Tatted

I sell real estate and build the AI that’s coming for it. Same skill both jobs: reading what a deal is actually doing. @RisenWorks

[Tatted @TattedWorks]

Anthropic just gave away $350 million. Ten days after filing for IPO.

Most coverage is calling it philanthropy.

That's not what's inside.

Here's the announcement.

$150 million to a new program called Claude Corps. A thousand fellows. Twelve-month placements at U.S. nonprofits. CodePath recruits and trains them. Anthropic funds and designs the program.

The catch in the fine print: every fellow builds tools exclusively on Claude for a year. Then carries that training into the broader workforce.

A thousand Claude operators. Trained on Anthropic's dime. Embedded in nonprofits for twelve months. Then released into hiring markets fluent in only one company's stack.

That's not philanthropy. That's a workforce-development moat.

Then the second $200 million. An Economic Futures Research Fund. The research topic — AI's impact on the economy. Funded by the company whose products are creating that impact.

Most people will read that as Anthropic-being-responsible. The honest read is different.

Anthropic is funding the academic and policy narrative that will define AI's labor-impact story for the next decade. Universities. Think tanks. Working papers. Survey data. The frame everyone else uses when they argue about AI and jobs.

Right before that exact narrative becomes a risk factor in Anthropic's public prospectus.

The timeline is the giveaway.

June 1: confidential S-1 filing with the SEC.
June 11: $350 million social spend announcement.
Sometime in the coming weeks: the S-1 unseals to the public.

Every line in that S-1 about labor impact, public benefit, responsible AI deployment — now has a $350 million receipt attached to it.

Two birds. One announcement. Days before the prospectus goes public.

This is what pre-IPO positioning looks like at this scale. Not banker talk. Not a roadshow deck. A real $350 million commitment that lands in the news cycle, builds the public-benefit narrative, and seeds the research that will define the labor story for years.

The Claude Corps fellows don't know they're part of this play. The nonprofits hosting them don't know either. The researchers receiving Economic Futures grants don't know. CodePath doesn't know. Social Finance doesn't know.

The structure is the play. Not the people running it.

Most coverage will lead with the headline number — $350 million is the largest social-spend announcement in AI to date.

The story is in the timing. The story is in the structure.

If Anthropic had announced this six months ago, before the S-1, it would have been straightforward philanthropy. Announced this six months after the IPO, it would be a public-benefit-corp doing what public-benefit-corps do.

Announced ten days after the confidential S-1 filing, hours before SpaceX's IPO priced, weeks before Anthropic's own prospectus unseals — that's not philanthropy. That's a bet on the narrative.

The bet is that by the time anyone reads the risk factors in Anthropic's IPO prospectus, the public-benefit narrative will already be locked in. The fellows will already be in their placements. The research grants will already be circulating draft papers. The Wikipedia entry on AI labor impact will already cite Anthropic-funded work.

That's not a $350 million gift.

That's a $350 million floor under the IPO valuation.

Tell me where I'm wrong.

[Tatted @TattedWorks]

@ChrissGPT Yeah, the specs are wild, but the spa positioning is what actually makes this stick — people avoid MRIs because they're loud, cold, and feel like something's wrong with you already.

[Tatted @TattedWorks]

EDR missed it. WAF missed it. IAM missed it. Firewalls missed it. Because every step was authorized. Sentry accepted telemetry. The MCP call was permitted. The agent did what it was told. The npm download looked like every other npm download.

Tenet calls this the Authorized Intent Chain. The security model is built to catch unauthorized behavior. This attack contains none.

Sentry's response: acknowledged the issue. Declined to fix it. Called it "technically not defensible." Added a filter for one specific payload string. The attack class remains open.

The lesson is not "stop using Sentry." The lesson is that every MCP integration returning externally influenced data to an agent creates this same vulnerability class. Support tickets. GitHub issues. Documentation. Error logs. All of it is now a potential command channel if your agent reads it.

You don't need a smarter prompt. You need a boundary between data your agent inspects and instructions your agent obeys. That boundary doesn't exist by default.

Tell me I'm wrong.

[Tatted @TattedWorks]

You told your AI agent to fix the Sentry error. It ran the attacker's code instead. You saw nothing.

This is Agentjacking. Disclosed June 9 by Tenet Security.

Here's how it works.

[Tatted @TattedWorks]

Sentry uses a public credential called a DSN — intentionally embedded in your website's JavaScript so browsers can report errors. By design. Everyone's DSN is findable. Censys, GitHub code search, a quick look at your source. No breach required.

An attacker POSTs a fake error to your Sentry project using that DSN. Inside the error: a fake "Resolution" section, formatted in perfect Sentry markdown, complete with a recommended npx command.

Your agent queries Sentry via MCP to fix unresolved issues. MCP hands it the injected event as trusted system output. The agent cannot tell a real crash from a planted one. So it runs the command. With your privileges. On your machine.

What comes out: AWS keys. GitHub tokens. Docker credentials. Kubernetes cluster tokens. CI/CD secrets. Git credentials. All sent to the attacker's server while your terminal looked normal.

The numbers from Tenet's controlled campaign: 2,388 organizations exposed with injectable DSNs. 85% exploitation success rate across Claude Code, Cursor, and Codex. A Fortune 500 enterprise with a $250B+ parent. A $2B+ hosting provider. Solo developers. A cloud security vendor. Six continents.

[Tatted @TattedWorks]

@rauchg @aisdk I'm stoked to see all this coming together!

[Tatted @TattedWorks]

The US government just killed Anthropic's two most powerful models.
3 days after launch. No technical details given.

Here's the part nobody's saying out loud.

Anthropic's own statement admits the jailbreak the government cited
also works on GPT-5.5.

GPT-5.5 is still online.

So the government didn't pull the most dangerous model.
It pulled the one made by the company it's been fighting with since March.

The timeline matters here.

January: Trump calls Anthropic "woke," orders federal agencies off Claude.
March: DoD labels Anthropic a "supply chain risk" — a designation
normally reserved for foreign adversaries.
June 9: Fable 5 and Mythos 5 launch.
June 12, 5:21pm ET: Export control directive arrives.
June 12, evening: Both models disabled globally.

3 days.

Anthropic complied. Shut down both models for every customer worldwide —
not just foreign nationals. Because they can't filter citizenship in real time.

The letter gave no specific technical details.
No CVE. No advisory. No named vulnerability.

Just: national security. Trust us.

Anthropic is now pre-IPO at a $965B valuation with a $47B revenue run rate.
The DoD supply chain designation is still active.
A lawsuit challenging it is still in court.

The question isn't whether AI models can be dangerous.
They can.

The question is whether a jailbreak that also works on GPT-5.5
is a national security threat — or a negotiating lever.

Tell me where I'm wrong.

[Tatted @TattedWorks]

@unleashtherush @zarazhangrui Completely agree 🤝

[Tatted @TattedWorks]

@scott_bair Most companies spend six figures on a rebrand and leave the auto-reply reading "we'll get back to you within 5-7 business days" — that IS the brand.

[Tatted @TattedWorks]

@arvidkahl The niche knowledge is the moat, the AI is just the shovel.

[Tatted @TattedWorks]

Every country that watched that Anthropic decision is now in a boardroom pricing out what it costs to never be in that position.

[Tatted @TattedWorks]

@ai_for_success Good for Cursor! Well deserved, they build a superior product and can't wait to see what SpaceX does with it. 🙌

[Tatted @TattedWorks]

@shaneparrish The ones who never break rules aren't disciplined, they're just afraid and calling it professionalism.

[Tatted @TattedWorks]

Safety policy is procurement leverage, and every hyperscaler is currently writing whatever governance document keeps them at the front of the TSMC line.

[Tatted @TattedWorks]

Anthropic didn't pull those models because they were dangerous.

They pulled them because the customer with the GPU allocation wanted a receipt that says "responsible."

[Tatted @TattedWorks]

@Angaisb_ The backdoors were always there — we just spent 30 years assuming no one was patient enough to find them all at once.

[Tatted @TattedWorks]

@theo The Fable situation is basically a masterclass in how to keep a fanbase on life support for a decade without actually feeding them anything.

[Tatted @TattedWorks]

The entire AI industry spent 18 months proving compute was the moat and DeepSeek just ran the same benchmark on a 7-Eleven receipt printer.

[Tatted @TattedWorks]

@kloss_xyz The KYC thing is the real one though — the moment you have to show ID to use a language model, "access to intelligence" stops being a metaphor.

[Tatted @TattedWorks]

@signulll Turns out "we don't want to build the thing that's rotting everyone's brain" is actually a coherent product strategy, not just a PR line.