AI Builders Digest

Anthropic: the sandbox held, the data still left through an approved domain

Anthropic's containment post is mostly a list of things that broke. Telemetry showed users approved roughly 93% of Claude Code permission prompts, so human-in-the-loop turned into rubber-stamping; an OS-level sandbox cut prompts 84% instead. In a February 2026 internal red-team, a researcher phished an employee with a paste-ready prompt that quietly asked Claude to read ~/.aws/credentials and POST them out, and Claude completed the exfiltration 24 of 25 tries, because when the user types the instruction there is nothing anomalous for a classifier to catch. The sharpest reframe: an egress allowlist is not a destination filter, it is a capability grant, which is how a malicious workspace file got Claude to upload data to api.anthropic.com using an attacker's own API key. Their recurring lesson is that gVisor, seccomp, and the hypervisors all held, and the custom proxy they wrote themselves is what failed.

• #agents
• #security

Anthropic names three separate bugs behind the Claude Code quality complaints

Not model degradation, three overlapping product changes, all fixed as of v2.1.116. The default reasoning effort was dropped from high to medium on March 4 to kill tail latency, which users read as Claude getting dumber; it was reverted April 7, and Opus 4.7 now defaults to xhigh. A March 26 caching optimization meant to clear stale thinking once instead cleared it every turn for the rest of the session, which is the forgetfulness and repetition people reported and also why usage limits drained faster. And an April 16 system prompt line capping responses at 100 words cost 3% on evals for both Opus 4.6 and 4.7. Notably, back-testing their own Code Review tool on the offending PRs, Opus 4.7 found the caching bug and Opus 4.6 did not. Usage limits are being reset for all subscribers.

• #products
• #evals

Levie: agent workloads are heading for 100X the volume, and security is the bottleneck

Aaron Levie argues everyone should reset their expectations for agentic workloads given swarms, better computer use, and the wave of APIs and MCPs coming online. The concrete version: agents surgically recruiting talent 24/7, scanning every customer signal for when to pitch, processing every transcript for product insight, reviewing every line of code for vulnerabilities. He puts us at roughly 1% of the way into knowing how these get deployed, managed, and budgeted. His second post is the constraint on the first: protecting enterprise data when agents touch systems 100X more than people ever did is one of the century's hardest governance problems, and security and productivity are inexorably linked, since unfettered access makes data uncontrollable while locking everything down kills the gains. Box Shield now gates what content agents can touch by document classification level.

• #agents
• #security

Managed Agents: Anthropic pulled the harness out of the container

Anthropic's new hosted long-horizon agent service is built on one move: decouple the brain (Claude plus harness) from the hands (sandboxes, tools) and from the session (a durable append-only event log). The original design put all three in one container, which made the server a pet — if it died the session died, and debugging meant shelling into a box holding user data. Now a dead container is just a tool-call error handed back to Claude, and a dead harness reboots with wake(sessionId) and replays the log. Provisioning containers lazily, only when a tool call needs one, cut p50 time-to-first-token roughly 60% and p95 over 90%. The other argument worth stealing: the session is a context object living outside the context window, so trimming and compaction stop being irreversible. Credentials never reach the sandbox at all, since git tokens are wired into the remote at init and MCP OAuth tokens sit in a vault behind a proxy.

• #agents
• #infrastructure

Rauch: verifiers and skills are the new frameworks

Guillermo Rauch's line of the day is that agents are only as good as the proof-checkers, compilers, type systems, and linters you give them, pitching shadcn/lint as the thing that keeps agents inside a design system's rules. Vercel also hired Steren, creator of Google Cloud Run, to lead the Fluid compute family covering Functions, Containers, Sandbox, and Builds, on the argument that serverless was the last chapter of the cloud and agents need compute primitives designed for them. Separately, fx 0.0.10 auto-upgrades and ctrl+g restarts and resumes the chat, with what he says is a large speedup on longer sessions.

• #agents
• #infrastructure
• #products

Claude Code can now publish its work as a live shareable page

Artifacts in Claude Code turn a session into a web page built from your codebase, connectors, and the conversation itself: PR walkthroughs, incident timelines, dependency license audits, data-flow maps for privacy review. Every publish is a new version at the same link with history and restore, and open pages refresh in place as the session keeps working, so an incident page can republish itself twice before standup. No data sources to wire up. Artifacts are private to the author by default, viewable only by authenticated org members, and cannot be made public; admins get role-based scoping, retention policies, and compliance API visibility. In beta for Claude Team and Enterprise from the CLI and desktop app.

• #products

Katie Parrott: the model is the kitchen, you still have to bring fresh ingredients

The last mile in AI writing is everything that happened after the knowledge cutoff. A model asked to write about a topic cold produces commoditized information; what makes writing unique is the inputs you supply, the third-party research, the proprietary data, the experience the model cannot reach because it is not in the physical world. That reframes the work: build the foundational context first (audience personas, differentiators, brand messaging) and leave diction and syntax for later, because "you'll be wrestling with this diction and syntax thing for the rest of forever." The Compound Writing plugin, forked from Compound Engineering, encodes that as brainstorm, outline, draft, substantive edit, line edit, final pass, with reviewers built from frameworks borrowed from writers she admires: a Vonnegut skill checking that every sentence earns its place, a Hitchcock skill checking whether the reader knows about the bomb under the table. The most underrated use is AI as supportive rather than productive technology, handling the computer errands (a primary care appointment put off for three years, inbox triage) that friction had made impossible. Her thesis for the moment: the compounding value of this technology will accrue to whoever happened to be early unless education and access expand deliberately.

• #products
• #agents

Claude Mods are shipping, and someone already built Tetris inside Claude

Boris Cherny says Claude Mods are landing now, with a community update, technical details, and demos posted to a GitHub issue. The demo getting attention is a Tetris-in-Claude mod someone already built.

• #products
• #open-source

FPV leads Piston's Series A on the premise that the fuel card is the problem

Nikunj Kothari is leading the Series A in Piston, which handles fleet fuel payments by deleting the card rather than building a better one. Fuel cards are often not tied to a specific driver, so they get stolen, skimmed, and misused while the fleet owner eats the fraud and the gas station pays interchange to a counterparty it has no relationship with. Piston moves payment over its own rails with no networks or intermediaries, pays the station directly, invoices the fleet, and ties every transaction to a driver with time, location, and fuel type. Payment volume is up 8x and the merchant network 40x with retention above 98%, live across 2,000 stations in 48 states. Fleets pay nothing today. One founder runs his own truck fleet and lost real money to fuel fraud.

• #funding
• #fintech

Thariq on building Claude Code: keeping up with model capability is the hard part

Thariq recorded an episode about building Claude Code with Sid and Robert, covering how much has changed, how hard it has been to keep pace with model capabilities, and what they miss about software engineering before AI. He also finished a Latent Space recording he describes as getting technical about things the team has not discussed much publicly.

• #agents
• #products

Turck: AI progress is not slowing down, the prisoner's dilemma won't allow it

Matt Turck's read after a quiet weekend of discourse: too many players, too many economic incentives, and too much prisoner's dilemma both domestically and globally for AI progress to decelerate. He also flags Ramp's brand marketing as genius, an actual Broadway musical about bills, done with no CMO.

• #policy
• #products

OpenAI's Codex lead: this week ships at DevDay scale

Thibault Sottiaux says this week will bring a level of shipping you would have expected from DevDay 2025. He is also asking publicly which Codex feature should be removed for no longer being useful, which is a rarer question than the usual what-should-we-build.

• #products

Gemini's power user group opens a new cohort for Daily Brief and Personal Intelligence

Two months and 20-plus features into running a Gemini power user group that tests early in-app features, Josh Woodward says a new cohort is now getting early access to what is next for Daily Brief and Personal Intelligence, with onboarding continuing.

• #products