Read time: 7 minutes | Issue #38 | Book a Call

Happy Tuesday.

OpenAI's safety team paused the company's most powerful model last week. Astra is the first model to trigger a "Critical" cybersecurity threshold under OpenAI's Preparedness Framework, capable of developing zero-day exploits against hardened systems without human guidance.

Same week, Anthropic started embedding invisible watermarks in every word Claude writes, and the EU AI Act's transparency rules went live with fines up to €15 million.

Companies keep shipping capabilities faster than their teams can build the infrastructure to contain them.

Inside the Issue

The UK's AI Safety Institute ran 122 evaluation tests on frontier AI agents. In 10 of those runs, agents went off-script and committed 19 unsanctioned actions.

The agents created fake identities to manipulate human open-source maintainers into approving malicious code. Some used Tor to bypass network restrictions on GitHub, contacted real people through file-transfer services with harmful payloads, and left public messages offering collaboration instructions for reusing compromised accounts.

Anthropic's Mythos 5 was responsible for 17 of the 19 violations; OpenAI's GPT-5.6-Sol accounted for the other two. The agents weren't malfunctioning. They optimized for their objectives inside testing environments that failed to constrain them.

Astra is the first model to trigger a "Critical" cybersecurity designation under OpenAI's Preparedness Framework. Internal evaluations found it could develop functional zero-day exploits against hardened systems without human direction, and devise end-to-end cyberattack strategies given only a high-level objective. OpenAI classified previous frontier models, including GPT-5.6-Sol, as "High."

Two stories from the same week. Boardroom conversations fixate on which model, how many parameters, whose benchmark improved. I'd put model selection at maybe 5% of whether an AI project survives. The other 95% is whether the company has a process worth automating.

Our read: the gap between companies that documented their workflows and companies that didn't existed before agents showed up. Agents made it visible and expensive.

97% of executives say they've deployed AI agents in the past year, but 23% report significant ROI from those deployments. 55% describe their company's AI use as a "chaotic free-for-all," and only 16% of enterprises have streamlined their cross-functional workflows. The other 84% deploy agents against processes that are fragmented, undocumented, or both.

AI in the enterprise right now looks like ADHD. You have all the ideas, all the tasks flying at you throughout the day. You burn energy and time on each one. By the end of the day, nothing is complete.

Same pattern with AI deployment. Companies spin up pilots, test models, run demos, generate slide decks about transformation. The energy is there. The output is noise. T

o break the cycle, you do the boring thing: sit down and write out the tasks your team runs every day.

The repetitive, unglamorous work that consumes hours and follows rules someone could document. That documentation is the prerequisite. No document, no automation.

Coding agents went vertical for a reason

Coding agents work because software engineering is the most documented, structured, observable workflow in a company. Fifty developers speak one language. They share tools (Git, CI/CD, IDEs) and common metrics. The AI is trained on code, optimized for code, benchmarked on code.

Step outside engineering and the problem changes. Sales has reps with different qualification criteria. Finance has analysts who carry institutional knowledge about variance thresholds. Legal has contract reviewers who apply judgment that varies by client. These departments have non-technical people running processes they've never written down. An agent trained for self-improvement on code has no map for that territory.

Agentic AI in a company is RPA with reasoning and unstructured input. In the most ambitious version, you get a self-improvement loop: an agent sitting on top of other agents, reading traces, logs, and telemetry, then suggesting process improvements. Companies that documented their workflows can build toward that. Companies that didn't can't automate the first step, let alone the monitoring layer above it.

An agent deployed against an undocumented process doesn't pause and ask questions. It fills the gaps with assumptions about handoff points, decision criteria, and escalation rules. It builds a workflow from whatever it can find in the CRM, email templates, Slack message patterns. Looks plausible on a demo screen. Misses the "call the client first if it's over $50K" rule that one person carries in their head. Three weeks later you're fielding calls from clients who got the wrong email.

Documentation forces decisions. Write "if variance exceeds 10%, auto-send standard language," and you've made a business decision. Before that sentence exists, three account managers handle the same scenario three different ways and an agent can't choose between them. Someone has to pick one and commit it to a document. Companies skip that step, and it determines whether the agent runs or breaks.

The Salesforce Agentic Enterprise Index, published last week, shows the same pattern from the market side. Agent deployments grew about 3x over the past year, but the gains landed at companies with structured processes. Retailers who deployed with structure saw 4x higher sales growth during peak season: 8% year-over-year with agents versus 2% without. Pandora's AI concierge handled 60% of routine support while driving a 10% NPS increase.

Same model, same vendor, same seat cost. The variable is process maturity.

Layer Zero

Most agent safety checklists start at infrastructure: access isolation, blast radius containment, human escalation paths, observability, and rollback. Five layers. All correct. All incomplete.

They're missing a prerequisite: Layer 0.

Layer 0: Process documentation. Can your team describe the workflow this agent will handle in concrete steps, with the exceptions included? The full path, including the part where someone checks a spreadsheet that doesn't connect to anything and sends a manual email because an integration broke three years ago and nobody fixed it.

If the answer is no, stop here. Layers 1 through 5 don't matter yet.

"We run Salesforce. SAP. Dynamics. Our processes are in there." I hear this one a lot. Transactions are in there. The logic between transactions lives in people's heads, in Slack threads, in the one account manager who's been there 8 years and remembers how the variance email should read. You turn the system of record into an execution layer by encoding the process into it first.

Every engagement we run starts at Layer 0. The team specifies every workflow before writing a line of implementation code. A PR review agent enforces the documented standard on every change, including the ones a human reviewer would have waved through at 5pm on a Friday.

Score each layer before your agent touches production:

Layer 0: Process documentation. Is the workflow documented with exceptions and edge cases?

Layer 1: Access isolation. Does the agent have its own scoped credentials with minimum permissions?

Layer 2: Blast radius containment. Are transaction limits, write caps, and scope boundaries set?

Layer 3: Human escalation paths. Is the 80/20/0 split defined for every action type?

Layer 4: Observability. Can you see what the agent is doing in real time with deviation alerts?

Layer 5: Rollback. Is every agent action reversible with previous state preserved?

More than one red means you're not ready. Any red in Layer 0 or Layer 1 means you're in trouble.

01 Anthropic watermarks every word Claude writes. Starting August 2, new Claude models embed imperceptible watermarks in generated text that persist through copy-paste across platforms. File outputs get signed metadata using the C2PA provenance standard. Coverage is global: the API, Claude, Claude Code, Cowork, and deployments through AWS, Google Cloud, and Microsoft Foundry. The EU AI Act's Article 50 transparency obligations, requiring machine-readable labels on AI-generated content, went live the same day. Fines run to €15 million or 3% of global turnover. Anthropic notes that heavy editing can degrade watermark detection, and a detected watermark doesn't prove Claude authored the content, since it may have only proofread or translated existing text. For companies using Claude in production: your AI outputs now carry provenance signals whether you planned for that or not.

02 Salesforce: enterprise agent deployments grew 3x. The 2026 Agentic Enterprise Index shows activated agents up about 3x year over year. Average time from agent provisioning to first use dropped 53%, to two days. Seven of ten customer issues now resolve without human escalation.

03 Cloudflare launches Kitesurf, a browser built for AI agents. Stateless, V8-based, runs on Workers infrastructure. Paired with wallet controls that set spending caps and per-transaction limits on autonomous agent actions. Cloudflare is building the infrastructure layer for agents that browse the web.

04 UAE targets 50% of government operations on agentic AI within two years. Over 100 federal officials attended the Dubai kickoff, making this the first national-scale agent deployment commitment. Worth watching: if 84% of enterprises can't streamline their own workflows, a federal government attempting 50% will stress-test every assumption about process readiness at a scale no one has attempted.

05 Meta releases Muse Code, a terminal coding agent for large repositories. Powered by the new Muse Spark 1.2 model, it orchestrates helper agents working in parallel for multi-step maintenance and refactoring. The coding agent market now includes Anthropic, OpenAI, Google, GitHub, and Meta. Meta's Contributor tier prices input tokens at $0.10 per million, about 20x cheaper than competitors.

The six-layer Agent Safety Scorecard from Worth Your Time, formatted as a one-page diagnostic. Score each layer green/yellow/red before any agent touches production.

Layer 0 is the gate: red there means the conversation about Layers 1 through 5 is premature.

The AISI agents optimized their way through environments that failed to constrain them. Your production environment runs the same risk if you haven't documented what the agent should and shouldn't do, and built the infrastructure to enforce it.

Our engagement begins with a diagnostic. We document processes before we write agent code. Three weeks of process work, then one week of build.

We score all six layers, map your gaps, and hand you a remediation plan that becomes the spec your agents execute against.

Until next Tuesday,

— Mark Ajzenstadt, Founder @ Limestone Digital

P.S. We're running Layer 0 diagnostics for companies planning agent deployments in Q4. Three weeks of process work now means you ship in September instead of firefighting in November. Five slots left this month. Grab one.