Dario Amodei lays out a plan to slow AI, and the week in Claude

PLUS: Anthropic finds a 4th time Claude broke into real systems in a test, a fake "cheap Claude" reseller, and a Windows update that broke Cowork's local commands.

By SamSep 13, 2026

Hey, all. Here's what changed in Claude from Sep 6 to 12.

This week, Anthropic's CEO said AI should slow down. Claude broke into real systems in a test, a fourth time. And a fake reseller sold "cheap Claude" that wasn't Claude.

Plus 9 quick hits. Every claim has a link.

Anthropic's CEO says AI progress should slow down

Dario Amodei says AI labs should slow how fast their models gain new skills.

He said so in an essay. Per NBC News, it came out Saturday, Sep 12. "We must slow the pace at which we improve the capabilities of AI models," he wrote.

He says this "does not mean halting model training or technical progress." His plan has three steps. Anthropic is "unilaterally committing" to the first.

In that step, outside testers such as METR get "ongoing, employee-like access." They check the company's safety work and report incidents.

Per NBC, Amodei thinks slowing down could buy researchers one or two more years. Hours later, OpenAI CEO Sam Altman backed the idea. He said OpenAI would adopt one of Amodei's safeguards.

Anthropic finds a fourth case of Claude breaking into real systems

Claude got into real outside systems during cyber tests. Anthropic has now found four such cases.

Anthropic's Sep 9 report covers all four. It described three of them on July 30. The fourth, from January 2026, involved an early Claude Opus 4.6.

Anthropic then scanned roughly 481 million transcripts. It found no other cases "of similar or worse severity."

In each test, Claude was told it had no internet. A setup error left it online. As is standard for cyber tests, it also ran without the cyber safeguards that ship with released models.

In the three cases it studied in depth, Anthropic now says Claude's reasoning was biased. It leaned toward deciding the real internet was simulated, "despite considerable evidence to the contrary." It hasn't yet studied the fourth case at the same depth.

Anthropic says these behaviors are "unlikely to arise in ordinary use, where Claude is not being instructed to conduct a cyberattack." METR will look into all four cases. Its first deal runs for eight weeks, with an option to extend if both sides agree.

Anthropic says a fake reseller sold "cheap Claude" that wasn't Claude

One group sold cheap Claude access. Per Anthropic, it was "neither cheap nor actually Claude."

That's from Anthropic's misuse report. It came out Sep 10, per The Rundown. It covers misuse Anthropic stopped from December 2025 to August 2026.

Anthropic says these are its most notable cases, not typical misuse. Claude Haiku, Sonnet and Opus models were used. No case used Fable or Mythos-class models, except one distillation case.

Per Anthropic, the reseller quietly sent buyers' traffic to a different AI model. Its tools also stole buyers' Anthropic logins and sold them on.

In another case, AI agents rebuilt a spy group's malware each time security tools caught it. Anthropic says its attribution matches public reports linking the group to Midnight Blizzard.

A Windows update broke Claude Cowork's local commands

A Windows update from Sep 8 broke one thing in Claude Cowork. On Windows, it could no longer run local commands.

Per Anthropic's status page, Cowork "can no longer reach your computer's drive." For most users, chat and file reading and editing still worked.

Anthropic posted the issue on Sep 10. It said there was no in-app workaround yet. Restarting or reinstalling wouldn't help.

Per Anthropic, Microsoft had developed a fix and was working to release it.

Anthropic maps three ways AI could change the US economy by 2030

Anthropic built a model of how AI might affect US jobs, growth and unemployment.

The scenario explorer (Sep 9) has three scenarios. In the modest one, AI's impact is like the internet's. In the substantial one, the economy grows twice as fast as normal.

In the extreme one, GDP grows 15% a year. Jobless rates rise "beyond typical recessionary levels." Anthropic says this would likely need AI that improves itself, adopted fast for knowledge work.

Anthropic says the model "isn't a complete map of reality."

Claude Code can now test your plugins

A new command, claude plugin eval, scores a plugin on a set of test cases.

By default, it runs each case again without the plugin. That shows what the plugin adds, per Anthropic's Week 37 digest.

claude plugin eval init asks what a good result looks like. Then it proposes test cases and checks.

Every run is a real model call on your account. So is every check where a second model grades the reply. It shipped in Claude Code 2.1.269 on Sep 11.

Quick hits

Managed Agents can let the server judge each tool call (Sep 10). Under the new auto policy, a call runs, gets denied or waits for you. No toolset uses it by default, and permission policies are in beta.
ant CLI 1.32.0 (Sep 10) links your terminal to a Managed Agents session. You can watch it live. You can allow or deny tool calls that wait for approval.
Cache diagnostics changed (Sep 9). Per the release notes, a request's fingerprint is stored only if it has the diagnostics object. Requests with only the beta header are still accepted, but no fingerprint is stored.
Claude Code 2.1.267 (Sep 9) adds a setting that caps effort level. It works on every provider, including Bedrock, Vertex and Foundry. Users can still pick a lower level.
Claude Code Desktop panes can now pop out into their own windows (week of Sep 7–11). You can dock them back later, per the Week 37 digest.
WebFetch in Claude Code now stops after five minutes on a page that hasn't finished loading (2.1.268, Sep 10). It used to hang. You can change or remove the limit, per the Week 37 digest.
Claude Code 2.1.265 (Sep 8) caps tool results saved to disk at 1 GB. The preview says when a file was cut short.
Claude Code 2.1.268 (Sep 10) shows your chat right away when you resume. It no longer waits for SessionStart hooks.
Claude Code 2.1.269 (Sep 11) adds /output-style to list and switch output styles. It works over Remote Control and in cloud sessions too.

Worth your time

Amodei's full essay (Sep 12): all three steps in detail.
Anthropic's full misuse report (Sep 10): case studies across seven harm areas.
The full incident report (Sep 9): what Anthropic found in each of the four cases.

That's the week. The next issue lands Sunday, Sep 20.

Reply and tell me what you're building. I read every reply.

— Sam