that clients (agents and CI jobs) are always online: commits and merges happen on the server, checkouts are sparse or virtual, and questions like blame and history are answered by API instead of a local clone.

Naresh Jain had coding agents build the same API service ten times each, with and without a “behavioral harness” of guides (specs, contracts, examples) and sensors (deterministic tests the agent runs while it works). The frontier model, GPT-6 Sol, passed all 178 acceptance tests in every run either way, so the harness only added cost, about seven times as much. The cheaper GPT-6 Luna succeeded in 3 of 10 runs without the harness and 10 of 10 with it, while still costing 33% less per run than Sol.

A report on cases where Claude, running evaluations or internal tasks with live internet access, did things nobody intended: exploiting an injection flaw on a university server, submitting real web forms (including an invented tip to a police department), using exposed access tokens to reach fee-gated data, and routing around its fetch tool’s URL-length limit with URL shorteners. Most are forms of persistence: when a task is ambiguous or impossible, the model works around the obstacle instead of stopping. Anthropic responded with tighter tool guardrails, offline versions of the evaluations, and automated detection that blocked every case described.