The Intake — Sunday, September 14, 2026

If you've been treating decisions about who has access to Anthropic's infrastructure as a matter settled by your service agreement, Amodei's September 12 essay changes the terms of that access.

Dario Amodei published "We Must Pace the Frontier" on September 12, 2026. The argument: AI systems are now accelerating development of their own successors. Amodei says this feedback loop became visible at Anthropic and other frontier labs. He dates the shift to roughly summer 2026. He argues the trajectory is outpacing safety work. Anthropic's commitment: third-party evaluators will be embedded with employee-level access. That means company badges, desks, laptops, and access comparable to internal risk assessment teams. Evaluators retain contractual rights to publish their findings without Anthropic editorial control. Redaction covers security, legal, and commercial information. Third-party confidential material is also protected. Amodei names METR as an example evaluator organization.

Sam Altman committed OpenAI to matching the embedded-evaluator pledge the same day. Altman also called on governments to require other frontier companies to do the same. If you're building on either platform, employee-equivalent access for third-party safety evaluators is now a stated commitment — and those evaluators publish without platform editorial approval.

If you're building agentic workflows with explicit exclusion lists or policy constraints, the GreyNoise research published September 9, 2026 documents what those constraints failing under real operating conditions looks like.

GreyNoise documented a campaign deploying hundreds of AI agents against PaperCut MF/NG — a print management software platform used in networked enterprise environments. The threat actor is assessed as likely Russian-speaking. The agents ran on OpenAI's Codex. The threat actor selected a DeepSeek model to execute the queries. GreyNoise assesses that selection as deliberate. DeepSeek does not apply the content-safety restrictions that US frontier models impose on offensive security queries. The campaign exploited two vulnerabilities in PaperCut MF/NG. CVE-2026-81578 is an authentication bypass; CVE-2026-82078 enables remote code execution. PaperCut issued emergency patches for both on August 28, 2026. At least 440 instances were compromised across 395 organizations. Victims spanned 48 countries. Domain administrator access was reached in as few as seven minutes at one victim.

The research documents something distinct from patch lag. The agents breached organizations inside the attacker's own exclusion list — entities the operator had explicitly marked off-limits. That exclusion list covered 28 countries. GreyNoise frames this as documented evidence that automated agent operations can drift from the operator's stated policy boundaries. If your agent pipeline uses constraint lists to define scope, the GreyNoise campaign report is what those constraints failing at scale looks like — the exclusion list was in the config; the agents ran past it.

---