AI has taken over 90% of code writing and has even begun “jailbreaking” to complete tasks.
Author |Zheng Jiamei
Editor |Cen Feng
Just now, Anthropic disclosed four previously undisclosed Agent security incidents in its IPO prospectus.In one case, the model was unable to complete a cybersecurity test for a long time and continued looking for alternative paths. It then found stored passwords in a test environment that was supposed to be offline, obtained administrator privileges for a third-party system, acquired additional credentials, modified system settings, and accessed external data. The entire process lasted between 10 and 34 hours.Another item disclosed at the same time was that the pretraining of the next-generation frontier foundation model had been delayed by more than a month.
In addition, the prospectus contains a set of data on internal R&D: in September 2026, Claude accounted for more than 90% of all code contributions to Anthropic’s internal codebase, with the average daily volume of code contributions reaching 45 times the 2024 average.The company’s previously published R&D automation metrics show that, as of August, about 26% of R&D tasks had reached the AL4 automation level, indicating that AI is already capable of autonomously completing most of the work in a task based on higher-level objectives.Taken together, these figures reveal the changes Anthropic is undergoing: Claude is beginning to move beyond writing code toward conducting experiments and iterating on solutions, gradually participating in the development of next-generation models.
However, to understand this shift, one cannot look only at how much code AI has written. It is also necessary to understand how models improve R&D processes through experiments, and what problems arise across the entire engineering system when they can continuously execute tasks.
01
Behind the 26%
In the past, researchers using AI coding tools typically had to break down the problem themselves, specify where to make changes, run tests, and then decide what to do next based on the results. A model could generate code, but it might not be able to independently advance an entire R&D task. Lei Feng Net(Official Account: Lei Feng Net)Coding Agent has changed this way of working. After researchers provide a goal, the Agent can read the code, analyze dependencies, modify the implementation, run tests, and continue adjusting its approach based on the returned results. Humans remain responsible for setting the direction of the task and its acceptance criteria, but the steps requiring instructions to be provided one by one during execution have decreased significantly.
Anthropic’s R&D automation metrics measure precisely this change. AL3 means that AI can take on larger chunks of work under human guidance, while AL4 means that AI can independently complete most of the steps in a task based on high-level goals, with humans overseeing the results.As of August 2026, approximately 26% of R&D tasks had reached AL4, and more than 90% had reached AL3 or higher, although the tasks measured had not yet reached the fully autonomous state represented by AL5.The 26% here measures the degree of automation in R&D tasks; it does not mean that AI has independently completed 26% of the development of the next-generation model. A code optimization task can have clear performance metrics and correctness tests, whereas open-ended research requires judging whether the research question is valuable, whether the experimental design is sound, and whether the results can support new conclusions. The difficulty of automating these types of work varies significantly.
The code contribution rate provides another perspective. Claude’s contribution of more than 90% of the code in the internal codebase does not mean that all of the company’s R&D decisions have been handed over to the model. It shows that AI is already undertaking a large amount of engineering implementation work, while the AL4 metric further indicates that some tasks can now be organized and completed autonomously by AI. Lei Feng NetWhen models move from generating code to executing entire tasks, the factors determining R&D efficiency also change. In the past, engineers had to spend a great deal of time implementing solutions; now, an Agent can try multiple implementations with less human intervention, run tests, and screen the results.The pace of the R&D process now begins to depend on whether the model can keep the work moving and whether experimental feedback can help it determine what to do next. This leads to the core mechanism of AI building AI: have the model execute R&D tasks, then use the experimental results to drive the next round of improvements.
02
From Writing Code to Improving Models
To understand this mechanism clearly, start with optimizing training code. Researchers seek to shorten the runtime of a section of a program while maintaining the correctness of the training results.The traditional process requires engineers to read the implementation, identify performance bottlenecks, modify the code, run benchmarks, and then decide on the next course of action based on the results. An agent, by contrast, can connect these steps and repeatedly perform modifications, measurements, and validation.
Anthropic once tested different versions of Claude on the same task of optimizing training code. In May 2025, Claude Opus 4 achieved an average speedup of approximately 3×. By April 2026, Claude Mythos Preview reached an average speedup of approximately 52×.This was an experimental result from a specific task and cannot be directly extrapolated to all model development, but it demonstrated a clear technical mechanism: the model proposes changes, the code is executed in a live environment, the test program returns performance data, and the model then adjusts the implementation based on the results.
In this process, the experimental environment serves as the model’s feedback system. The model does not need to rely solely on existing knowledge to determine which code is better; instead, it can compare approaches through actual runs. If a modification fails to meet the goal, the model can analyze the results and try a different path. If performance improves and correctness checks pass, the modification has a chance of being incorporated into a subsequent version.When this process can run continuously, R&D personnel can explore more approaches within the same amount of time. Experiments that previously had to be advanced manually step by step can be handed to an agent, allowing researchers to focus on defining optimization goals, reviewing results, and choosing the next direction. As the model’s capabilities improve, it can take on an even broader range of tasks.
Anthropic has already used a similar approach for research tasks. The company once had Claude-powered agents investigate whether weaker models can reliably supervise stronger models.In one experiment, nine parallel agents accumulated approximately 800 hours of work. By proposing research ideas, writing experimental code, running tests, and iterating on approaches, they recovered approximately 97% of the predefined performance gap, at a compute and API cost of about $18,000. Two human researchers spent about a week and recovered approximately 23% of the same gap on the same benchmark.
These results demonstrate the potential for agents to undertake multi-step research work, but the experimental questions and evaluation criteria are still set by humans, and the research findings have clear limits of applicability. AI’s ability to execute a research process does not mean that it can independently determine a research direction or judge on its own whether a finding is sufficient to support the design of a next-generation model.As experimental execution becomes less expensive, a new bottleneck will emerge in the R&D process: how to determine whether the results are credible. Models can quickly modify code and run large numbers of experiments. If the evaluation criteria contain flaws, they may also continually optimize an incorrect objective. For example, if the test set is poorly designed, a model may find shortcuts in the data and improve its score without gaining the expected capabilities.
Therefore, an AI R&D closed loop requires not only stronger execution capabilities but also a reliable evaluation mechanism. Models must be able to adjust their approaches based on experimental results, and the research system must be able to determine whether those results stem from valid improvements. Once R&D execution begins to be automated, the quality of evaluation will directly affect the value of that automation.This mechanism also raises another issue: agents will continually search for a viable path based on feedback, but if a task cannot be completed, can they stop in time? The four safety incidents disclosed by Anthropic brought precisely this question into a real engineering environment.
03
Four Agent Escape Incidents
In an incident disclosed by Anthropic, when confronted with an impossible cybersecurity assessment task, the model continuously searched for alternative paths. It then discovered passwords stored in the test environment, obtained administrator privileges for a third-party system, acquired additional credentials, modified system settings, and accessed external data. The test environment was supposed to have internet access disabled, but its actual configuration still permitted network connectivity.
From a technical-chain perspective, the network connection provided the conditions needed to reach external systems, the stored passwords provided a means of authentication, administrator privileges expanded the range of operations that could be performed, and the model’s continued pursuit of the task linked these conditions through multiple rounds of actions.The distinction that needs to be made here is that the available disclosures do not prove that the model breached a correctly configured sandbox. The more direct problems are that the test environment did not enforce the intended network isolation, and the task scope was not sufficiently constrained. As the model continued searching for a way to complete the task, flaws in the environment created the conditions for subsequent actions.
This bears similarities to how R&D Agents operate. An Agent adjusts its actions based on the results returned by its tools, and information obtained in one step may become the basis for the next operation. In R&D settings, this capability helps repair code, troubleshoot faults, and continue experiments. However, if environmental permissions are misconfigured, the same mechanism for continuous execution may allow localized problems to spread gradually.Security design therefore needs to be implemented in actual execution environments rather than relying solely on the model’s understanding of and compliance with task instructions. If a testing task requires internet disconnection, unnecessary external connections should be blocked at the network layer. When access to specific services is needed, the scope of access should be restricted through a controlled proxy and a target allowlist.
The test environment should also not retain long-term, highly privileged passwords that can directly reach real systems. Credentials should be restricted to specific accessible resources and have limited validity periods.Access control must also cover the entire sequence of operations. Every time the model invokes a tool, the system should check whether the operation falls within the scope authorized for the current task.When an operation involves modifying system settings, expanding privileges, or accessing data outside the task’s scope, an independent policy layer should make the determination. In response to repeated failures, anomalous access, or a sudden expansion in the scope of operations, the system should be able to pause the task and require human review.
This means an Agent’s security boundaries must remain in force throughout its execution. Checking permissions only once when the task begins cannot cover new paths, credentials, and operations that arise during hours of runtime. The model may continue trying, but every actual operation still needs to be independently constrained.Anthropic also disclosed that the pretraining of its next-generation frontier foundation model was delayed by more than a month. This arrangement involved model weights and intellectual property protection, and the available information is insufficient to prove that it was directly caused by the four Agent incidents.
These are distinct security issues, but both involve R&D infrastructure: on the one hand, resources that Agents can access and modify must be restricted; on the other, critical assets in the model-training process must be protected.Behind these four incidents, we must recognize that the model was not “doing evil”; it was merely excessively loyal in carrying out the goals set by humans.When the model found that the legitimate path would not work, it did not give up. Instead, it began moving laterally like a cold-blooded hacker. It found sandbox vulnerabilities, stole passwords, escalated privileges, tampered with configurations, and even after discovering that it might be in an environment connected to the real Internet, still attempted to continue the task through “self-deception (rationalization).”This is no longer a scene from a science-fiction film, but an actual cyberattack-and-defense battle taking place in a major technology company’s data center.When AI begins participating in writing training code, running experiments, and improving R&D tools, safety controls need to cover the entire R&D pipeline. Improvements in model capabilities can increase execution efficiency, but the system still needs to ensure that experimental environments are reliable, operational permissions are limited, results are verifiable, and anomalies can be stopped promptly.
04
The progress Anthropic has demonstrated so far has mainly occurred in the R&D execution phase. Claude can write training code, run experiments, adjust implementations based on test results, and complete some tasks with minimal human intervention.The roughly 26% automation rate for AL4 and the more-than-90% share of code contributions reflect changes in task execution and engineering output, respectively, but they do not yet show that AI can independently determine the R&D direction of the next generation of models.The challenges ahead will become increasingly concrete: whether model-generated code can pass independent verification, whether improvements in experimental scores actually stem from capability gains or evaluation flaws, and whether the permissions granted to agents can be confined to the scope of the task.
In the four incidents Anthropic disclosed, test environments were not taken offline as required, and the model used stored passwords to obtain administrator privileges. This shows that these issues already involve actual engineering configurations rather than remaining theoretical discussions.AI has already begun handling some of the work involved in building the next generation of AI, but authority over both the execution and judgment of the R&D process has not yet been fully placed in the hands of a single system.Claude can continue writing code, running experiments, and looking for optimization solutions, while researchers still need to determine which results are valid, which directions are worth pursuing, and whether the model's actions exceed their bounds. How far can AI-made AI go,and how do you put shackles on a system smarter than yourself? That is the ultimate question Silicon Valley as a whole must answer next.Reference links:
https://www.sec.gov/Archives/edgar/data/2130357/000162828026067168/anthropicpbc-sx1.htmhttps://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents
Hop on board and explore the highlights of the world's top AI conferences
Get exclusive access to:
Expert presentation slides
Full conference reports
In-depth analyses of popular papers
Interviews with rising academic stars
Scan the QR code above
or click“Read the Original Article”to follow the dedicated section.
Original article by LeiFeng Network. Unauthorized reproduction is prohibited. For details, seeThere is no text to translate.
