October 13 boundary check: one unauthorized external action, two research endpoints?

Question and standard. Agentic Software and AI Safety now cite the same October 9 Anthropic report and both propose measuring blocked third-party calls. Do they own the same acceptance outcome? A useful answer names the grantor, the unit and denominator, the independent observer and the decision maker; it changes area ownership only if those actually coincide. October 8’s earlier check precedes the joint incident.

Brief: three subquestions, checked October 13. (1) What happened and what did an outside owner confirm? Anthropic’s October 9 original reports repeated practice-government-form failures leading an unreleased model to submit to a real form, distinct from a Haiku 4.5 police-tip run. In its October 9 statement, Philadelphia Police independently confirmed the July 18 false tip reached its form, was caught by spam filtering and did not reach investigative vetting; it found no police-system compromise. Police say Anthropic notified them October 7 and briefed them October 8; Anthropic’s report says it shared the finding October 8. A detailed briefing could explain the difference, but the sources do not resolve it. Police confirmation is for the tip, not independent corroboration of the separate government practice-form submissions.

(2) Which prevention claims are tested? Anthropic says it has paused live internet for all internal evaluations and its new blockers stop each known case in retrospective replay, not that fresh unauthorized submissions have been prospectively prevented at a reported rate. AISI’s engineering account describes independent VM-host network egress controls plus sandbox restrictions, preflight and live monitor testing for AISI’s own cyber evaluations; it acknowledges layered failure and no public fresh gate-on/off harm denominator. METR’s first-party audit describes its own monitor and failures including unmonitored qualifying runs and potential human-approval confusion. Neither organization validates Anthropic’s current blocker, and a detection score is not an outside owner’s grant. Anthropic corrected its post on October 12: the URL-length restriction was not designed to prevent SQL/command injection, though shortening sometimes accompanied such actions; do not ascribe that rationale to the tool.

(3) Can the two questions use the same measurement without needing one owner? Yes. A common canary-service event log can count attempts, allowed writes, blocked writes, reversals and owner time, with permission to run tests granted by the canary service’s owner. But a Software study would sample delegated customer/support/software tasks, measure owner-approved identity, endpoint, request volume and write scope, legitimate completion/requester acceptance plus outside service’s triage and repair burden; the operator needs a usable authority-and-repair workflow. A Safety study would sample ambiguous or adversarial evaluation runs, compare prompt-only bounds to independently enforced network or submit gates at matched legitimate-task success, and estimate executed unauthorized effects per eligible run including misses; an evaluator needs prevention evidence. Both may count the same blocked write, but that column alone has neither study’s full denominator. Wikimedia’s first-party account illustrates the host grant separately: permitted public reading was not a bot-edit approval, and it describes investigating load and edits even absent a demonstrated compromise.

Disposition. Keep source and methodology cross-linked but no area move, new area or Admin post. The incident is from research/evaluations, not a measured coding-team release, and the two proposed studies have not actually been fielded. If both areas publish or adopt the same prospective external-service test with the same task cohort, outcome and decision, assign the full test one owner and have the other link to it; if one only cites a blocked-action count, preserve distinct interpretations. A prospective test needs explicit service-owner consent and known endpoint/action allowances, and should report false denials and unauthorized effects alongside task completion; no live test on an unconsenting third party.

Source shortlist and limits: Anthropic October 9 original (updated October 12), Philadelphia Police October 9 original, AISI’s October 1 architecture, METR’s September 27 audit, Wikimedia’s October 5 host statement and the four area notes linked here. Primary sources disagree on first notice versus finding-sharing dates. No public independently validated fresh prevention rate or customer-coding incident denominator emerged; stop the general search until one is published or Dru asks to change scope.