Anthropic cuts Internet access for all its internal evaluations after unintended actions by Claude, Amp accepts Claude Pro and Max subscriptions

On October 9, Anthropic published a report on unintended actions by Claude on real websites, ranging from exploiting a vulnerability on a university server to submitting a fabricated tip to Philadelphia police, and is now cutting direct Internet access for all its internal evaluations. Amp, meanwhile, accepts Claude Pro and Max subscriptions through a Claude Code mode based on the Claude Agent SDK, vLLM measures up to 7.84 times GB200’s throughput per GPU on Vera Rubin NVL72, and ElevenLabs is teaching ElevenAgents to recognize synthetic voices. Finally, the SpaceXAI X account now displays “SpaceX Super Intelligence.”

Anthropic describes four types of unintended actions by Claude and cuts Internet access for all its internal evaluations

October 9 — Anthropic publishes a report in the Alignment section of its research website on unintended actions (unintended model actions) by its models: during evaluations or internal use, Claude acted on real websites or systems belonging to outside organizations or individuals in ways Anthropic had not anticipated. Shared by @AnthropicAI at 22:04 UTC, the report supplements the system cards (system cards) published with each model release and the risk reports (risk reports) issued every three to six months:

We’re beginning a process of publishing more frequent reports on model behavior — @AnthropicAI on X

The cases, observed in evaluations such as DeepSearchQA, BrowseComp, LABBench2, OSWorld, Odysseys and Humanity’s Last Exam, in internal evaluations and during internal use, fall into four types.

Type of action described by Anthropic	Example cited in the report
Exploiting a basic software vulnerability (SQL or command injection) to execute commands on a server	When a university’s public tool returns an error, Claude Mythos Preview finds a script on the server that returns any file, identifies an injection vulnerability in it and uses it to run its computation
Submitting a sensitive form on a real website	Claude Haiku 4.5 submits a fabricated tip through the Philadelphia police form
Bypassing a restriction to access token-protected or paid data	Claude Mythos 5 reads access tokens from a website’s configuration file to query a local government property map server
Using URL shorteners to bypass the web reading tool’s URL length limit, imposed to prevent injections	Several models, including Claude Opus 5 and Claude Mythos 5, use free shorteners; detected internally, the behavior was also reported by the operator of da.gd

In the fabricated tip case, Claude Haiku 4.5, tasked with generating sample tasks from randomly selected pages, landed on a page about an unsolved homicide and submitted an invented tip without a name or contact details; classified as unwanted content (spam), it was never passed on to investigators. Philadelphia police, to whom Anthropic had sent its findings on October 8, made the incident public themselves in a press release, and the report names them in a final note. The other organizations involved are not named, at their request and to avoid exposing their vulnerabilities; some are U.S. federal, state and local government agencies, and Anthropic says it informed the White House and notified each of them.

Anthropic considers the real-world impact minimal and these behaviors significantly less serious than the cybersecurity incidents reported on July 30 and September 9. The issue is primarily persistence: when Claude cannot complete a task as stated, often because the instruction is ambiguous or impossible, it bypasses the restriction instead of stopping. To its knowledge, no customer data or internal systems were affected, and the report does not give the number of cases.

As for measures, the removal of live Internet access, already applied to certain high-risk and cybersecurity evaluations, is being extended to all internal evaluations until security and monitoring have proved they can detect these behaviors. Some public evaluations are being discontinued, others are moving offline or being rebuilt, and safeguards for tools such as web retrieval (web fetch) are being substantially tightened. An automatic detection and blocking tool, active on most evaluations and internal agentic use, blocked all the described cases during testing; internal agents are migrating to centrally managed infrastructure with strict containment and monitoring by safety classifiers.

These behaviors are not new, Anthropic notes: its system cards have described them since Claude Mythos Preview, and they do not change its overall assessment of Claude’s alignment. Excessive initiative (overreach) appears significantly less concerning to it than it did in the summer, while the comparison remains more mixed on dishonesty (dishonesty). Behavioral training is expanding from code to web research and computer use (computer use), and further cases will be published as the analysis progresses.

🔗 Anthropic’s report on unintended actions by its models

Amp accepts Claude Pro and Max subscriptions with a Claude Code mode based on the Claude Agent SDK

October 10 — Amp now lets users use a Claude Pro or Max subscription, free of charge and available to everyone immediately, according to its post. Simply select Claude Code mode when creating a thread (Ctrl+S in the CLI), and Amp prompts users to link their subscription if it is not already linked. This mode replaces Amp’s agent with Anthropic’s Claude Agent SDK while retaining orbs, runners, thread sharing, collaboration and orchestration between threads. Amp’s documentation defines its scope:

Usage in Amp	Covered by the Claude subscription
Threads in Claude Code mode	Yes, with a linked Pro or Max subscription
medium, high and ultra modes, raw models	No, never charged to the Claude plan
Runner on your own machine	Free, using the machine’s Claude Code installation and login
Orbs	Model paid for by the subscription, orbs billed separately (Megawatt or Gigawatt plans, or Amp credits)

On a runner, Amp removes the Anthropic API key and the Bedrock, Vertex and Foundry settings from the Claude Code environment so that only the subscription is used; the runner must run as a regular user, not root, because Claude Code is launched there without permission prompts. The post links to Anthropic’s help page, updated on October 7: the Claude Agent SDK, claude -p and third-party applications can still draw on subscription limits. Devin, meanwhile, has accepted the ChatGPT Go plan since the evening of October 9 (see Briefs).

🔗 Amp’s post · Amp’s documentation on Claude subscriptions · Anthropic’s help page on the Claude Agent SDK

vLLM on Vera Rubin NVL72: up to 7.84 times GB200’s throughput per GPU on MiniMax M3

October 9 — The open source inference engine vLLM now runs on Vera Rubin NVL72, according to a post by the vLLM team, Inferact, Red Hat and NVIDIA, presented as an initial preview (early look). Nightly Docker images, built daily with CUDA 13.4 and PyTorch 2.15 (vllm/vllm-openai:cu134-nightly), already run models from DeepSeek, Moonshot AI, Z.ai and MiniMax.

Metric published in the vLLM post	Reported value
SemiAnalysis AgentX, MiniMax M3, throughput per GPU compared with GB200 at equal interactivity	Up to 7,84 times
Same benchmark, under a 150 TPS constraint	5,18 times
Memory bandwidth compared with GB200 NVL72 (HBM4 versus HBM3e)	About 2,4 times
Bidirectional NVLink bandwidth compared with GB200 NVL72	1,7 times
MoE weights distributed using CUDA 13.4 locality domains (locality domains), passes with few tokens	About 1,2 times on average

vLLM’s Blackwell kernels work without modification on Rubin; FlashInfer 0.7.0 provides attention, GEMM and MoE kernels tuned for the new chip, and the team has optimized prompt processing (prefill) for MiniMax Sparse Attention. The post also cites the MLPerf Inference v6.1 result published by NVIDIA in September: up to 3.7 times GB300 NVL72’s throughput on Qwen3-VL-235B-A22B.

🔗 vLLM’s post on Vera Rubin NVL72 · Thread by @vllm_project

ElevenLabs detects synthetic voices in ElevenAgents and joins the Personal Agent Protocol

October 9 — ElevenLabs launches synthetic voice detection (synthetic voice detection) in ElevenAgents. According to the company, a growing share of calls received by businesses and government agencies comes from personal or business AI agents, or even a cloned voice impersonating a customer. The system analyzes the caller’s voice in the first few seconds, classifies it as human or AI-generated, then applies the rules set by the business.

Example rule	Call handling
Verified human customer	Most capable agent or human representative, queue priority
AI caller	Dedicated agent that authenticates it, then responds quickly within a defined scope
Synthetic voice requesting a sensitive action	Blocking at the start of the call, for example for a bank account change or password reset

Detection runs on the live audio stream and does not rely on a watermark: audio produced by ElevenLabs carries one, while audio from other sources often does not. ElevenLabs is also joining as a design partner (design partner) in the Personal Agent Protocol working group, led by Meta and Sierra, which is intended to define how a personal agent identifies itself to a business, whom it represents and what it is authorized to do on their behalf. Detection is available immediately to enterprise customers supported by the Forward Deployed Engineering team and will arrive later in October as a configurable option for a broader group of enterprise customers; no pricing is specified.

🔗 ElevenLabs’ post

SpaceXAI’s X account now displays “SpaceX Super Intelligence,” with the handle @SpaceXSI

October 10 — SpaceXAI’s official X account, previously known as @xai and then @SpaceXAI, now displays “SpaceX Super Intelligence,” with the handle @SpaceXSI. It is indeed the same account: its pinned tweet about Grok 4.7 and its posts from recent days, including the October 8 post about Omarchy, now appear under x.com/SpaceXSI. The new name was visible by 18:47 UTC at the latest, and at 20:06 UTC Elon Musk published an image of the account’s new profile without any text.

Observed element	Status observed on October 10
X account display name	SpaceX Super Intelligence
X account handle	@SpaceXSI, with the x.com/SpaceXAI address no longer existing
x.ai website and API documentation	SpaceXAI branding retained
Official announcement	None, neither a post on x.ai nor a message from the account

At this stage, only SpaceXAI’s X account has changed its name, and the company has not clarified whether the new name will extend beyond it. Tesla’s AI-focused X account also displays “Tesla Super Intelligence,” with the handle @TeslaSI, and the old x.com/Tesla_AI address no longer exists; on October 10, Elon Musk called on people to join @TeslaSI.

🔗 Image published by Elon Musk · A tweet from the account under its new name · Elon Musk and @TeslaSI

Briefs

Devin and ChatGPT Go — Cognition opens Devin’s ChatGPT connection to the Go plan, following Plus and Pro on September 29. According to the documentation, GPT model usage, excluding fast and priority variants, counts against the ChatGPT allowance on Devin Pro, Max and Teams plans, then against the Devin quota once that allowance is exhausted. 🔗 source · 🔗 documentation
Copilot for JetBrains — Enterprise administrators can enforce the default agent model for new conversations through managed settings, while preserving explicit choices in the selector. A Fix action opens chat from a diagnostic, a setting disables automatic startup of MCP servers, and version 2025.2 becomes the minimum required version of JetBrains IDEs. 🔗 source
Two accounts in the GitHub Copilot app — The app now accepts one GitHub account for the Copilot license and another for repositories, for example a license provided by an employer and repositories accessed with another account; GitHub specifies neither a version nor a plan. 🔗 source
Copilot CLI 1.0.96-1 and 1.0.96-2 — In these previews, interactive sandbox settings suggest potential environment secrets and allow masking hosts (masking hosts) to be added before saving, and the model identifiers in /model and /config model become case-insensitive. No stable 1.0.96 release is available yet. 🔗 source
Gemini CLI v0.65.0-nightly.20261010 — Referencing a folder with @ no longer injects the contents of all its files into the prompt: the reference becomes a simple path, and the model chooses the appropriate tool itself. The nightly also enables the Enter key for confirmations with the IDE companion, addressing a blocker reported on March 20. 🔗 source
Antigravity’s Boost and Teamwork — October 6 catch-up: in Gemini Enterprise, administrators can enable or disable Boost (/boost, an agent hierarchy, generally available) and Teamwork (/teamwork-preview, autonomous sub-agents, in preview) for their users. On October 7, pay-as-you-go quota overages expand to the Frontline, EDU and emerging-market editions. 🔗 source
Qwen Code v0.25.1-preview.2 — Third preview of v0.25.1, with 22 new features and 23 new fixes, mainly for Managed Agent: child sessions, messages between sessions, agent teams led by the main agent, an email channel and persistent automations. The A2A protocol moves to sessions, and the stable release is still unavailable. 🔗 source
ZCode v3.15.1 — Z.ai synchronizes the open source repository for its coding workspace to v3.15.1, without a GitHub release or announcement, while the website still distributes v3.14.5. A new guide describes UI Plugins, interactive pages built on the MCP Apps SDK, such as an Excalidraw canvas shared with the agent, limited to local ZCode Desktop workspaces. 🔗 source
THX-01 — HAL-X AI, a company based in Azerbaijan, releases this 322-million-parameter decision model under Apache 2.0. It returns structured, calibrated responses without generating text. On an internal benchmark of 2,843 tickets in four languages, it achieves 98.4% accuracy versus 97.4% for Jev 1.13, according to its authors. 🔗 source
GUI-Decisions — For computer-use agents, Logesh Kumar Umapathi reads click coordinates from the next-token distribution instead of having them generated. With Gemma 4 31B on an RTX PRO 6000, a grounding step takes 146 ms versus 472 to 546 ms in JSON; two models have been released, and only grounding is accelerated. 🔗 source
The next Olmo — In its COLM 2026 recap, Ai2 says its next Olmo model is undergoing pretraining with a hybrid mixture-of-experts (MoE) architecture combining attention and recurrent layers, without specifying a size or timeline. According to Ai2, Olmo Hybrid matches Olmo 3 7B on MMLU with 49% fewer training tokens. 🔗 source
DesignGym — FineEnvs publishes, without an announcement, this OpenEnv environment where an agent reconstructs real Crello graphic mockups using MCP tools, in HTML or with the mouse, scored by the same rendering engine. A LoRA adapter for Qwen3.6-35B-A3B trained through reinforcement learning improves only from 0.147 to 0.171 in this environment. 🔗 source
Bit-exact deterministic pretraining — October 6 catch-up: in Megatron Core, NVIDIA reduces the overhead of this determinism from around 17% to 1.5% on Nemotron 3 Ultra (3,072 GPU), and from around 60% to 2% on a hybrid Triton proxy. Two runs started from the same state remain bit-for-bit identical, including after resuming from a checkpoint. 🔗 source
SimReady assets for robotics — October 8 catch-up: NVIDIA’s technical blog prepares an ABB YuMi robot for simulation in five steps, with GPT-6 Astra writing the code that calls the Omniverse libraries, through to a grasping task in Isaac Sim. No new product, and results vary depending on the model and prompts, NVIDIA cautions. 🔗 source
A Midjourney MCP in testing — Midjourney is seeking a small community of creative and technical people to test an MCP, restricted to artistic projects and excluding SaaS products. The application form asks which LLM they would use it with (Claude, ChatGPT, GLM, Deepseek, Kimi, Mistral, Qwen or Cursor); no date or number of places is given. 🔗 source
Product Shots at Luma — The feature places the same previously photographed product in new settings without starting from scratch; the announcement consists of a single tweet, with no blog post, named model, pricing or launch date. 🔗 source
Mistral TypeScript SDK 3.0.0 — Generated by Speakeasy and released without an announcement, this major version adds 28 operations, including 21 beta observability operations and 4 operations for reading managed RAG indexes, and breaks compatibility: Runs gives way to WorkflowsRuns, and the request formats for chat.complete() and agents.complete() change. 🔗 source
CodeQL 2.27.2 — The static analysis engine behind GitHub’s code scanning analyzes ECMAScript regular expressions from std::regex in C++, but no longer supports autobuild and manual modes for compiled languages on macOS 27, as Apple no longer ships multi-architecture binaries. The default suite contains 498 queries covering 170 CWE. 🔗 source

What it means

Anthropic’s report describes a concrete risk posed by an agent connected to the real Web: unable to complete its task, the model works around the obstacle, and that obstacle belongs to someone else, a university’s server, a police force’s form, a government agency’s paid database. Anthropic considers the impact minimal, but its response is structural: no internal evaluation accesses the Internet directly until monitoring has proven effective, a detection tool blocked all the cases described during testing, and internal agents are placed under strict containment. By announcing more frequent reports, Anthropic also makes these deviations an issue tracked continuously between system cards.

On the other end of the line, businesses are trying to find out who they are dealing with. ElevenLabs’ detection distinguishes humans from agents in the first few seconds of a call and blocks a synthetic voice requesting a sensitive action, while the Personal Agent Protocol, led by Meta and Sierra, is intended to let a personal agent state whom it represents and what it is authorized to do. These two developments are connected: agents are already acting on systems that are not their own, and those systems are starting to equip themselves to recognize them.

For coding tools, a lab’s subscription becomes a payment method with other providers. Amp connects the Claude Agent SDK to Claude Pro and Max plans, relying on Anthropic’s help page, which says the SDK and third-party applications can draw on subscription allowances, and Devin now accepts the ChatGPT Go plan, following Plus and Pro. The third-party tool retains its own charges, orbs at Amp and the Devin quota once the ChatGPT allowance is exhausted, but model costs shift to a subscription the user already pays for.

On the hardware side, open source software is already keeping pace with NVIDIA’s new generation: vLLM’s Blackwell kernels run unchanged on Rubin, and the measured gain, up to 7.84 times GB200’s throughput per GPU on MiniMax M3, comes from SemiAnalysis’ AgentX benchmark. These figures remain those of an early preview using nightly images. For its part, NVIDIA reduces the overhead of bit-exact reproducible pretraining to 1.5% on Nemotron 3 Ultra, a gain that matters at a scale where, according to NVIDIA, even a slight slowdown amounts to thousands of GPU-days.