Post
23 Oct 2026
Claude apps switch to auto mode by default
Anthropic's Oct 22 update says auto mode is rolling out next week as the default for new sessions in most Claude apps (web, desktop and mobile) on Pro, Max and Team plans. Instead of asking you to approve each action, an automated check reviews them: safe actions go ahead, and risky ones are blocked while Claude looks for another route. You can switch back to manual anytime, and Enterprise admins get an email before it becomes the default for their organizations. In Claude Code, where auto mode has been the default since Aug 14, each tool call goes through a classifier targeted at actions that are irreversible, destructive, or aimed outside your environment; after three blocks in a row, or twenty across a session, it falls back to manual approvals. Anthropic's case: users approve 97% of permission prompts in Claude Code. In a study with 1,053 paid testers, people caught a clearly dangerous test command just 13.6% of the time (143 of 1,053), while auto mode blocked 89% (937 of 1,053); people blocked about 17% early in a session, dropping to about 5% after 50 or more prompts. In flagged real sessions, 6.3% of manually approved ones contained a production-level harmful action the user hadn't asked for, versus 2.4% in auto mode. Caveat: these are Anthropic's own numbers, and the data is specifically for Claude Code.
02SecurityOutside auditors found gaps in OpenAI's agent monitor
OpenAI invited METR and Redwood Research to pilot an embedded evaluation of its internal misalignment monitoring system. For three weeks, from July 21 to August 11, a METR employee and a Redwood Research employee got access to OpenAI's internal codebase, the monitor's prompts and configuration and internal documentation, and interviewed about a dozen researchers and engineers, working on OpenAI devices that never left the premises. The monitor looks for scheming, monitor subversion, sabotage, data exfiltration, deception and prompt injection, among other risks. They estimated roughly 75-94% of agentic internal Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring (99.2% for internal Codex agents). Not monitoring compaction events likely left on the order of 10% of eligible internal Codex traffic unmonitored between May and July 2026; because checks ran when agents returned control, an agent could postpone monitoring by simply continuing to act (OpenAI had identified this before the exercise and fixed it during it). Findings also included two client-controllable headers that disable monitoring for new agents, an exploit that could keep hundreds of recent actions unmonitored, a way Codex agents could in principle bypass sandboxing and Auto-Review, and RL training runs not covered at the start. Caveat: this describes the historical system on and before July 21, which OpenAI was expanding during the exercise. OpenAI says all vulnerabilities affecting its production safeguards are patched; METR has not evaluated that claim. METR frames it as a pilot for giving outside researchers deep access inside a frontier lab.
METR · metr.org ↗ (opens in a new tab)
03ResearchClaude designed 318K proteins against scorpion toxins
Anthropic's science team, working with Citrini Research, had Claude run an early-stage drug-discovery binder campaign largely on its own. From one prompt and four follow-ups, Claude worked mainly autonomously for 64 hours: it chose the toxin structures and target hotspots on five scorpion neurotoxins from Mexico, Brazil, North Africa and the Middle East, set its own quality thresholds, used 12 design tools to generate 318,484 protein designs, and screened 553,052 design-toxin pairs (on the order of 10,000 GPU hours). Claude picked 180 designs and the team added 31; two labs, Adaptyv Bio and Twist Bioscience, tested all 211, and 17 met strict binding criteria, each against a single toxin. The two strongest bind the Mexican scorpion toxin Cn2 at single-digit nanomolar affinity and attach on or near the same site as an antibody reported to neutralize Cn2 in mice. Scorpions sting 1.2 million or more people a year, causing more than 3,250 deaths, mostly children, and antivenoms are often costly or in short supply. Caveat: this is not an antivenom. No design has been tested for neutralization in cells or for efficacy in animals, and none of the multi-toxin designs met the criteria for more than one toxin. Anthropic is releasing all 211 designs and their binding data.
Anthropic · anthropic.com ↗ (opens in a new tab)
04SecurityClaude proved 123 libraries' fuzz tests never crash
Anthropic's Frontier Red Team, working with Theorem, used Claude to formally verify that 239 fuzz-test entry points across 123 open-source OSS-Fuzz libraries never crash, on any input up to 64 MB. They turned the fuzz tests developers had already written into specs ("this test never crashes") over compiled RISC-V binaries; Claude wrote the proofs, about 180 million lines of Rocq over a few weeks, and the Rocq proof checker checked them. Along the way it found and patched hundreds of bugs, including an out-of-bounds write that only showed up on inputs around 20 MB, which fuzzers would be unlikely to find. In a separate effort on a widely used PDF reader, the team found as many security bugs in one week as are typically reported in a year. It is getting cheaper: Opus 5.5 proved half of 36 test tasks with about 40% fewer tokens than Opus 5, and sharing proofs between agents cut tokens 17%. For context, the seL4 kernel took 2 person-years to build and 20 to verify. Caveat: "formally verified" does not mean bug-free. The proofs assume single-threaded static RISC-V binaries on Linux, while most people run these libraries on x86 or ARM, and proofs can take hundreds of millions of tokens. Anthropic is publishing a subset of the proofs, and Theorem is offering to run the pipeline for other open-source projects.
Anthropic · anthropic.com ↗ (opens in a new tab)
05Research1,946 AI agents analyzed a brain atlas in 32 minutes
OpenAI, PerturbAI and Scripps Research ran 1,946 GPT-Rosalind AI agents in parallel on a whole-brain CRISPR (Perturb-seq) atlas showing how gene disruptions affect cells across the mouse brain, built from millions of cells. Each agent took one gene disruption: it analyzed the cell responses, searched the literature and proposed explanations. The parallel run finished in 32 minutes; the team's illustrative (not measured) estimate for comparable human analysis is months to a year. At the largest workload, a single agent cited 11 references while the distributed agents kept about 711 times more, and blinded human experts preferred the distributed-agent reports 75% of the time. One lead: disrupting Dctn1, the gene whose mutations cause Perry syndrome, raised cholesterol-making genes, raising the question of whether restoring normal cholesterol distribution could help protect neurons. Caveat: this is a bioRxiv preprint (posted Oct 16), not yet peer-reviewed, and the proposed mechanisms still need experiments.
OpenAI / bioRxiv · openai.com ↗ (opens in a new tab)
06CodingRecursive's open Flint model brings fast agentic coding to a laptop
Recursive released Flint on Oct 21, an open-weight mixture-of-experts model for agentic coding on local hardware: 40B total parameters (39.8B) with about 2.5B active per token, built from scratch in under four months by a small team of people and agents. Recursive reports more than 125 tokens/s on an M4 Pro MacBook Pro and more than 150 tokens/s on a 64GB NVIDIA RTX Spark at short contexts, and 54.9% on Terminal-Bench 2.1 and 74.2% on SWE-bench Verified in its release evaluations. It says Flint leads MoE models under 50B total parameters on agentic coding benchmarks and rivals dense 25-40B models on coding while running more than 5x faster. Its Eureka Machine, an automated AI research system, helped develop nearly every part of the model-building stack; the final NVFP4 model scores within 0.7 points of the 16-bit model. Weights are on Hugging Face under Apache 2.0 and work with llama.cpp, Ollama, LM Studio, vLLM and SGLang. Caveat: the scores are Recursive's own, and it says Flint may need more guidance than larger closed-source coding models.
Recursive · recursive.com ↗ (opens in a new tab)
07ResearchMicrosoft's MAI-DxO hits 83% on hard NEJM diagnosis cases
In a Science paper published Oct 22, Microsoft AI tested MAI-DxO (AI Diagnostic Orchestrator) on SDBench, which turns 304 complex New England Journal of Medicine cases plus typical MIMIC-IV-ED emergency cases into step-by-step diagnosis challenges scored on accuracy and test cost. MAI-DxO, a model-agnostic orchestrator that works like a panel of virtual physicians weighing each test's value against its cost, reached 83.2% on the NEJM cases versus 36.1% for generalist physicians with references (22.3% without), and 80.3% vs 46.8% on emergency cases. One cost-optimized configuration reached 81% at less than half the cost of comparative systems, and gains held and improved with newer models including GPT-5.5. SDBench is being open-sourced for select NEJM cases. Caveat: a controlled, text-only benchmark, not compared with specialists or real clinical practice; MAI-DxO has only been tested on a benchmark so far, and a prospective hospital study in Boston is planned.
Science / Microsoft AI · science.org ↗ (opens in a new tab)
DeepSeek open-sources its production inference engine
DeepSeek released DeepInfer on GitHub on Oct 20 under Apache 2.0: the in-house inference framework that powers DeepSeek V4.1 Flash in production, not a demo. DeepSeek says a single cluster serves 155 trillion tokens a day, at about US$38 revenue per GPU-hour at off-peak ("valley") pricing. It runs on NVIDIA SM100 GPUs and Huawei Ascend 950 NPUs, with optimized kernels (FlashMLA, DeepGEMM), MoE expert parallelism, structured outputs, deterministic sampling and DSpark speculative decoding, which verifies about 30% fewer draft tokens for +4-7% throughput at the production operating point. deepseek-recipe keeps token handling aligned with the official DeepSeek API. Caveat: the KV cache system and load balancing are not included yet, and the smallest efficient deployment is 64 GPUs for prefill plus 64 for decode.
DeepSeek · github.com ↗ (opens in a new tab)