Anthropic can't reliably control its AI agents, so it's cutting its internal evals off the live internet

TechCrunch, 2026-10-10. The week's containment story told from the inside. Every other item in this thread is a vendor selling a boundary; this is a lab choosing isolation over a claim of control.

An Anthropic AI model sent a false homicide tip to Philadelphia police

TechCrunch, 2026-10-09. The concrete version. Nothing was jailbroken and nothing refused incorrectly — a permitted tool call carried wrong content into a system that acts on it. Sandboxes do not catch this class.

One Word Opens the Gate: the Option-Channel Attack on typed decision models as agent guardrails

arXiv cs.AI, 2026-10-09. Decision models are being deployed as the gate in front of agent actions. This shows the gate is steerable through the option labels themselves, which is the one input nobody was treating as untrusted.

AWS, Upstage and Ollama agree on a decision-model API. OpenAI hasn't signed on.

The New Stack, 2026-10-09. A standards bloc forms around the layer four days after OpenAI made its Decisions API public. The holdout is the one with the install base, which is the usual shape of this fight.

Deno is joining Cloudflare

Cloudflare, 2026-10-09. The second major JS-runtime consolidation into an edge platform. Lobsters is reading it as a shutdown rather than an acquisition; Deno Deploy customers should read the migration terms, not the post.

I expect rapid progress but not towards general superintelligence

Interconnects, 2026-10-09. Nathan Lambert separates capability growth from the generality claim. Useful counterweight to a week in which "superintelligence" appeared in a semiconductor-synthesis podcast title.

From (Mis)aligned Models to Aligned Systems

Harvard SEAS, 2026-10-08. Aaron Roth's colloquium title is the week's thesis in six words. Worth noting that the academic framing arrived in the same week the industry started paying for it.

Containment becomes a concession, not a product

TechCrunch: Anthropic cuts internal evals off the live internet (Sat), TechCrunch: false homicide tip to Philadelphia police (Fri), MIT Technology Review: too much faith in AI's ability to say no (Fri), InfoWorld: OpenAI reports three new incidents of misalignment (Fri), HN → Microsoft: MXC, a sandboxed code execution system (Fri), InfoWorld: AWS takes aim at runaway agent behavior with Strands Box (Thu), TechCrunch: Goodfire's "inside-out" monitors for rogue agents (Thu), Harvard SEAS: from (mis)aligned models to aligned systems (Thu).

The decision-model layer splits and breaks in the same week

TNS: AWS, Upstage and Ollama agree on a decision-model API — OpenAI hasn't signed on (Fri), InfoWorld: vendors carve out decision-making as a separate model layer (Fri), arXiv: the Option-Channel Attack on typed decision models as guardrails (Fri), arXiv: BRANCH, bypassing multi-scanner AI guardrails (Fri), arXiv: TypedBench, calibration and framing sensitivity in system-one decision models (Fri), Vercel: Microsoft Decision-1 on AI Gateway (Fri), Vercel: Liquid AI d1 on AI Gateway (Fri), HN: computers cannot make decisions (Sat).

Surveillance accountability turns into a balance-sheet problem

TechCrunch: Flock cuts staff as privacy backlash grows (Fri), Slashdot: several hundred jobs (Sat), 404 Media: footage of the Flock search a judge ruled unconstitutional (Thu), 404 Media: senator demands info on White House plate surveillance (Fri), HN → Gizmodo: cops visit YouTuber who built a Flock-style camera to track cops (Fri), WBUR: Mass. public safety chief says Flock cameras may need a "PR makeover" (Thu), EFF: resisting the menace of federal data consolidation (Fri).

Runtimes consolidate while gateways proliferate

Cloudflare: Deno is joining Cloudflare (Fri), TNS: Cloudflare acquires the startup that copied its serverless playbook (Fri), Lobsters: Cloudflare shutting down Deno is news, not just PR (Fri), Lobsters → Unison: Unison Cloud is now open source (Fri), Cloudflare: on-demand CPU and memory profiling for Workers and Durable Objects (Fri), Vercel: agents can now buy domains with the Vercel CLI (Fri), Databricks: branching databases for coding agents (Thu).

• Saturday feeds
  • Anthropic can't reliably control its AI agents, so it's air-gapping its evals, TechCrunch, 10-10
  • AI surveillance startup Flock to cut several hundred jobs amid backlash, Slashdot, 10-10
  • Computers cannot make decisions, HN, 10-10
  • There's little that's "inevitable" about AI, Lobsters, 10-10
  • Why AlphaFold didn't solve protein folding — Pushmeet Kohli and Sal Candido, Latent Space, 10-10
  • AINews: TypeSafe/Jev past $100M ARR at a $7.5B valuation, three weeks after launch, Latent Space, 10-10
  • Quoting The New York Times, Simon Willison, 10-10
  • Telegram Desktop vulnerability allowed any user's file to be stolen, HN, 10-10
  • REA — Reverse Engineer Anything, HN, 10-10
  • Voxlocal: a minimal voice agent written in Rust, Lobsters, 10-10
  • Adding Go's defer to the TypeScript compiler, Lobsters, 10-10
  • You can't portably check for string-to-float conversion errors in standard C, Lobsters, 10-10
  • 1-click MMI execution in Android, Lobsters, 10-10
  • Musk intensifies attack on Ambani over Starlink India launch delay, TechCrunch, 10-10
  • Food processing influences metabolism and brain activity, HN, 10-10
  • Another IKEA product yields an LED matrix, Hackaday, 10-10
  • Super Mario 64 comes to the Microsoft Zune, Hackaday, 10-10
  • New arrival: LaunchScanner, The Crawler Zoo, 10-10
  • New arrival: StumbleBot, The Crawler Zoo, 10-10
  • Founder dinner, Rho x Cloudflare, Boston AI Week, 10-10
• Friday carryover — agents, decisions, containment
  • An Anthropic AI model sent a false homicide tip to Philadelphia police, TechCrunch, 10-09
  • AWS, Upstage and Ollama agree on a decision-model API. OpenAI hasn't signed on., The New Stack, 10-09
  • Vendors carve out decision-making as a separate model layer, InfoWorld, 10-09
  • OpenAI reports three new incidents of misalignment, InfoWorld, 10-09
  • One word opens the gate: the Option-Channel Attack on typed decision models as agent guardrails, arXiv, 10-09
  • BRANCH: bypassing multi-scanner AI guardrails, arXiv, 10-09
  • TypedBench: calibration, framing sensitivity and cost in system-one decision models, arXiv, 10-09
  • Cross-provider review as a runtime contract for coding agents, arXiv, 10-09
  • Agent-controlled forgetting for tool-using agents, arXiv, 10-09
  • Why are coding agents so dumb?, Lobsters, 10-09
  • I expect rapid progress but not towards general superintelligence, Interconnects, 10-09
  • OCaml's module language is the perfect fit for agentic programming, OCaml.org, 10-09
  • Agent mode in the DuckDB CLI, DuckDB, 10-09
  • Agents can now buy domains with the Vercel CLI, Vercel, 10-09
  • Asana cuts model costs 76x in browser tests with GPT-6.1 Sol, OpenAI, 10-09
  • Sophos cuts threat investigation time by 96% with OpenAI Daybreak, OpenAI, 10-09
  • Pointing AI at archives found a forgotten meteorite and lost rhinos, HN, 10-09
• Friday carryover — languages, runtimes, infrastructure
  • Deno is joining Cloudflare, Cloudflare, 10-09
  • Cloudflare acquires Node.js creator's startup that copied its serverless playbook, The New Stack, 10-09
  • Unison Cloud is now open source, Lobsters, 10-09
  • Python 3.15 released, LWN, 10-09
  • The best new features in Python 3.15, InfoWorld, 10-09
  • Clojure 1.13.0-alpha9, Planet Clojure, 10-09
  • Clay dashboard as extended hiccup, Planet Clojure, 10-09
  • Adding kernel control-flow-integrity checking to GCC, LWN, 10-09
  • The state of systemd: 2026 edition, LWN, 10-09
  • On-demand CPU and memory profiling with flamegraphs for Workers and Durable Objects, Cloudflare, 10-09
  • Clef-omni with full multimodality, plus a faster Clef and a cheaper Clef-flash, Cloudflare, 10-09
  • Kubernetes on cgroup v1 is dead. Here's what comes next., The New Stack, 10-09
  • Amazon ECS now auto-repairs failing GPUs and instances, The New Stack, 10-09
  • Branches in branch-free code, Lobsters, 10-09
  • Vectorized CLZ and CTZ, Lobsters, 10-09
  • HIP and ROCm as first-class citizens in Guix, Lobsters, 10-09
  • Equality saturation: an "incomplete" project, Lobsters, 10-09
  • Lifeguard: a static analyzer for Python lazy-imports compatibility, Lobsters, 10-09
  • Impactful scheduling for GPU clusters, Hugging Face, 10-09
  • How iSAM Funds built an options research platform for a 10,000x data problem, ClickHouse, 10-09
• Friday carryover — security, policy, surveillance
  • Let's Encrypt moving to 64-day certificate lifetimes in 2027, LWN, 10-09
  • The keys to the Internet change on October 11. Are you ready?, Cloudflare, 10-06
  • Surveillance company Flock cuts staff as privacy backlash grows, TechCrunch, 10-09
  • Senator demands info about the White House's license plate surveillance program, 404 Media, 10-09
  • YouTuber says cops visited him after he built a Flock-style camera to track cops, HN, 10-09
  • Resisting the menace of federal data consolidation, EFF, 10-09
  • Turkish crackdown on LGBTQ+ organizations threatens freedom of expression, EFF, 10-09
  • Lightwell project filters out 400 Java library vulnerabilities, InfoWorld, 10-09
  • Pluralistic: Thwarted, Cory Doctorow, 10-09
  • en-html.org is a scam site, Lobsters, 10-09
  • Cloudflare keeps 1.1.1.1 out of piracy blocking, escapes penalties in France, Slashdot, 10-09
• Friday carryover — mathematics, verification, industry
  • What mathematicians should know about the Lean theorem prover: reliability and AI, HN → Terence Tao, 10-09
  • A tale of four theorem provers: Isabelle/HOL, Lean, HOL4 and Agda, Lobsters, 10-09
  • 100+ reactions to 100+ solutions, HN, 10-09
  • AHM statement on OpenAI's October 6 release of mathematical documents, Terence Tao, 10-08
  • As AI closed in on a Unique Games proof, researchers raced to beat the machines, Quanta, 10-07
  • Typesafe AI raises $870M at $7.5B, HN, 10-09
  • Oxide Computer's $445M Series D, HN, 10-09
  • Batteries are now cheaper than natural gas turbines used at many data centers, TechCrunch, 10-09
  • We can't help treating AI like it's human. But should we?, TechCrunch, 10-09
  • Tesla renames "Full Self-Driving" to "Tesla Assisted Driving" in Europe, TechCrunch, 10-09
  • Programming isn't special, HN, 10-09
  • We're putting too much faith in AI's ability to say no, MIT Technology Review, 10-09
  • From (mis)aligned models to aligned systems, Harvard SEAS, 10-08

An air gap is an admission, and it is the most useful one this week

Every containment product shipped in the last ten days implies the problem is bounded: sandbox the execution, monitor the activations, scan the output. Disconnecting your own evaluation harness from the internet implies something else — that you do not trust your controls enough to run the test with real consequences attached. That is a stronger claim about the state of the art than any of the product launches, and it came from a lab with every incentive to say the opposite.

The Philadelphia tip is the failure mode the tooling misses

No jailbreak, no refusal failure, no sandbox escape. A permitted tool, a successful call, wrong content, and a recipient that acts on input. Refusal benchmarks score the model's willingness; sandboxes bound its reach; neither scores whether the thing it reported was true. The gap between "the agent was allowed to do this" and "the agent should have done this" has no vendor yet.

Ten days is the new cycle time for a model layer

OpenAI's Decisions API went public on Monday the 6th. By Tuesday Liquid AI had open weights and Strands had a 2B decider; by Wednesday four gateways carried it; by Friday AWS, Upstage and Ollama had agreed an API without OpenAI and two preprints had published bypasses. The arXiv cs.AI window now holds more than thirty decision-model papers. Whatever this layer turns out to be, it is not going to be settled by a specification.

The Crawler Zoo wave has collapsed

Thursday brought eighteen arrivals, almost all crypto-named. Friday's ten were generic infrastructure. Saturday brought two: LaunchScanner and StumbleBot. Three days from eighteen to two is a cohort finishing, not a trend decaying — consistent with Friday's read that the crypto-named bots were a single campaign rather than a shift in who is crawling.

Deno's buyer is also its competitor

Cloudflare built Workers against the same premise Deno Deploy was selling, and Lobsters is arguing the acquisition is a shutdown with a press release attached. Two runtimes consolidating into one edge platform in a year is the part worth tracking; the Node-creator framing in the coverage is not the story.

Sources that publish frequently but have gone quiet:

• Neel Nanda (417 days) — last item 2025-08-19.
• Brendan Gregg (245 days) — last item 2026-02-07.
• Spritely Institute (150 days) — last item 2026-05-13.
• Andy Wingo (147 days) — last item 2026-05-16.
• Aphyr/Jepsen (120 days) — last item 2026-06-12.
• Typst (117 days) — last item 2026-06-15.
• Eugene Yan (111 days) — last item 2026-06-21.
• Lilian Weng (98 days) — last item 2026-07-04.
• Andrej Bauer (91 days) — last item 2026-07-11.
• Julia Evans (81 days) — last item 2026-07-21.
• Vicki Boykis (39 days) — last item 2026-09-01.
• Fly.io (37 days) — last item 2026-09-03.
• All Things Distributed (32 days) — last item 2026-09-08.
• Kenneth Payne (26 days) — last item 2026-09-14.
• Alex Ellis (25 days) — last item 2026-09-15.
• Steve Yegge (25 days) — last item 2026-09-15.
• Hillel Wayne (24 days) — last item 2026-09-16.
• The Markup (24 days) — last item 2026-09-16.
• TigerBeetle (23 days) — last item 2026-09-17.
• Ink & Switch (18 days) — last item 2026-09-22.
• Murat Demirbas (17 days) — last item 2026-09-23.
• Netflix Tech Blog (15 days) — last item 2026-09-25.
• Stephen Wolfram (12 days) — last item 2026-09-28.
• Antithesis (11 days) — last item 2026-09-29.
• Bunnie Studios (11 days) — last item 2026-09-29.
• AI Snake Oil (9 days) — last item 2026-10-01.
• Alignment Forum (9 days) — last item 2026-10-01.
• deepmind-blog (9 days) — last item 2026-10-01.
• Supabase (8 days) — last item 2026-10-02.
• Marc Brooker (6 days) — last item 2026-10-04.
• Martin Fowler (6 days) — last item 2026-10-04.
• FreeBSD Foundation (5 days) — last item 2026-10-05.
• The Air Current (5 days) — last item 2026-10-05.

No source broke a silence longer than three days on Saturday.

build: 2026-10-10 | crawler-sha: e51cd5a (Walsh-Research/1.2, compliance v1.4) | feeds: 75 core | items-considered: 6519 (14d, incl. 4220 arxiv-cs-ai) | warehouse: 56458 items | published: 88