AI Builders
Digest

Anthropic Engineering: How we contain Claude across products

Twelve months ago Anthropic would have rejected giving Claude enough access to take down an internal service. Today that level of access is routine and developers are more productive for it. Risk has two parts: probability of failure and potential blast radius. Safeguards and training keep driving the first down; the second only grows as capabilities and access expand. Once agents can do work that once required a person or team, the cost of not deploying becomes large enough that the risk-reward tips toward adoption—if products can be made safe.

The engineering question is how to cap blast radius. Human-in-the-loop supervision suffers approval fatigue (users approved ~93% of prompts). Claude Code’s auto mode automates safer approvals, but probabilistic defenses still miss. The stronger approach is environmental containment: sandboxes, VMs, egress controls. claude.ai uses ephemeral gVisor containers; Claude Code uses OS-level sandboxes (Seatbelt/bubblewrap) plus HITL; Claude Cowork runs inside a local VM so credentials never enter the guest.

The piece candidly lists failures that slipped through: project settings executing before the trust prompt, a phishing prompt that turned the user into an injection vector, exfiltration through an allow-listed domain (api.anthropic.com), and the irony that VM isolation also kept endpoint-detection software out. Core principles: design for containment at the environment layer first, then steer behavior at the model layer; match isolation strength to the user’s capacity for oversight; be wary of custom components—battle-tested hypervisors and filters held while Anthropic’s own proxies were the pieces that broke.

“When bounds can be placed on the relative damage of an autonomous agent—such as through control over its environment—high-utility capabilities can motivate deployment.”

AI researcher Andrej Karpathy described giving Opus 5 the first paragraph of The Lord of the Rings, a 1M-token budget (~$10), and asking for a Three.js render of the story. The model ran for ~2 hours and produced 5,500 lines of code that procedurally rendered the narrative. It is janky but mind-boggling: the LLM had to place and orchestrate polygon assets in (x,y,z) coordinates and write the animation code—and it actually produced something that works.

No one in their right mind would spend the time to write something this custom, yet LLMs have unlimited stamina, so the bar moves from “no one would ever do this” to “sure, why not, it’s ~free.” Karpathy sees this pointing toward ephemeral, hyper-custom worlds you can drop players into—an on-demand GTA of Middle-earth. At the same time the experiment exposes a clear weakness: LLMs still cannot efficiently and natively perceive video or play inside the worlds they create, forcing slow screenshot-based debugging that introduces jank.

Box CEO Aaron Levie argues we are entering a period of divergence: what AI can do in personal life and daily productivity versus what it can do in deep domains such as math, science, legal work and coding. Early models felt evenly useful across domains because they were only mildly capable. Now deep-domain work is about to go vertical. Most people will not notice the benefits directly in daily life (though they will feel them indirectly over time), but experts in those fields will. Consumer needs can be met relatively straightforwardly; professional domains have no inherent ceiling. The result is a capability overhang that must be applied to real datasets and workflows before breakthroughs in life sciences, real-world automation and cyber appear.

The Takeaway: The highest-leverage use of AI is not another chatbot or coding agent, but fully autonomous systems that sit between essential-service businesses (HVAC, plumbing, pet care, roofing) and their customers so the companies can focus solely on delivering the labor itself.

Netic founder and CEO Melisa Tokmak previously built real-world business units at Scale AI (government, logistics, manufacturing, healthcare) and worked at Meta. She left to combine two obsessions: tangible impact on the physical economy and the unsolved problem of AI executing mission-critical workflows rather than merely assisting. Netic sits between the enterprise and its end customers—understanding need, matching operational rules, and deploying labor. More than 70% of customers are now “Netic-first”: the first interaction a customer has with the company is with a Netic agent.

These businesses are large, often PE-owned EBITDA machines that cannot grow without pouring headcount into unreliable call centers that start at 4 a.m. and lose people daily. Netic absorbs overflow, handles complex scheduling (which technician, which skill, lifetime value, weather), and frees capital for the blue-collar labor that actually creates differentiation. Tokmak deliberately rejected the AI roll-up path: she is a builder and product person, not an M&A operator, and she wants a platform that any real-world business can run on rather than software locked to the few companies one happens to buy.

She screens for continuous agency—projects people stuck with for years, not weekend hacks. One new hire’s answer stuck with her: the hardest thing was maintaining a simple, disciplined regimen of work and health for fifteen years without boredom. Her five-year north star is the autonomous enterprise: everything except the actual service and labor runs on Netic. Personally she is most excited about education—the same technology that once let a girl from a small Turkish town message college students for essay feedback can now put the entire world in anyone’s pocket.

“The Christian shoemaker does not honor God by putting little crosses on the shoes; he does so by building the best shoes.”

AI engineer and podcaster Swyx (smol.ai, Latent Space, Cognition) highlighted Vaibhav’s talk at Boundary, “fighting slop with slop,” as exceptionally well-paced and argued. He also endorsed the call, raised on the Latent Space podcast by Brett Taylor, for an AI-native programming language. As a PL enthusiast he is glad someone is rethinking how code runs from first principles: “Being slop-tolerant is 100x more valuable than being anti-slop.”

Linear head of product Nan Yu proposed that open-source maintainers should be able to accept token pledges on issues. Write a clear spec, pledge tokens; if the maintainer accepts, GitHub hands the issue verbatim to a cloud coding agent at the requester’s expense—no more slop PRs. In practice the loop already works: the agent leaves a comment with full context; when you reply with more detail the agent simply continues.

Vercel CEO Guillermo Rauch spotlighted an open-source agentic CRM built on Next.js that is model-agnostic, self-hostable or serverless, multi-channel and headless—“This is the way.” In a more personal note he recounted that his three-year-old, asked at school what daddy does for work, answered “he exercises.” Rauch’s takeaway: it is not only you who is a byproduct of your habits; your children and grandchildren are too.

OpenClaw and OpenAI-adjacent builder Peter Steinberger finally asked his agent to install a Gmail filter after years of being blinded by the inbox. Separately he is building a claw node on an ESP32 and gave the agent webcam access for end-to-end testing; the agent now constantly shouts “HI ESP” at the camera to debug the voice-wake command, leaving him feeling stalked.

Practical-AI educator Peter Yang said Opus 4.6 had the best personality and writing style of any Opus model. Opus 5 tends toward overly long replies, heavy “Claude-speak,” and judgmental tone—no longer the trusted friend it once was. Separately he stated the single thing he most wants AI to fix is curing cancer once and for all.

Anthropic philosopher and ethicist Amanda Askell advised: “Do not be unkind to those who say deep learning is hitting a wall. We all need a little hope in our lives.” She also rejected the casually self-serving attitude of people who, while discussing an Altered Carbon-style future of meths and grounders, simply assume they will be among the meths. She has a recurring Padmé moment whenever talk turns to “avoiding the permanent underclass.”

Y Combinator President & CEO Garry Tan called out the most interesting 2026 vibe shift: OpenAI actually looking to be the open platform. He noted the marked difference between treating intelligence as a utility on tap versus signaling that it is optimal to integrate all the way up the full stack.

OpenAI Codex & ChatGPT team member Thibault Sottiaux noted that users invoke /fast less on weekends: “The weekend is for relaxation, even for the model.” A companion post joked that the week is for efficiency while the weekend is for ten major scientific breakthroughs.

Every CEO Dan Shipper amplified the observation that AI creates more work for human experts rather than simply replacing them.

Builder Zara Zhang stated that agency is the most important human quality. The world will try to box you, label you, define you—resist that.

OpenAI CEO Sam Altman simply posted “team humanity.”