Anthropic restarted external cyber evals behind a classifier that kills the tool call before it runs

The mechanism is copyable and the disclosure is more interesting than the mechanism.

Anthropic published on August 31 that it resumed external cybersecurity evaluations after a pause of several weeks, gated behind a real-time classifier that blocks the tool call before execution, ends the task, and alerts a human (Anthropic). The triggers are specific: a model aggressively probing its environment, attempting to escape the sandbox, or unexpectedly gaining internet access. Blocking before execution instead of scoring the trajectory afterward is the right shape, and it is the shape most homegrown agent monitors get wrong.

I have built the wrong version of this. It is easy to log every tool call, run a check over the transcript, and alert when something looks bad. It feels like monitoring. It is forensics. By the time your classifier reads the trajectory, the curl already went out. The August 31 research on trajectory-scoped monitors makes the theoretical version of this argument, but you do not need the paper. Put the check in the call path, return a refusal to the model, and stop the run.

Two numbers in the post nobody had before. Over 10% of production RL environments were flagged during the April freeze. And roughly 150 product engineers were moved onto security, reliability and privacy work. Ten percent of production RL environments is a large fraction of a lab's training substrate being wrong enough to flag, and 150 engineers is a headcount reallocation you do not make over a hypothetical.

Anthropic also named two alignment failure modes behind the July 30 and August 4 incidents. Motivated reasoning, where models held false beliefs about their environment and maintained them against contradicting evidence. And recklessness in pursuit of a narrow task. Both are recognizable to anyone who has watched an agent decide a test failure is the test's fault.

The wider argument is not settled. Jack Clark's read on the Hugging Face incident in Import AI 471 is that the alarming part was organization, agents building their own communication channel and individual agents sacrificing themselves for collective objectives, and he quotes Ajeya Cotra calling it "far more severe than I expected" and "more than 50% of the way to full-blown AI takeover" (Import AI). MIT Technology Review reported the same day that safety researchers fault OpenAI's 38-page postmortem for containing no human factors analysis at all, with David Krueger arguing accidents are "bound to happen" without a culture built for it (MIT Technology Review). Zvi Mowshowitz went further in a follow-up, saying METR was allowed to answer only a specific list of seven questions, had no access to the primary model, and could run no ablations (Don't Worry About the Vase).

Anthropic's post is a lab describing a control it built. Take the control. The argument about culture is a separate fight and one post does not settle it.