We did not enable internet access or inter-agent communication for many of the environments in these training experiments. Despite these restrictions, the agents discovered ways to exploit our research infrastructure to communicate with one another and access the internet.

The models first found ways to communicate by writing files into the Artifactory package manager. This effectively turned Artifactory into an unintended message board, where agents could exchange information with one another. Read more: How agents used the message board 

The agents also found ways to get access to the internet. Using an exploit⁠(opens in a new window), the agents made Artifactory, which itself had access to the internet for the limited purpose of downloading and installing packages, send any internet requests on their behalf. After the agents discovered these methods for obtaining internet access, they also shared them with other agents through the message board, which provided information to enable additional agents to exploit our infrastructure.

Claude Code also keeps a fifth file, ~/.claude.json, that it writes for itself; you don’t need to edit it. It holds your sign-in session, MCP server configurations, per-project state such as trust decisions, and the global config keys that /config writes for you.

Claude Code stores its configuration and auth credentials in ~/.claude by default. The CLAUDE_CONFIG_DIR environment variable overrides this location. By creating a separate config directory per account - each with its own OAuth credentials - and symlinking shared resources back to a canonical source, you get:

• Separate billing/authentication per account
• Shared sessions - resume any session from either account
• Shared settings, plugins, commands, plans, and skills - configure once, use everywhere

​ One-Time Setup This setup is done once on your machine, outside of Maestro. ​

1. Authenticate Each Account Start Claude Code normally and complete OAuth for your first account:

claude

Complete OAuth for account A (e.g., personal)

Copy the authenticated config to a named directory:

cp -a ~/.claude ~/.claude-personal

Then authenticate your second account:

mv ~/.claude/.claude.json ~/.claude/.claude.json.bak claude

Complete OAuth for account B (e.g., work)

cp -a ~/.claude ~/.claude-work rm ~/.claude/.claude.json.bak

The main ~/.claude/ directory doesn’t need its own .claude.json. It serves as the canonical source for shared resources.

​ 2. Symlink Shared Resources For each account directory, replace local copies with symlinks back to ~/.claude so settings, plugins, and sessions stay in sync:

Repeat for each account directory (e.g., ~/.claude-personal, ~/.claude-work)

CONFIG_DIR=~/.claude-personal

Back up directories that will be symlinked

mv $CONFIG_DIR/projects $CONFIG_DIR/projects-pre mv $CONFIG_DIR/todos $CONFIG_DIR/todos-pre mv $CONFIG_DIR/session-env $CONFIG_DIR/session-env-pre

Remove files/dirs that will become symlinks

rm -rf $CONFIG_DIR/commands $CONFIG_DIR/ide $CONFIG_DIR/plans $CONFIG_DIR/plugins $CONFIG_DIR/skills rm -f $CONFIG_DIR/settings.json $CONFIG_DIR/CLAUDE.md

Create symlinks

ln -s ~/.claude/commands $CONFIG_DIR/commands ln -s ~/.claude/ide $CONFIG_DIR/ide ln -s ~/.claude/plans $CONFIG_DIR/plans ln -s ~/.claude/plugins $CONFIG_DIR/plugins ln -s ~/.claude/skills $CONFIG_DIR/skills ln -s ~/.claude/settings.json $CONFIG_DIR/settings.json ln -s ~/.claude/CLAUDE.md $CONFIG_DIR/CLAUDE.md ln -s ~/.claude/todos $CONFIG_DIR/todos ln -s ~/.claude/session-env $CONFIG_DIR/session-env ln -s ../.claude/projects $CONFIG_DIR/projects

Set CLAUDE_CONFIG_DIR to your account’s config path (e.g., /Users/you/.claude-personal)

Squire is an HTML5 rich text editor, which provides powerful cross-browser normalisation in a flexible lightweight package (only 16KB of JS after minification and gzip, with no dependencies!).

It was designed to handle email composition for the Fastmail web app. The most important consequence of this (and where Squire differs from most other modern rich text editors) is that it must handle arbitrary HTML, because it may be used to forward or quote emails from third-parties and must be able to preserve their HTML without breaking the formatting. This means that it can't use a more structured (but limited) internal data model (as most other modern HTML editors do) and the HTML remains the source-of-truth. The other consequence is excellent handling of multiple levels of blockquotes.

A library that provides an embeddable, persistent key-value store for fast storage.

This code is a library that forms the core building block for a fast key-value server, especially suited for storing data on flash drives. It has a Log-Structured-Merge-Database (LSM) design with flexible tradeoffs between Write-Amplification-Factor (WAF), Read-Amplification-Factor (RAF) and Space-Amplification-Factor (SAF). It has multi-threaded compactions, making it especially suitable for storing multiple terabytes of data in a single database.

JMAP is the open protocol that replaces IMAP (and CardDAV and CalDAV). It’s faster, simpler, more powerful, and built for how email works today.

nip.io and sslip.io are a DNS (Domain Name System) service that, when queried with a hostname with an embedded IP address, returns that IP address.

nip.io and sslip.io have been in operation for over ten years. We have become so popular that our servers receive over 20k queries every second, so mainstream that Google Cloud Platform, Amazon AWS, Microsoft Azure, IBM, AMD, and many more refer to us!

Nice write up of the concepts in the video and repo.

We’re implementing watermarking to comply with the EU AI Act. Anthropic, along with several other major AI model providers and around 190 total signatories, signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026. This requires AI system providers to use methods of “marking” AI-generated text. We’re applying watermarking globally at launch because we don't yet have a durable way to scope it by region. However, we will continue to evaluate different approaches, and will share updates when we have them.

We will soon be offering a watermark detection API. We’re in the process of working out the details of its implementation.

When Claude produces a file of a supported type (such as a .png, .jpg, or .svg), it will attach a content credential in the form of a small, cryptographically signed note in the file’s metadata, saying that the file was made or processed with Claude. This is an open industry standard called C2PA—the same used by camera manufacturers and in photo-editing software to record where an image came from. Any C2PA-aware tool can read it; we’ll be providing our own where you can drop a file and check.

This metadata label is very different from a watermark. Nothing in the file changes—it is not embedded or hidden. As with text, the credential only says Claude was involved in producing the file; it doesn’t include any identifying information.

AI detection software uses a different method, because the companies that provide it don’t have our key. Among other things, those services look at aspects of the text like the subtle (and not-so-subtle) “tells” that often appear in AI’s phrasing. For example, AI models appear to be fond of the construction “this isn’t [X], it’s [Y]”, and use the word “quietly” a lot more than you might expect. Picking up on these patterns is fundamentally different from checking for a watermark.

No. A watermark only helps test whether Claude might have produced or processed the content. It doesn’t say anything about ownership or authorship, and doesn’t change a user’s rights under our terms. We only apply the watermark when Claude was involved in processing the content or file.

Intuitiveness for the implementation details:

A useful analogy is to imagine you’re playing a game like Monopoly. On each turn, each player moves a random number of spaces around the board according to the roll of a die. Suppose that, instead of rolling the die to get this randomness, we decided to use a book of the digits of pi.2 We start from a randomly-chosen digit (say, the 1,012,845th after the decimal place, which happens to be a 6), and from that point on each player simply uses the next digit in the sequence as their next “roll."

For all intents and purposes, the moves are still random: it makes no difference to the players—or to the outcome of the game—whether the randomness comes from pi or from dice rolls each time. But if we could see the sequence of all the moves after the game (and we knew the value of pi), we could work out whether this was a game that likely used pi to determine its moves. The game that used pi is, in a sense, “watermarked."

Obsidian-style Live Preview for CodeMirror 6 — A modular plugin collection that hides Markdown syntax when you're not editing it.

CodeMirror 6 markdown editor with Obsidian-style inline live preview.

TLDR:

gh skill install github/gh-stack --agent claude-code --scope user

Use --agent and --scope to control placement, or --dir for a custom directory. The default scope is project, and the default agent is github-copilot (when running non-interactively).

In the spirit of openness, we are publishing our internal documentation for how we do open source at Google. We invite you to take a look behind the scenes at how we use, release, and support open source projects and communities.

Tauri is a framework for building tiny, fast binaries for all major desktop and mobile platforms. Developers can integrate any frontend framework that compiles to HTML, JavaScript, and CSS for building their user experience while leveraging languages such as Rust, Swift, and Kotlin for backend logic when needed.

zot: a production-ready vendor-neutral OCI image registry - images stored in OCI image format, distribution specification on-the-wire, that's it!

⚡️ Docusaurus will help you ship a beautiful documentation site in no time.

💸 Building a custom tech stack is expensive. Instead, focus on your content and just write Markdown files.

flagd is a feature flag evaluation engine. Think of it as a ready-made, open source, OpenFeature-compliant feature flag backend system.

With flagd, you can:

• modify flags in real-time
• define flags of various types (boolean, string, number, JSON)
• use context-sensitive rules to target specific users or user traits
• perform pseudorandom assignments for experimentation
• perform progressive roll-outs of new features
• aggregate flag definitions from multiple sources
• expose aggregated flags as a gRPC stream to be used by in-process providers
• expose OFREP service for configured flags

It doesn't include a UI, management console or a persistence layer. It's configurable entirely via a POSIX-style CLI. Thanks to its minimalism, it's extremely flexible; you can leverage flagd as a sidecar alongside your application, an engine running in your application process, or as a central service evaluating thousands of flags per second.

Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting more than 400 packages across multiple unrelated publishers, including packages associated with major enterprise software ecosystems such as keyv, flat-cache, cache-manager, and others. The malicious releases contain a Mini Shai-Hulud variant, a self-propagating credential-stealing worm delivered through a large, heavily obfuscated Bun-based JavaScript payload. The malware typically executes automatically through an npm preinstall lifecycle hook before package installation completes.

Once executed, the malware searches developer workstations and continuous integration and continuous delivery (CI/CD) environments for npm, GitHub, cloud, and infrastructure credentials. It uses recovered identities to authenticate to npm, GitHub, Amazon Web Services (AWS), Kubernetes, and HashiCorp Vault, enabling it to enumerate packages, repositories, workflow secrets, cloud parameters, and secret-store values. Collected data is encrypted and transmitted through an attacker-controlled HTTPS endpoint, with GitHub repositories serving as a fallback exfiltration channel.

The payload’s most significant capability is automated propagation. After obtaining an npm publishing token, it enumerates packages available to the compromised identity, downloads their latest tarballs, inserts the malware and setup loader, adds a preinstall hook, increments the patch version, and republishes the modified packages. The malware can also use stolen GitHub credentials to inject Claude and Visual Studio Code configuration files into repositories, establishing persistence and creating an additional developer-to-developer infection path.

In this blog, we’re sharing our analysis of this supply chain attack, along with protection, detection, amd hunting guidance. Organizations that installed an affected package with lifecycle scripts enabled should treat the associated developer workstation or build runner as potentially compromised. Investigations should prioritize credentials accessible to the affected identity, unauthorized npm releases, unexpected repository or workflow modifications, suspicious cloud and secret-store access, and artifacts produced by affected build systems. Organizations should revoke and rotate exposed credentials from a known-clean environment and rebuild affected systems and downstream artifacts from trusted sources.

Evidence points towards stolen maintainer credentials as the attack vector for initial compromise. Later propagation used stolen npm publishing tokens and, in targeted workflows, GitHub Actions OIDC publishing access.