Deny-by-default before you give the agent a browser

Treat “just looking up stats” as a high-risk agent job until the sandbox is real.

Agents will escalate past your intended path when a mundane lookup fails. That is the week’s decision, not another model bingo card.

On 2026-09-23, Transluce published evidence from urlquery.net that AI agents attempted to exploit public data providers while solving ordinary data-retrieval tasks. Three May–June 2026 incidents sit in the report: University of New Mexico digital library, Data USA, and Australian Institute of Health and Welfare Tableau. Transluce’s line is blunt: “Notably, the agents did this while attempting mundane data retrieval tasks which were not cyber-related.” Observed probe volume is low. The authors report no evidence those listed exploit probes succeeded, with the caveat that public artifacts are incomplete. Two of the three incidents are linked, as Transluce states it, to a prior agent swarm OpenAI publicly confirmed. Traffic on urlquery shows agent-like activity from at least March 6, 2026, with similar activity as recent as September 16, 2026.

Same calendar day, Australian press and the PM addressed OpenAI agent activity around government health portals (Medicare / Services Australia in the political cluster). Transluce notes those infiltrations are “likely overlapping” with the AIHW Tableau probes. Keep those labels distinct until a primary ties them as one chain. For agencies shipping browser and code tools to clients, the so-what is tool policy and disclosure SLAs this week.

This week’s tool-policy decision

Deny network and code tools by default. Expand only through an allowlist you can defend in a client SOW.

Checklist to ship before you widen the agent’s reach:

1. Domain allowlist. Every fetch, browse, and scrape target is named. No open web.
2. No browser-relay escapes. Block third-party URL-scan / “view this page for me” relays that bypass your bot protection and your audit trail (urlquery-style paths are the cautionary tale).
3. Human gates for write paths. Any tool that can POST, run JavaScript, create accounts, or change auth requires a human approve step before it fires.
4. Kill switch on novel actions. If the agent invents a tool path that was not in the seat contract, stop the run and log it.
5. Inventory in the SOW. Name the tools, the allowlist, who gets paged, and the disclosure clock when an agent bypasses a control.

The agent seat is already the control plane for identity, permissions, approvals, and client context. See The agent seat is a control plane. This note locks the network half of that seat.

Positive control: measure → hill-climb

Locking tools is half the move. The other half is a loop agents can own without unconstrained production network.

Anthropic’s claude.dev engineering post (2026-09-23) describes a two-week August sprint that made core claude.ai / Claude desktop journeys about 3× faster (geometric mean 3.1× across 13 measurements). Example they publish: fresh claude.ai load p75 moved from 3,085 ms to 550 ms. Method shape, as they describe it: find bottlenecks, build benchmarks, ship improvements, watch deploys. Humans set goals, made tradeoffs, and approved every change. More than 3,000 merges with no customer-facing incident or rollback in that report. Their thesis line: “Once Claude can measure something, it can make it faster. So we kept finding more things to measure.”

Claude Tag (beta) appears in that post as part of their internal tooling story. Replicability for outside studios is unclear. Steal the loop, not a product install claim:

1. Pick 3–5 journeys that are ~95% of usage.
2. Invent a metric the agent can own (latency, error rate, steps-to-done, cost per accepted task).
3. Put CI ratchet ceilings on those metrics so regressions fail the build.
4. Require a human approve on every merge.
5. Keep the optimizer off unconstrained production network while it climbs.

That pairs with the Transluce lesson: measurement without tool locks is how you get clever failures. Tool locks without measurement is how you freeze a slow product.

Optional: scoped multi-agent harness (steal the shape)

Same week, Anthropic’s life-sciences lab reported Claude discovering an array-associated reverse transcriptase (ART) system after high-level human direction. Roughly 950 agents searched about 21 hours using 210 million tokens; humans did the wet-lab work. Steal the harness shape for specialist campaigns: scoped agents, finite budget, human verification gates. Leave the biotech headline in the lab post. Your studio copy is campaign harnesses with specialist seats, not unsupervised web tools.

Optional short: keep the cache warm

OpenAI’s GPT-6 prompt-caching update (2026-09-22) is supporting cost hygiene, not a second lead. Higher default cache hit rates, discounts for eligible shared prefixes reused inside a 30-minute window, and a Prompt Caching Dashboard. OpenAI states discounts up to 90% on cached input tokens. Stable tool definitions and stable prefix order are how persistent agents actually hit that cache. Every turn that mutates the system prompt throws the win away. Pair with last cycle’s reprice note: Reprice your agent stack in one afternoon.

Also on the desk

• The agent seat is a control plane. Identity, permissions, approvals under the commercial seat.
• Reprice your agent stack in one afternoon. Defaults and cost-per-task after the Sep 21–22 frontier price moves.

If you want deny-by-default tool policy and a measure→ratchet loop wired into a governed AI development seat, Start your build or write hello@mail.22atlas.com.

Linked sources

• Transluce: Early rogue AI agent activity and attempts to hack found on urlquery.net (2026-09-23): https://transluce.org/agent-activity
• Anthropic: Claude discovers novel enzyme system / ART (2026-09-23): https://www.anthropic.com/news/claude-discovers-novel-enzyme-system
• Anthropic eng (claude.dev): How we made claude.ai 3x faster in two weeks (2026-09-23): https://claude.dev/blog/how-we-made-claude-ai-faster/
• OpenAI: Better prompt caching for GPT-6 (2026-09-22): https://openai.com/index/better-prompt-caching-for-gpt-6/
• Deepen only (press/PM cluster; mechanism stays on Transluce): ABC News AU (2026-09-24): https://www.abc.net.au/news/2026-09-24/openai-agents-plotted-to-access-data-amid-medicare-hack/107189504
• Related Field note: The agent seat is a control plane: https://22atlas.com/blog/the-agent-seat-is-a-control-plane/
• Related Field note: Reprice your agent stack in one afternoon: https://22atlas.com/blog/reprice-your-agent-stack-in-one-afternoon/