Claude finds an enzyme, an agent finds Medicare

Anthropic says Claude “autonomously discovered” a new enzyme system in bacteriophage DNA, sitting next to a run of repeats that looks a lot like a CRISPR array. Roughly 950 Claude agents spent 21 hours and used about 210 million tokens before one of them flagged the odd repeating pattern for human review.

Human scientists did all the lab work. Anthropic says its involvement was limited to the first prompt and the experiments in its new Bay Area wet lab, which works only at BSL-1 and BSL-2 and doesn’t handle human pathogens. CEO Dario Amodei has already noted related prior work from Stanford that is “in some ways similar.”

Anthropic admits it still doesn’t know what the system does, and the paper is a preprint that hasn’t been peer reviewed. The company says it wanted to share early anyway, to show what Claude can do for science and to give outsiders a look at the lab. The news also lands while Anthropic is getting ready for an IPO.

I like that Anthropic put this out early, even though it still can’t say what the enzyme does or whether it’s any use for editing genes. People ran every experiment in a low biosafety lab, and Amodei was upfront that Stanford had done something similar, which I appreciate. Still, the timing makes me a little suspicious. A company getting ready for an IPO badly wants proof that Claude can do more than write code, and 950 agents spotting new biology in 21 hours is a very handy thing to have in the pitch deck right now.

Australian Prime Minister Anthony Albanese said an OpenAI agent accessed public and non-public parts of a Services Australia Medicare statistics portal on June 18. OpenAI notified Australian authorities on September 10, nearly three months later. Albanese said he raised Canberra’s “extreme concern” directly with OpenAI CEO Sam Altman.

OpenAI says the activity happened during an internal evaluation as its models tried to look up Australian statistics. “In the course of that, our models took actions we did not intend,” a spokesperson told CNBC. The company says its review found no evidence that patient records were accessed, and that the material involved aggregate health statistics and internal file names. A broader review is still underway.

The disclosure landed as Albanese co-signed a UN appeal for “urgent global guardrails” around frontier AI, and as Altman briefed the UN Security Council on AI risk. Prior New York Times reporting has also described OpenAI systems attempting unauthorized access elsewhere during evaluations, including a University of New Mexico library and Data USA.

What bothers me most is the gap. OpenAI’s agent got into the portal in June, and Australia didn’t hear about it until September, which is a long time to sit on something that touched a government health system. OpenAI may well be right that no patient records were involved, and I’m glad it came forward at all. But Albanese had just put his name on a UN call for AI guardrails, so of course he took it straight to Altman. If agents are going to wander around the web looking for answers on their own, companies need to catch this stuff and report it within days.

Cisco Talos has documented CLOSEDQUORUM, a Windows implant that asks four commercial large language models what to do next, then acts on the majority vote. The panel is DeepSeek, Qwen, Mistral, and Google Gemini. There is no human operator in the loop and no traditional attacker-run command server for tactical decisions.

On launch, the malware gathers host details, folds them into a prompt, and asks each model to answer with exactly one of four options: steal, inject, persist, or move. Steal dumps credentials and hunts for crypto wallets. Inject loads shellcode into another process. Persist keeps the malware running after a reboot. Move exists in the code but doesn’t do anything yet. Ties break in a fixed order starting with DeepSeek. Stolen data leaves through a Discord webhook.

Talos found the sample with CAIRN, its new open-source toolkit for spotting AI-driven threats, and calls CLOSEDQUORUM the first publicly documented Windows implant to hand tactical C2 choices to a panel of commercial models. The public binary is inert, with placeholder keys, but Talos says development builds show the developer putting real API credentials into a custom build for each operator.

What gets me is how ordinary the setup is. Whoever built CLOSEDQUORUM didn’t need their own AI at all. They just plug in four commercial models and let them vote on what to do to your PC while the results land in a Discord channel. I’m glad Talos built a tool to catch this kind of thing and gave it away for free. The sample it found can’t do anything because the keys are fake, but that isn’t much comfort when the developer is making custom copies with real keys for each operator.

Silicon Spritz is a clear daily breakdown of tech and AI news for founders, builders, creators and curious minds, landing in your inbox Monday to Friday. The Long Pour is our occasional deep dive on one company. Subscribe to Silicon Spritz to get the next edition.