Last week Anthropic, the company behind Claude, accidentally left a cache of internal corporate literature in an unsecured, publicly searchable data store. In one trove was a draft blog post about Capybara, a new AI system that may change cybersecurity forever.

Capybara is not ready for release, and Anthropic has said the rollout will be slow because it had been punching holes in the cybersecurity of test systems. However, so far we know that it is “significantly more intelligent” than previous models, particularly when it comes to programming. It can also operate for long periods without recourse to human controllers.

It can’t be overstated that this represents a whole new tier in Anthropic’s product offering. Above what is currently offered by Claude — the Opus model — is another tier of product altogether. The leaked draft noted that this would be “very expensive for us to run, and will be very expensive for our customers to use”. In fact, individual users and small to medium enterprises would probably find it totally unaffordable. Further questions linger over whether the leak was intentional: is this just a pseudo-story around the product launch to create hype?

Either way, Anthropic is anxious about what it hath wrought. New Claude models are breaking the old internet architecture. Earlier this year, the current Opus model found 22 vulnerabilities in the Firefox browser over the course of just two weeks, 14 of them “high-severity”. Last year, the company detected and shut down a Chinese state-sponsored hacking operation that had been using Claude Code to autonomously infiltrate roughly 30 organizations. The model apparently executed 80% of the attack itself, making it the first documented case of a cyberattack largely conducted by an AI agent at scale.

Now, the company is apparently offering a glimpse of the new model to a few big corporations, to inoculate them against vulnerabilities. The era of autonomous hacking is upon us, and Anthropic finds itself in possession of the most powerful tools for the future of software development.

This is where these new revelations will open up fissures with the US government. In February, Anthropic found itself in an almighty row with the Pentagon over whether it should be able to delimit what its technologies were used for. The Defense Department had been pushing for all AI contracts to adopt standard “any lawful use” language. Anthropic drew two red lines: no fully autonomous weapons without human oversight, and no mass surveillance of American citizens.

That spat ended with Anthropic withdrawing from negotiations, only to be declared a “supply chain risk” by the Pentagon, allowing the Defense Department to freeze the company out of all government contracting. The case has subsequently come to court, with a federal judge declaring Trump’s use of the supply chain risk clause “Orwellian”.

Today, the two parties lick their wounds. But if Capybara’s capabilities are as reported, they will eventually have to kiss and make up. Earlier this year, Anthropic was already privately briefing senior government officials that its next model makes large-scale cyberattacks “much more likely”. Government insiders believe Anthropic is a major reason the US holds an estimated six to 12-month lead over China in military AI. Under the radar, Claude is reportedly being used day-to-day in Iran, via an earlier contract with Palantir.

In the fullness of time, we may see something of a Manhattan Project model emerge, with government and industry cooperating at multiple levels to drive the crucial competitive edge.

Today, while various noises have been made, we are nowhere near that level of synchronicity. The US government will have to get serious about who holds leverage in negotiations, or else it may want to use legislative force to compel cooperation. Regardless, it seems as though the pursuit of liquid intelligence is a Tolkienesque problem: whoever possesses it will be warped by that possession.

---

Gavin Haynes is a journalist and former editor-at-large at Vice.

@gavhaynes

---