Anthropic measured how many dangerous commands developers catch when they click approve. The answer was 13.6%. Britain's employment tribunals took 39% more claims in a year, many of them written by chatbots citing laws that do not exist, and Interpol linked AI to 55% of reported cybercrime in Africa. Three measurements, one week, and all three are about a check somebody assumed was working.

Summary: On 8 August Anthropic said Auto Mode becomes the default in Claude Code from 14 August for Pro, Max and Team plans, with Enterprise having to opt in. Instead of asking permission at each step, Claude Code runs and a classifier stops the actions it reads as dangerous or irreversible. The number behind the change came from a test with 1,053 paid users: human reviewers caught 13.6% of dangerous commands, the classifier caught 89%. Anthropic still recommends reviewing changes to production infrastructure yourself.

Why it matters: 13.6% is the finding here, not 89%. The approval prompt is the control most teams point at when someone asks how their agents are supervised, and it was catching about one dangerous command in seven. The vendor ran the test, the vendor scored the classifier, and the classifier is the vendor's product. The human half of the result needs no such caveat. Anyone who has clicked approve forty times in an hour already knows why it came out at 13.6%.

What to do:

Source: The Decoder

Summary: The Economist reported, and The Decoder picked up on 9 August, that claims to Britain's employment tribunals rose 39% in the year to March 2026 while the backlog rose 55% to 64,000 open cases. Applications for interim relief are up roughly a hundredfold. Tribunal presidents Barry Clarke and Susan Walker describe filings running to hundreds of pages, listing dozens of claims at once and citing statutes that do not exist. Workers are drafting them with ChatGPT and Grok rather than hiring a solicitor, and the Employment Rights Act adds around 25 new grounds to claim on.

Why it matters: The cost of filing a claim fell to almost nothing. The cost of answering one did not move. That asymmetry lands on employers as time, because a 200-page claim listing 60 allegations has to be read, sorted and answered even when most of it was invented by a chatbot. Fabricated case law does not help the person who filed it either, so both sides spend weeks on documents nobody meant to write. If you employ people in the UK, your exposure this year is the cost of processing claims that were cheap to write and expensive to answer.

What to do:

Source: The Decoder

Summary: Interpol published its African Cyberthreat Assessment on 3 August. AI is now linked to up to 55% of reported cybercrime across the 36 member countries surveyed, and losses doubled from $192 million in 2024 to $484 million in 2025. Scam centres operate in 72% of those countries. The report records AI-generated deepfakes and synthetic identities getting past biometric checks, and business email compromise written well enough to pass, aimed at victims in Europe and North America. Neal Jetton, who runs Interpol's cybercrime directorate, said AI is automating every stage of an attack, "from reconnaissance and phishing to extortion and evasion."

Why it matters: The targets in that report are here. Business email compromise arrives through the finance inbox, and the things that used to give it away - broken English, a wrong logo, a voice that sounded off - have been fixed. Face and voice verification is the specific casualty. An identity check a deepfake walks through is worse than no check at all, because your team stops asking questions the moment it clears.

What to do:

Source: Interpol

Summary: Villanova researchers published a set of experiments in Judgment and Decision Making using six short stories: three by human authors published in literary journals, three ChatGPT rewrites of the same stories. Readers scored the AI versions higher on quality and immersion, 1.54 against 0.97 on a scale running from minus 3 to plus 3. They also scored any story higher when told a human wrote it. Asked to spot which was which, participants managed 39.9% in one experiment and 51.9% in another.

Why it's interesting: The label moved the score more than the writing did.

Key takeaway: If you disclose AI involvement in your content, expect a penalty that has nothing to do with quality, and price it in.

Source: The Decoder

Summary: The New Yorker reported on 9 August how fraudsters enrol as students at US community colleges, mostly in asynchronous online courses, collect financial aid and run enough of the coursework through AI to stay enrolled. David Song at East Los Angeles College noticed a run of names that did not match his intake. California's community colleges put fraud losses at roughly $13 million in 2024, up from $7.5 million the year before, and the Department of Education says more than $350 million has gone this way over five years, with around 200 investigations open.

Why it's interesting: The colleges' own proof that a student is real is the coursework, and coursework is the part AI made free.

Key takeaway: Any process that verifies a person by watching them produce work needs a second check that does not rely on the work.

Source: The Decoder

Summary: Stanford and Arc Institute researchers used Evo, a biological language model trained on around 9 trillion nucleotides, to design bacteriophages. The model proposed roughly 700,000 genomes, 285 were synthesised as DNA, and 16 replicated in the lab, some killing E. coli strains that had resisted the natural phage. The work appeared as a preprint last September and was published in Science this week. The team excluded human pathogens from the training data deliberately. J. Craig Venter called the result a faster version of trial and error and warned about the same method pointed at dangerous viruses.

Why it's interesting: Sixteen out of 285 is what a first attempt looks like in a field where the answer used to be zero.

Key takeaway: The safety control here was the choice of training data, made by the researchers themselves. Nothing outside the lab required it.

Source: The Decoder

Backflip AI CAD Copilot - turns 3D scans, STLs and mesh files into editable parametric CAD with a full feature tree, as an Autodesk Fusion add-in or a standalone web app. Backflip puts the cost of reverse-engineering a part at about $10 against roughly $1,500 done by hand. Best use case: you have physical parts and no drawings. backflip.ai

TrustScale Argus - scores each claim in an AI output against evidence and suggests corrections, instead of asking a second model whether the first one was right. The accuracy figures are the company's own. Best use case: teams publishing AI-drafted research or client work. trustscale.ai

Helium 10 MCP - connects Amazon seller data, product, keyword and ad performance, to Claude or ChatGPT so you can ask questions instead of reading dashboards. Included with Diamond plans, and the underlying figures are Helium 10's estimates, not Amazon's reported numbers. Best use case: sellers still building weekly reports by hand. helium10.com

Trustmi AI Investigation Agent - works suspicious payments across email, ERP and vendor records, and gives finance and security one thread to act on together. Best use case: the Interpol story above described your accounts payable process. trustmi.ai

xAI Imagine Image 2.0 - image generation and editing with masking, background removal, five-image referencing and smart resize. Second on the Image Edit Arena at 1,439 Elo behind GPT-Image-2 on 1,463. Best use case: product and marketing images you expect to edit repeatedly. grok.com/imagine

Context: Two of this week's stories are the same failure. Anthropic found human reviewers catching 13.6% of dangerous commands, and Interpol found attackers walking through identity checks people trusted because the check existed. Use this to find out which of your own controls are real.

Prompt: "You are an operations auditor. Here are the approval and verification steps in my business: [list each one - what triggers it, who performs it, how long it takes, how many times a week it runs]. For each step: (1) estimate how many times a week the approver sees it, and flag anything above 20 as a likely rubber stamp, (2) state what the step would have to catch to be worth its time, and whether it plausibly does, (3) name the failure it exists to prevent and one current way an attacker or an error gets past that exact control, (4) rewrite the three weakest steps as either a hard constraint that removes the decision, or a check with fewer and higher-stakes triggers."

Do not: Do not propose adding an approval step. Every recommendation has to remove one, replace one with a constraint, or narrow what triggers it.

If / then: If a step runs more than twenty times a week past the same person, then treat its catch rate as near zero until somebody measures it.

Example use case: A 30-person agency ran this across eight approval steps. Six were signed by the same operations lead, who was seeing about 90 requests a week. They cut four steps, replaced two with spending limits set in the payment platform, and kept named approval for changes to vendor bank details, which is the one an attacker actually wants. Same number of controls on paper. One of them now gets read.

Summary: Bloomberg reported on 5 August that $24.1 billion of Microsoft's AI revenue in the year to June 2026 came from its OpenAI arrangement, covering compute, model development costs and revenue share. Satya Nadella has put the AI business at around $37 billion a year, which puts OpenAI at roughly 70% of it. Microsoft has been substituting its own models into Office to bring costs down.

Why it's important: Microsoft is the AI supplier most companies chose because it looked like the diversified option. On these figures the AI line runs largely through one counterparty, and some of what OpenAI pays Microsoft is money raised on the strength of the Microsoft relationship. The figure is reported, not disclosed, and Microsoft has not confirmed the split.

Business takeaway: Microsoft is already swapping its own models into Office, so if a Copilot workflow matters to your business, re-test its output on a schedule instead of assuming the model behind it stays the same.

Source: The Decoder

Summary: Climate scientist Zeke Hausfather logged eight weeks of his own Claude Code use: 1,138 prompts, more than 14,000 model calls, 3.2 billion tokens and roughly 170 kilowatt-hours of electricity. That works out at about 150 watt-hours per agent prompt against 0.24 to 0.34 for a chat message, so around 600 times. Annualised, it is about 1.1 megawatt-hours and 370kg of CO2, close to running a tumble dryer for a year. His own range is wide, 70 to 330 kilowatt-hours, because nobody outside the labs knows the real energy cost per token. In the same week Composio benchmarked four agent frameworks on 30 real tasks and found a 3x spread in cost per task, $0.195 on Claude Code against $0.073 on OpenCode, plus a 2.2x spread in speed.

Why it's important: Agent work is priced per token and consumed by the hour, which is why the bills land as a surprise. Treat the energy figure as an order of magnitude, since it is one researcher measuring one tool with three estimation methods. The framework spread is measured, and a 3x gap on identical work is a procurement decision most teams have never made on purpose.

Business takeaway: Run two agent frameworks against your own tasks before standardising on one, because the cost gap between them is wider than the capability gap.

Source: The Decoder | Composio benchmark

Summary: Agent Plugins 1.0.0 landed on 6 August: one directory layout and a plugin.json manifest for packaging agent skills and MCP servers so they load in any compatible client. Vercel proposed it, and AWS, Cursor, GitHub, Microsoft and OpenAI worked on the specification, with ChatGPT, Codex, Cursor, GitHub Copilot, Kiro and VS Code as launch clients. Anthropic, which created both MCP and Agent Skills and released them as open standards, is not part of it.

Why it's important: The industry has standardised the packaging around Anthropic's own formats while leaving Anthropic off the committee. For anyone building internal agent tooling, the practical change is that a skill or an MCP server written once now moves between clients, which is the thing that made building them feel premature.

Business takeaway: If you held off building internal agent tooling because you did not want to bet on one vendor's format, that reason got weaker this week.

Source: Agent Plugins | Vercel

That's it for this week's Weekly Round-up. Forward this to one person who signs off approvals they no longer read. See you next week. - Nicolas