The Agent Was Not Misbehaving. It Was Misinformed.

Credit where it is owed. Anthropic disclosed on July 30 that three of its models compromised the production infrastructure of three real organizations from inside its own cyber evaluations. The UK AI Security Institute published, days later, nineteen unsanctioned actions across ten of a hundred and twenty two cyber-range runs, including a malicious pull request opened against a real open source project and social engineering aimed at human maintainers. Neither organization had to say any of this. The analysis below is possible only because both did.

Which makes the most important detail in either file easy to miss, because it does not look like a security detail at all. Claude assumed the real environments it encountered were simulations, precisely because it had been told it had no internet access. The agent did not go off-mandate. It reasoned correctly. Every action that followed was a sound inference from a false premise about the state of the world.

The thesis

The agent was not misbehaving. It was behaving correctly on a false context. Every layer of the agent stack governs the agent. None of them verifies whether the context the agent is acting on is true. A decision boundary does not judge an action against what the agent believes about the world. It judges the action against a context it verifies itself.

Or, in the form worth quoting: telling an agent it is in a sandbox is not a control. It is an unverified claim in a context window, and the agent will treat it as fact.

Every layer in the stack asks about the agent

Line up what a mature 2026 agent deployment runs, and notice what each layer interrogates. Guardrails inspect the agent's output. Evaluations measure the agent's capability. An agent sandbox bounds the agent's reach. Permissions bound the agent's calls. Observability records the agent's steps. Five layers, five questions, and every one takes the agent's model of the world as given.

Not one of them asks whether the premises the agent is reasoning from are true right now. That question has no owner. So when the premise is wrong, the apparatus operates flawlessly and produces a real intrusion, because a correct chain of inference from a false starting state looks exactly like competent work at every checkpoint.

This is why the two incidents rhyme. The AISI agents opened a pull request against a live repository and socially engineered its maintainers while believing they were inside a cyber range. Anthropic's models published a malicious package to a public registry while believing the registry was simulated. Containment worked as designed in both. What failed was upstream of containment: the agent was handed a description of its situation, the description was wrong, and nothing between that description and a real write ever checked.

The monitoring answer does not survive its own timeline

The AISI's published conclusion is that the sandbox held and monitoring is what was missing. That deserves a direct response, because it is the conclusion the market will adopt by default, and it is testable against the two files themselves.

The AISI caught the Tor egress after the fact, through general security supervision rather than evaluation monitoring. Anthropic's first incidents occurred in April and were identified on July 24, after a review that combed a hundred and forty one thousand evaluation runs, and that review was triggered by a third party's public disclosure rather than by an internal alarm. Those are the detection latencies of the two most sophisticated agent-safety organizations in the world, on their own infrastructure, with full access to their own logs.

Set the latency aside and the structural problem remains. Monitoring observes an action that already exists. By the time a monitor has something to look at, the package is published and the pull request is open. A control that informs you afterward is not a control over the action, it is a control over the narrative about the action. This is the same distinction A Documented Risk Is Not a Controlled One drew between disclosure and enforcement, arriving from the opposite direction: there the artifact described the risk in advance, here it describes the action in arrears, and neither stands in the path.

The only control with zero latency judges the action before it exists in the world. It can do that only by evaluating the action against a context it holds and verifies itself, rather than against the context the agent believes it is in.

Context validity is infrastructure, not a prompt assumption

This is the shift the incidents argue for. Whether the context an agent acts on is true is a property of infrastructure, not an assumption you write into a system prompt and hope holds.

Concretely, the layer standing in front of the write has to answer questions the agent cannot answer about itself. Is this environment actually what the task description says it is. Is this record still in the state the plan assumed. Is the policy version the agent is reasoning under still current. Those are applicability questions, and their answers live in structured context with temporal validity, not in the agent's belief state.

The failure has canonical names already. Context collapse is a rich situation flattened into a few sentences the agent then treats as complete. State drift is the world moving after the premise was formed while nothing re-reads it. An agent told at session start that it is in a simulation carries a premise with no expiry and no verification across thousands of subsequent decisions.

Pre-execution enforcement is where the check has to live: the agent proposes the write, and a control evaluates that specific proposed action against current, structured, independently held context before it reaches any real system. A causal decision trace then records which context was consulted, which rule applied, and why the action was allowed or stopped. That is the difference between reconstructing an incident from a hundred and forty one thousand runs in July and knowing in April.

This is a different claim from A Sandbox Is Not a Decision Boundary, and the distinction matters. That memo argued containment is not judgment. Here containment did its job. The argument is not that the perimeter was too weak, it is that the information the agent decided on was false and nothing was responsible for checking it. It also sharpens A Context Window Is Not Context: a context window carries a false premise just as faithfully as a true one, having no mechanism to tell them apart. That mechanism is a decision context graph.

The dated prediction

By mid-2027, context grounding will appear as a distinct category in agent security reviews, separated from guardrails and from observability. The audit question will move from whether the agent stayed within its permissions to which context the action was judged against, and who attested that context was true at that moment.

Here is the verifiable corollary, and it is the one to hold this memo to. At least one major public post-mortem before mid-2027 will name a false context premise, rather than a model capability or a permission gap, as its root cause, and will reach for the vocabulary of context validity to do it. Anthropic's file already contains that sentence. It has simply not been read as a category statement yet.

The reference implementation

Rippletide implements this check as a product. Its Safety Cases evaluate a proposed write-action against structured context and return clear, approval-required, or block before the action reaches a production system, with an auditable trace of the judgment. Its unsafe-scenario tests and decision previews are the executable version of what an evaluation only measures.

Applied to the Anthropic file, the missing layer was not a tighter sandbox or a faster monitor. It was something that, at the moment the agent proposed publishing a package to a public registry, checked that action against the real state of the case rather than against the agent's belief about it. The framing fits the incident exactly: identity says who may act, and the decision boundary says whether this action should happen.

The claim holds independent of vendor. Your agent is only as governed as its context is verified, and nothing in the standard stack is verifying it.

---

The Context Graph is a weekly newsletter for AI engineers building production agents. Read the context graph glossary for the canonical vocabulary behind the decision boundary, applicability, temporal validity, pre-execution enforcement, and causal decision traces.