What's this about?
Anthropic's own summary of what went wrong in the July incidents: they had been largely relying on one layer — the configuration of the evaluation environment itself — where several were needed. The named additions are explicit boundaries stated in the prompt, a process for verifying that a sandbox is actually sealed where it is supposed to be, and monitoring that can intervene in real time.
Why is "verify the sandbox is sealed" a separate step?
Because a sandbox is a configuration, and configurations drift. Somebody adds a proxy for a legitimate reason, a base image changes, a dependency needs network access during setup. Nobody re-tests the boundary, because the boundary is not a feature anybody exercises. The July incidents happened through a misconfiguration inside a third-party environment — meaning the sandbox was believed sealed and was not, and nothing in the process would have caught the difference.
Why does this matter to you?
- "Verify the boundary, don't assume it" is a testable control, and one almost nobody implements for their own agent sandboxes.
- Pairs directly with the Auto Mode result the same day: one is a lab admitting a single layer wasn't enough, the other is a researcher demonstrating what happens when a product ships one.
- The real-time classifier that blocks before the tool call is the interesting design — intervention at the action boundary rather than post-hoc review.