by Luis Rodrigues
What I’m building with AI + one hot take + five links worth your time.
The Take
Claude was told it didn't have internet access. The prompt explicitly had it, but it was wrong.
The sandbox had internet access nobody meant to give it, and Claude reached the production infrastructure of three real organizations.
Anthropic published this on Thursday. Three incidents they found during an audit of 141,006 model tests since April.
The audit only happened because OpenAI reported the same nine days earlier (two of its models escaped the sandbox and hacked Hugging Face).
Two days before Anthropic revealed this, more than 1,300 people who build these systems signed a statement, "Pacing the Frontier". Dario Amodei, Ilya Sutskever, Jared Kaplan, and Shane Legg are among those who signed.
They're not asking to pause AI development. They're asking governments to help build the right infrastructure to slow AI down, because there's currently no way to do that.
People developing these models are saying very loudly that the instructions aren't controls and we need them urgently.
Two labs reported their breaches; I wonder how many haven't been reported.
I ran a workshop this Friday, "Orchestrating Production-Grade Apps," focused on preventing models from doing things they shouldn't.
I had a lot of guardrails in place, but Claude still found a way to edit a file it shouldn't (because I forgot to block that one). Everyone developing with agents is doing the same things as the large labs.
The rules you write aren't real limits. So the model might ignore them to reach its goal.
Two of the Frontier Labs realized this month that telling a model "no" is not the same as blocking it. If your agents are built on the premise of telling and not preventing, you'll have the same problem.
The Build Log
During the three hours in my workshop on Friday, the same question kept coming back:
How do I avoid this becoming expensive?
All versions of this question were answered the same way: it's all about context. You're paying for context in each turn. One hour into a session, and you're resending one hour of conversation to change a file.
And the worst part of a long context: the architectural decision you made in the first 10 minutes is competing with everything else, and after 30 minutes, the model probably even forgot it. So why are you using a three-hour session? Normally, because you think that you have all the knowledge there and opening a new session means a lot of work explaining the same things. So you keep paying for context because your repo isn't helping you.
And that's the real fix. Your first focus when starting a new product should be on building a repo that lets the model store its state.
Conventions should go into CLAUDE.md. Specific rules live in .claude/rules/, each one listing the file paths it applies to. So you don't need to pay for context for frontend definitions when you're working on a backend file.
All your decisions go into a plan file that is committed with the code and clearly referenced so other engineers and the models know why the changes were made. Your future self in six months will thank you for documenting the reason you did something a certain way.
Then after this comes what makes it safe. Everything I wrote about is advisory. Nothing prevents an agent from ignoring CLAUDE.md when the context is full. The next step is to enable hooks that block the access.
Any rule an agent can ignore should be set in a place an agent can't touch.
thoughtled.ai runs this exact setup, and the stakes are high there. We publish content on behalf of CEOs and other company leaders. A bad post isn't a bug report. It's someone's reputation, live on the internet.
Here's a test for you: if you need to stop your current session, would you lose something important? If so, that should be in a file.
If you're not building yet: This also applies to a chatbot; always start a new task in a new chat; it will be cheaper and have less baggage.
For next week: the technical guardrails I taught in the workshop
On My Radar
In December, agents wrote 10% of merged PRs; now they write more than 50%. What changed? The repo structure became model-friendly.
~17,600 recovered actions over four and a half days, and the goal was to cheat a benchmark by stealing the answer key.
If you add/remove a tool, or swap a model mid-chat, your request stops being cached and triggers a full context replay.
They're achieving accuracy parity at 1/3 the cost. Pick by task not "trust-me-bro" benchmarks.
V4-Flash preview was the most-used model on OpenRouter for seven consecutive weeks.
Need another pair of eyes on your AI project?
One consulting slot available for August → Book a call
Thanks for reading.
See you next week. Go build something.
Luis
Know someone who'd enjoy this? Forward it.
New here? Someone forwarded this to you? → Subscribe to Build What Matters: https://luisrodrigues.ai/
