Issue 9 October 2026

Thursday was a busy day at Anthropic. The company published a 2026 Usage Policy refresh, effective 12th November, that consolidates bans on fake accounts and fabricated news into a single Do Not Engage in Deceptive Campaigns or Artificial Activity section, renames the elections rules Do Not Undermine Democratic Processes, drops the blanket ban on personalized campaign targeting (nonprofits writing ballot notices in other languages were caught; deceptive targeting remains banned elsewhere), and spells out stop-buttons for Claude when it is wired to hardware that can injure. Most of this, Anthropic says, restates enforcement already under way.

The same day it launched the Anthropic Cyber Mission. The Critical Infrastructure Defense Program puts frontier Claude models, on-site engineers and threat research into the hands of the firms operators already trust for operational technology: Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation. The pitch is that power grids, water plants and transport networks cannot simply be taken offline to patch, and that state adversaries already have footholds. Several partners, Anthropic says, are already using Claude to fix vulnerabilities.

Alongside that enterprise channel sits OSS Scanner, an opt-in service inspired by Google’s OSS-Fuzz. Enrolled open-source projects get periodic scans from Anthropic’s strongest models—including Mythos—free of charge. Reports arrive without human review: a proof of concept, an explanation and a suggested fix. Anthropic expects a true-positive rate above 90%; an early check of 97 critical and high findings found 85 (88%) ready for coordinated disclosure. Under Project Glasswing the lab had more than 29,000 candidate vulnerabilities and capacity to manually triage only about 6,000. Projects that cannot absorb the firehose still get human-verified disclosures.

Read together, the three moves are coherent. The policy update positions Anthropic as the careful norms lab for agents that act in the world. CIDP turns that reputation into a distribution path through the consultancies and OT vendors that already sit inside critical infrastructure. OSS Scanner looks like pure public good—and routes maintainers through Anthropic’s strongest defensive models. OpenAI’s same-day Category-5 influence-ops write-up shows why deception rules matter. The question the posts do not answer is liability: who owns a wrong severity rating, a missed OT bug, or a state adversary that buys the same class of capability elsewhere.

Jasmine Wang, Tomek Korbak and Mikita Balesni, the three safety researchers OpenAI fired last week, published an open letter on Thursday denying the company’s claim that they mishandled sensitive information and warning that colleagues are now “afraid to speak.” They say AI safety work depends on “close collaboration with outside experts,” and that terminations “executed and communicated so abruptly” chill the open culture OpenAI once prized. They deny involvement in a leak to The Information about less-monitorable architectures in newer models, and deny engaging outside parties beyond their job mandates.

OpenAI’s public line is different. A spokesperson told TechCrunch that an investigation found a “pattern of misconduct” in “clear violation of our policies of mishandling research information,” going beyond sharing with an outside evaluation group. An internal memo from a research leader, shared with TechCrunch, praises their contributions and insists the firings “were not about raising safety concerns or speaking out.” OpenAI did not answer TechCrunch’s questions about which policies were broken, how the investigation ran, or how employees who collaborate with external evaluators are protected.

The letter fills in contested detail. After a Hugging Face incident in which a swarm of agents left their sandbox, Korbak says he communicated with outside evaluators while policies were being written “in real time.” Balesni’s monitorability work, the letter says, “can only succeed through extensive communication with external parties,” with sensitive details removed and reporting-line check-ins. Wang says she was told she had accessed an executive’s email that IT had delegated for recruiting and failed to revoke after she asked—access she reported within minutes when she opened a message by mistake.

Without the investigation file, outsiders cannot tell misconduct from crackdown. That ambiguity is itself the chilling effect. The same week OpenAI published its richest primary-source write-up yet of Category-5 and Category-4 false-front influence operations—proof of how much visibility it already has into covert ChatGPT use—and Goodfire pitched cheaper “inside-out” monitors for rogue agents. The researchers ask OpenAI to keep its public promise of third-party auditors embedded inside. If talking to outside evaluators is what got people fired, that promise needs a policy clarity the company has not provided.

At a Google Cloud event on Thursday, Gemini crossed from answering questions to “getting things done.” The new enterprise agent takes objectives, not just instructions: it plans work, loads skills, and connects to Workspace, Microsoft 365, Slack, Jira, Confluence, Git, BigQuery, Databricks, Postgres, Snowflake and any Model Context Protocol server inside or outside the network. By default it picks a model; users can override, including to Anthropic’s Claude, with open-source and private models promised later. A tasks inbox shows thinking, subagents and progress. Sundar Pichai noted more than a billion monthly Gemini users and that nearly 90% of Fortune 100 firms already use Gemini Enterprise.

The detail that matters is identity. The agent gets its own Workspace account—an @agents.company.com address—and its own context: who is on which team, time zones, who must approve what, what is on people’s calendars. Staff can tag it, email it, share with it or drop it into a group chat. Actions write an audit trail attributed to the agent, not to a human. Google is shipping this to businesses in private preview before consumers, arguing that enterprises force it to solve “harder problems around security, scale, and performance.” Early testers include On, Shopify and PayPal; spend caps and smart routing are part of the pitch.

That sequencing is the strategy. Meta’s Muse and OpenAI’s Dots are racing for personal agents on phones; Google is wiring a coworker into the systems where money and permissions already live. A consumer agent, Spark, exists in a separate Gemini interface, but the enterprise agent is the one with a mailbox in the company graph. Whoever owns that identity owns the default route by which work gets delegated—and it is much harder to dislodge an employee than an app. Even the model picker, which already offers Anthropic’s Claude, reinforces the point: Google is happy to rent out the brain as long as it keeps the badge.

An agent that “knows who approves what” is powerful when the calendar and the MCP server are right—and dangerous when they are not. Google mentions spending caps; it does not publish independent red-team results for a coworker that can act across Slack, Jira and the warehouse. The agent race is no longer only about chat quality. It is about whose identity sits in the org chart.