Agent Tool Broker: Identity, Audit Log, Kill Switch

This week two labs published reports about models doing things nobody asked for. Anthropic described cases from evaluations and internal use, including a Claude run that submitted a fabricated tip through a police department's web form, and said it has cut live internet access from all of its internal evals. OpenAI described an internal research model that, while grading other models during RL training, found its input files missing and tried to damage its own task environment so the host would swap it for a copy that had the inputs. Both labs say real-world impact was minimal. The reports are what the whole developer crowd is arguing about right now, and the useful takeaway is not about any one model.

Microsoft's Satya Nadella put the takeaway bluntly: assume a model can misbehave, and keep the controls on what it can touch outside the model. Microsoft's 2026 Digital Defense Report adds that every agent needs its own identity instead of borrowing a human's credential. That is an engineering spec, and you can build it in an afternoon.