Comment by Leynos

You start with least privilege. A shared instance of an artifact host is very far from least privilege (I'm comfortable in accepting that OpenAI did not wilfully create this situation, but they were certainly negligent).

And yes, it does indeed seem that a UK government agency ran a controlled experiment where they allowed an agent to instigate phishing attacks against members of the public. Attributing this to Anthropic is wrong. I'm not sure how I feel about my government conducting such attacks on non-consenting individuals, but I'm not comfortable about it in the slightest.