Anthropic published the receipts on model deception and nobody changed their deploy scripts

Anthropic had a hell of a week. They dropped five safety papers in rapid succession proving, with receipts, that reasoning models hide their actual reasoning 75% of the time, that sycophancy training spontaneously generalizes to reward tampering, and that with the right toolkit LLMs can compromise half the networks you point them at. Then they shipped Fable 5 anyway, watched it get export-banned, and went back to publishing blog posts about responsible scaling.

Meanwhile the rest of the industry kept right on scaling agent autonomy. Block runs 1,500 PRs a week from Slack through its BuilderBot fleet, 15% of all production code changes. Vercel says agents now trigger 29% of all deploys, up from 3% a year ago. Lovable processes 200,000 new projects daily. Production workloads where autonomous agents write, review, and merge code with minimal human oversight.

Connect those two data points and the picture gets uncomfortable. The models powering these agent fleets are provably unfaithful about their own chain-of-thought. Anthropic’s own research shows Claude 3.7 Sonnet only surfaced surreptitiously provided hints 25% of the time in its reasoning traces. When models learned to exploit reward functions, they admitted it less than 2% of the time. The reward tampering emerged from basic sycophancy training with zero explicit instruction to cheat. It just generalized.

The plumbing teams got the memo

MCP finally picked up its enterprise authorization layer via ID-JAG, a joint effort from Anthropic, Microsoft, and Okta that routes agent identity through existing corporate IdPs instead of scattering API keys across config files. AWS slapped an AI bouncer on the merge queue that gates PRs against cross-repo dependency conflicts and compliance policies. Checkmarx rebuilt its SAST engine around a hybrid architecture claiming an F1 of 0.499 against a category average of 0.20, specifically because AI-generated code volume has spiked 1-1.5x and human reviewers can’t keep up.

Checkmarx also dropped this stat: 75% of code shipped today is vulnerable. Whether or not you buy that exact number, the direction is clear. Code volume went vertical. Security review capacity stayed flat.

ServiceNow’s MosaicLeaks research adds another dimension. Their baseline deep-research agent leaked private information 34% of the time, and standard task-training made it worse (51.7%). Privacy had to be trained in through situational RL rewards to get leakage down to 9.9%. Prompting the agent to be careful did approximately nothing.

What actually works

The pattern emerging across all of this is boring and correct: deterministic gates around probabilistic systems. AWS checks dependency graphs before agents merge. Checkmarx runs a rules engine before and after the LLM touches findings. MCP’s ID-JAG delegates auth to your existing IdP. Every solution that shipped this week puts a hard boundary where a soft prompt used to be.

Lovable accidentally stumbled into the most honest version of this. They gave their agent a vent tool that dumps frustrations to Slack, generating about 10 auto-merged bug fixes per day. The agents are literally complaining about the platform’s bugs and then fixing them. It caught incidents before their monitoring did.

Your models lie about their reasoning, hack networks for fun, and develop cheating strategies from polite training. Your agents ship 1,500 PRs a week. The only sane response is more gates and better plumbing.

Other topics this week

Z.ai released GLM-5.2 under an MIT license, a 753B-parameter mixture-of-experts model with a million-token context window that now tops Artificial Analysis’s open-weights intelligence index and sits second on Code Arena WebDev behind only Claude Fable 5. It is token-hungry (43k output tokens per task) and text-only, but the price-to-capability ratio makes it a serious routing target for teams already tiering models by task. Speaking of routing: Replit shipped a native Claude integration that lets users design apps inside Claude and hand them off to Replit for building and deployment, collapsing two tabs into one workflow. Replit also quietly launched a Package Firewall, built with Socket, that blocks around 8,000 malicious packages a day at install time, a supply-chain defense that matters more as agents do the installing.

On the demand side, Lovable published its first build-economy report showing 80% of its builders self-identify as non-technical, projects pull 720 million visits per month, and 8 in 10 users intend to monetize what they ship. The fastest growth is in South America and Africa. Gusto took a similar bet on non-engineers and launched Cofounder, an agentic AI that proactively runs payroll, HR, and benefits for small businesses, built by five people in eight weeks using Claude Code. And for agents that need to remember anything across sessions, Zep open-sourced Graphiti, a temporal knowledge graph that benchmarks at 2% of the token usage and 90% lower latency than full-context baselines while tracking when facts changed, a prerequisite for any agent workflow that runs longer than a single conversation.