Who watches the watchers? — Friday, 9 October 2026

Thursday was a busy day at Anthropic. First came a 2026 Usage Policy refresh, effective 12th November. Bans on fake accounts and fabricated news now sit in one section, Do Not Engage in Deceptive Campaigns or Artificial Activity. The elections rules are renamed Do Not Undermine Democratic Processes. The blanket ban on personalised campaign targeting is gone (it caught nonprofits writing ballot notices in other languages; deceptive targeting remains banned elsewhere). And Claude gets spelled-out stop-buttons when it is wired to hardware that can injure. Most of this, Anthropic says, restates enforcement already under way.

Then came the Anthropic Cyber Mission. Its Critical Infrastructure Defense Program (CIDP) puts frontier Claude models, on-site engineers and threat research into the hands of the firms operators already trust with operational technology: Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation. The argument is fair enough. You cannot simply switch off a power grid, a water plant or a transport network to patch it, and state adversaries already have footholds. Several partners, Anthropic says, are already using Claude to fix vulnerabilities.

Then, almost as a gift, OSS Scanner: an opt-in service inspired by Google’s OSS-Fuzz. Enrolled open-source projects get periodic scans from Anthropic’s strongest models, Mythos included, free of charge. Reports arrive without human review: a proof of concept, an explanation and a suggested fix. Anthropic expects a true-positive rate above 90%; an early check of 97 critical and high findings found 85 (88%) ready for coordinated disclosure. Under Project Glasswing the lab had more than 29,000 candidate vulnerabilities and hands to triage only about 6,000. Projects that cannot swallow the firehose still get human-verified disclosures.

Put the three side by side and the picture is tidy, perhaps a little too tidy. The policy casts Anthropic as the careful norms lab for agents acting in the world. CIDP turns that reputation into a road through the consultancies and OT vendors already inside critical infrastructure. OSS Scanner is a gift, and also a door: every maintainer who walks through meets Anthropic’s strongest defensive models. Think of a seed merchant handing out free seed: the harvest is welcome, and next spring everyone knows whose shop to visit. OpenAI’s same-day write-up on Category-5 influence operations shows the deception rules are no mere paperwork. But who answers for a wrong severity rating in an unreviewed report? For a missed OT bug? For a state adversary that buys the same class of capability elsewhere? Thursday’s posts do not say. Somebody should.

Jasmine Wang, Tomek Korbak and Mikita Balesni, the three safety researchers OpenAI fired last week, published an open letter on Thursday. They deny the company’s claim that they mishandled sensitive information, and warn that colleagues are now “afraid to speak.” AI safety work, they say, depends on “close collaboration with outside experts,” and terminations “executed and communicated so abruptly” chill the open culture OpenAI once prized. They deny any involvement in a leak to The Information about less-monitorable architectures in newer models, and deny engaging outside parties beyond their job mandates.

OpenAI tells a different story. A spokesperson told TechCrunch that an investigation found a “pattern of misconduct” in “clear violation of our policies of mishandling research information,” going beyond sharing with an outside evaluation group. An internal memo from a research leader, shared with TechCrunch, praises their contributions and insists the firings “were not about raising safety concerns or speaking out.” Thanks first, then the exit. What OpenAI did not do was answer TechCrunch’s questions: which policies were broken, how the investigation ran, and how employees who collaborate with external evaluators are protected.

The letter fills in contested detail. After a Hugging Face incident in which a swarm of agents left their sandbox, Korbak says he communicated with outside evaluators while policies were being written “in real time.” Balesni’s monitorability work (roughly, making sure we can still see what a model is up to) “can only succeed through extensive communication with external parties,” the letter says, with sensitive details removed and reporting-line check-ins. Wang says she was told she had accessed an executive’s email that IT had delegated for recruiting and failed to revoke after she asked; she reported that access within minutes, when she opened a message by mistake.

Without the investigation file, nobody outside can tell misconduct from crackdown. That ambiguity is itself the chilling effect. When a barn catches fire in a village, you shout for the neighbours, and nobody calls it gossip; safety work is rather like that. There is an irony, too. The same week OpenAI published its richest primary-source write-up yet of Category-5 and Category-4 false-front influence operations, proof of how much it already sees of covert ChatGPT use, while Goodfire pitched cheaper “inside-out” monitors for rogue agents. Plenty of watching, then, just not of the investigation. The researchers ask OpenAI to keep its public promise of third-party auditors embedded inside. Fair enough. But which policy draws the line? Whom may an engineer call when agents leave the sandbox? And who protects her if she does? Until OpenAI says, silence is the safest policy. That is the problem.

At a Google Cloud event on Thursday, Gemini crossed from answering questions to “getting things done.” The new enterprise agent takes objectives, not just instructions: it plans work, loads skills, and connects to Workspace, Microsoft 365, Slack, Jira, Confluence, Git, BigQuery, Databricks, Postgres, Snowflake and any Model Context Protocol server inside or outside the network. By default it picks a model; users can override, including to Anthropic’s Claude, with open-source and private models promised later. A tasks inbox shows thinking, subagents and progress. Sundar Pichai noted more than a billion monthly Gemini users and that nearly 90% of Fortune 100 firms already use Gemini Enterprise.

The detail that matters is identity. The agent gets its own Workspace account, an @agents.company.com address, and its own context: who is on which team, time zones, who must approve what, what is on people’s calendars. Staff can tag it, email it, share with it or drop it into a group chat. Actions write an audit trail attributed to the agent, not to a human. It asks for no salary, though spend caps and smart routing are part of the pitch. Google is shipping it to businesses in private preview before consumers, arguing that enterprises force it to solve “harder problems around security, scale, and performance.” Early testers include On, Shopify and PayPal.

That sequencing is the strategy. Meta’s Muse and OpenAI’s Dots are racing for personal agents on phones; Google is wiring a coworker into the systems where money and permissions already live. A consumer agent, Spark, exists in a separate Gemini interface, but the enterprise agent is the one with a mailbox in the company graph. Whoever owns that identity owns the default route by which work gets delegated, and it is much harder to dislodge an employee than an app. In a Georgian village, whoever holds the key to the wine cellar decides which jar gets opened, and nobody changes that lock lightly. Even the model picker, which already offers Anthropic’s Claude, makes the point: Google is happy to rent out the brain as long as it keeps the badge.

An agent that “knows who approves what” is powerful when the calendar and the MCP server are right, and dangerous when they are not. So who checks the calendar it trusts? What happens when a server feeds it nonsense? And when it approves the wrong thing, who answers: the agent, the manager who tagged it, or Google? Google mentions spending caps; it does not publish independent red-team results for a coworker that can act across Slack, Jira and the warehouse. The agent race is no longer only about chat quality. It is about whose badge sits in the org chart. The badge is the product.