More agent work needs checkable boundaries
– · 2 min read
A retrospective selection, researched on . This edition ends at the quarter boundary on 30 September.
The quarter’s final three days connect new models, runtime controls and a public hearing on incidents. This selection ends on 30 September and contains no October events.
Capability and access are different decisions
Anthropic introduces Sonnet 5.5 on 28 September for well-scoped everyday work; speed and cost claims come from vendor tests. Sonnet announcement. On 30 September, Google announces Gemini 4 Argon with initial Fairwind access for trusted cyber defenders. Argon publication. A model launch and later availability in another application remain separate events.
A boundary outside the model
On 28 September, NVIDIA announces a platform containing OpenShell and the Sentry reference architecture, combining execution controls and independent monitoring. The announcement does not prove a universally safe agent environment. NVIDIA announcement.
Our example: an agent should fix a problem in a test system. It receives the relevant code and test-environment access. An external control can specify which files and network destinations are reachable. If it attempts another connection, the control needs to decide about that action; a chat explanation is insufficient. The assignment’s output remains a checked change. The boundary answers another question: which actions were permitted along the way?
Incidents enter the public debate
On 30 September, METR president Chris Painter testifies before a US Senate subcommittee about agent incidents. Earlier attacks retain their original dates; the hearing is the new event. Published testimony.
Our interpretation this week: more tool access increases the importance of concrete permissions, observable actions and checkable outputs. This implies neither that every agent wants to attack nor that another safety layer resolves every problem. The practical task is to compare authorized work with the actions actually carried out.
A new model name does not answer the permissions question. Check the assignment, authorized access and actual actions separately.