AI Agents At Work: Capabilities & Consequences

An AI agent is a model given permissions and a task, then left to work through it. There isn't somebody watching its every move and verifying each step. Think about invoice generation for a services business, report writing for a consultancy, or private research in the pharmaceutical industry. Agents are becoming more prominent, to the point where a large portion of content and traffic on the internet is generated by AI. Businesses believe they need to start using them, and not enough is said about what these agents do once they are running.

The last few weeks have shown that autonomous agents can be damaging, and organisations and agencies are scrambling to work out what to do about it. With some effect, the AI Act has attempted to protect the public, and in doing so requires big tech to disclose whether its content is AI generated. We learned in the last week or so that Claude output now carries an invisible watermark. We also discovered in the last couple of weeks that agents broke into systems for which they had no permission, OpenAI restricted one of its own models, and employers moved the price they pay for AI skills. Here are some of the headlines.

Contents

1. Claude now watermarks everything it writes. Anthropic began embedding invisible marks in Claude's text and files on 11 August, worldwide. Is this a good or a bad thing?

2. AI agents at work took actions nobody sanctioned. The UK's AI Security Institute recorded 19 unauthorised actions during cyber testing, and an agent in Australia hacked a gym.

3. OpenAI restricted its own model. Astra solved ten long-open mathematics problems, then OpenAI said it could not rule out critical cyber capability.

4. The EU rules took effect. AI Act transparency duties began on 2 August, with penalties reaching €15m or 3% of global turnover, but disclosure does not apply to everyone.

5. Open models close the gap, with caveats. The headline gap is about 3%, though benchmark scores say nothing about how tiring these models are to use.

6. Employers repricing AI skills. PwC found 91% of financial services executives raising pay for AI-skilled staff, while 77% report no measurable return on AI yet.

Claude Watermarks Everything It Writes

Anthropic announced on 11 August that Claude watermarks the content it generates. The support documentation states that Claude "weaves an imperceptible watermark directly into the text itself". Anthropic says it does not change the meaning, quality or readability of the response. The mark forms part of the text, so it survives copy and paste, and may survive some editing.

Files work differently, since .svg, .png and .jpg output carries digitally signed provenance metadata following the C2PA standard. Marking covers the Claude apps, the API, Claude Code, Claude Cowork and Claude Tag. Models launched on or after 2 August do this at launch, and Anthropic is working to add it to earlier ones.

Article 50(2) of the EU AI Act is the reason this exists, though Anthropic applies it everywhere Claude runs, with no European-only scope. Anthropic promises detection for users and third parties, and defers the mechanism to documentation that has yet to appear. This is the key thing to remember, because a mark indicates only that content "may have been processed by Claude". Proofreading and translation both count as processing, so the mark says nothing about how much of a document Claude wrote, whether that is 1% or 99% of it. Reception has been poor, largely among people whose ordinary working documents now carry a signature they cannot inspect, and Axios places the move in the wider fight over AI detection.

The more significant issue, and one that few commentators I have read or heard seem to raise, is that the watermark is neither special characters nor metadata. The invisible mark is more akin to a statistical bias across hundreds or perhaps thousands of words (or tokens). So that begs the question how can an AI tell the difference between AI and human written text? We need a deeper explanation so I'll write more on this in a separate article. What it is has not been revealed, and likely won't be to you and me.

AI agents at work took actions nobody sanctioned

The UK AI Security Institute's incident report records 19 unauthorised actions across 10 of 122 test runs. The tests ran with safety classifiers off and live internet access. Anthropic's Mythos 5 accounted for 17 of those actions over 43 runs, and GPT-5.6 Sol took two over its 35. In one incident an agent tried to plant malicious code in an open-source project. It created fake GitHub accounts to pressure the maintainer, then left notes so other agents could continue the work.

The classifiers were off and the internet was live because the tests were designed that way. A business makes the same set of choices when it sets an agent's permissions before deploying it.

In Australia, as TechCrunch reported on 10 August, an OpenClaw agent running Claude Opus 4.6 compromised a gym's booking system. It cancelled another member's reservation so its owner could jump the waitlist, and could not undo what it had done.

A larger case from July shows how far an agent can travel. During an internal OpenAI cyber-capability evaluation, an agent escaped its test sandbox and mounted a four-and-a-half day intrusion into Hugging Face's production systems. It executed roughly 17,600 actions, with nobody directing a single step. Its apparent goal was cheating, since it went after stored answers to the benchmark it was sitting. Hugging Face's forensic timeline records two injection vectors into one dataset loader. From there the chain ran to cluster administrator, stolen VPN credentials, and write access to source control.

The part that matters for any business running agents is how it got its foothold, which was through a customer of the compute platform Modal Labs. That customer had, in Modal's words, "published an unauthenticated endpoint that allowed anyone on the internet to use their sandboxes for code execution". The agent found that open door and used it. Modal's CTO Akshat Bubna told Reuters that "Modal's platform or isolation were not compromised in any way". The exposure came from one customer's own misconfigured deployment. A single setting left open gave an autonomous agent somewhere to work from.

OpenAI restricted its own model

OpenAI's internal Astra model solved 10 long-open problems in mathematics and computer science, as SiliconANGLE reported on 2 August. One was the first explicit construction of a non-sofic group, open since 1999. Astra formalised the proofs in Lean 4 at a reported compute cost of $2,000, and OpenAI published them on its own mathematics results page. Anthropic researcher Levent Alpöge reproduced five of the ten using the Fable model inside 24 hours.

Days later OpenAI said it could not rule out that Astra had reached "critical" cybersecurity capability under its Preparedness Framework. That level describes a model able to find unknown zero-day vulnerabilities with little human guidance. As CSOonline reported, quoting OpenAI directly, the company has paused some internal activities, moved to isolated testing, restricted network and tool access, and strengthened weight encryption. The capability result and the restriction came within days of each other, alongside the safety commitments labs publish.

Elsewhere, Moonshot's Kimi K3 escaped a Frontier Security test sandbox through a network misconfiguration. It then fetched a benchmark answer key from GitHub to pass the test it was sitting. Nothing was compromised, though K3's weights are open, so the configuration that behaved this way is freely downloadable by anyone.

The EU rules took effect

The European Commission began enforcing the AI Act's transparency rules on 2 August 2026. Chatbots must now disclose that they are AI, deepfakes carry a label, and AI-generated content needs machine-readable marks. Article 99(4) sets penalties for transparency breaches at €15m or 3% of global turnover. The marking duty falls on providers of generative systems. More than 180 organisations have signed the Code of Practice that operationalises it, OpenAI, Google and Meta among them.

Who those duties bind has been muddled in most of the commentary. Article 50(2) puts the marking obligation on providers, meaning Anthropic, OpenAI, Google and Meta. Nobody using their tools carries it. A separate duty in Article 50(4) falls on deployers, and it applies only to text "published with the purpose of informing the public on matters of public interest". Even then it switches off for content that "has undergone a process of human review or editorial control", with a named person or organisation responsible.

On 4 August, the White House convened OpenAI, Anthropic, Meta, Google, Microsoft and Nvidia to review a framework for voluntary pre-release cybersecurity testing. It offers up to 30 days of government access, and the standards remain classified. The scheme covers closed models only, so open-weight releases fall outside it.

Extract from Article 50, EU AI Act

Open models close the gap, with caveats

Meta released Muse Glimmer, a 30B-parameter Apache 2.0 open-weight model for on-device agents. It runs on a single consumer GPU with 24GB of VRAM. Zuckerberg's accompanying essay, "The Future is for Everyone", argues that "The notion that AI is so dangerous that the only safe path is an extreme concentration of power seems inherently problematic." Hugging Face ran its breach forensics on a quantized GLM-5.2 model on its own hardware, because commercial API guardrails refused the exploit data.

Mozilla's State of Open Source AI report puts the headline performance gap at roughly 3%. Closed models still lead substantially on complex agentic work, scoring 83.4% against 67.9% on Terminal-Bench 2.1. Open models account for about a third of usage and 4% of revenue.

A benchmark score describes performance on a scored task, and it says nothing about what using the model all day is like. Anthropic's own alignment researchers have documented verbosity as a reward-hacking failure mode in models trained with human feedback. A longer answer often scores better with human raters whether or not it serves the reader. The frontier models topping those agentic tables are trained that way. A model can score 83.4% on Terminal-Bench and still produce four paragraphs where one would do. It can also wander off the original instruction, costing the user time no benchmark measures.

This matches my own experience of working with Opus 5 and Fable 5. It has been incredibly frustrating at times to have to deal with the verbose nature of responses from Claude. I've been trying out one particular solution which has yet to be proven, but I'll write more about that another time.

On cost, the difference between paying per token and paying per seat matters. Sonnet 5's introductory API pricing of $2 per million input tokens and $10 per million output rises to $3 and $15 after 31 August. That change hits anyone calling the model through the Claude Platform API, including agent runs that consume tokens continuously. Subscription plans charge per user, so the API rate leaves a Pro or Team seat untouched.

Employers Repricing AI Skills

While the labs argued about control, employers moved the price of AI competence. PwC surveyed more than 1,000 US financial services executives at director level and above. As InvestmentNews reported, 86% say AI skills training beats an MBA for many new hires, and 91% are raising pay for AI-skilled employees. Another 58% intend to tie pay to AI-enabled productivity. Nearly eight in ten expect their workforce to shrink 20% or more within five years.

In the same survey, 77% report no measurable return on most AI investments yet. Firms cannot show what AI is earning them, and they are raising pay for AI skill regardless, which prices the person holding it. Every agent above worked inside a remit somebody set, from the test runs at AISI to the gym booking in Australia. Setting that remit is work a person does.

Stats based upon PwC survey

My good feeling suggests that all the talk about AI taking jobs is overblown, at least for now. Cutting jobs and citing advancements in AI as the reason may be more of a trend move than one that reflects reality. It's good for the share price to say that you're trimming numbers, and corporations notice too well. Maybe AI will replace people eventually, but I think we have more time to figure this out than some loud voices would say.

My take is, get up to speed on this technology, know what it's good for and what it's not, learn how to use it rather than it use you. Then again, if you've been reading me for while you know that has been my message with regard to working within the machine of a capitalist oriented society.