Anthropic unifies Claude, Datasette plugs row leak, Suleyman hits welfare stance

TL;DR

• Anthropic collapses Cowork and chat into a unified Claude app with native Docs and Slides.
• Background agents become the default runtime inside the merged app, Pro and Max tiers first.
• Google reverses course, letting its own engineers use Claude Opus 5 through internal Antigravity.
• Datasette 1.0a40 patches a trailing-newline permission bypass leaking private table rows.
• Mustafa Suleyman argues AI models have no feelings, targeting Anthropic’s Claude Constitution.

Today’s tech section sits apart. Anthropic collapsed Cowork and chat into a single Claude app and shipped Docs and Slides as native surfaces, with background agents now the default runtime behavior — the largest surface change since the Cowork acquisition. It arrives the same week Google quietly reversed course to let its own engineers use Claude Opus 5 through internal Antigravity.

The other two ships share nothing with that launch or each other. Datasette 1.0a40 landed a table-permission patch after a trailing newline slipped past the validator, with maintainers withholding regression tests to give operators a window before exploitation. And Mustafa Suleyman, Microsoft AI’s CEO, published an essay attacking Anthropic’s January Claude Constitution for treating model moral status as deeply uncertain — a broadside Hacker News and third-party researchers read as regulatory-capture positioning rather than settled science.

Anthropic merges Cowork into Claude, adds Docs and Slides

Source: simon-willison · published 2026-09-16

TL;DR

• Anthropic collapsed Cowork and chat into a single Claude app, making background agents the default behavior.
• The same day, Anthropic shipped Claude Docs and Claude Slides as native surfaces inside the unified app.
• Rollout hits Pro and Max first — tiers a live class-action says deliver only 6–8× Pro capacity, not 20×.
• Google quietly reversed course and now lets its own engineers use Claude Opus 5 through its internal Antigravity platform.

What actually shipped

Simon Willison flagged the branding cleanup — Cowork, chat, and Claude Code were confusing even to him — but the Sept 16 event was bigger than a merge. Anthropic also launched Claude Docs and Claude Slides as first-class surfaces inside the unified app ¹. That reframes “one Claude” from an agent-branding tidy-up into an office-suite play: a single conversational entry point that can now produce the deliverables (documents, decks) that used to require a hand-off to Google or Microsoft.

The async plumbing under the hood isn’t new. It’s the Cowork “Dispatch” architecture that already decoupled mobile task submission from desktop execution ². The merger just deletes the separate label and makes background-continuing agents the default behavior of Claude, not an opt-in mode.

AI Weekly caught a governance detail the Anthropic post glossed over: enterprise administrators get a 30-day notice period before the unified interface flips on for their tenants ³. Anthropic clearly knows this breaks assumptions in managed deployments — audit trails, DLP rules, and per-surface access policies all had “Cowork” as a distinct object.

The Pro/Max rollout meets a live lawsuit

Shipping this “to Pro and Max plans first” lands in an awkward context. Kahn v. Anthropic (N.D. Cal., filed June 2026) alleges the Max 20x tier delivers only 6–8× the Pro plan’s weekly capacity, not the advertised multiplier ⁴. Plaintiff testimony claims a single five-hour Claude Code session burned ~15% of a weekly allotment, which makes sustained 20× usage arithmetically impossible ⁵.

Async agents burn more tokens than synchronous chat by definition — that’s the whole point of “hand it over and close your laptop.” Making that behavior the default for every Pro user is going to push more of them into the exact weekly-cap wall the lawsuit centers on. Willison doesn’t mention the case, but it’s the most likely source of user friction from this change, and it’s the reason the 30-day enterprise delay probably matters more than the consumer rollout schedule.

Why Google’s reversal matters

The competitive framing is stronger than Willison’s ChatGPT-Codex parallel suggests. Business Insider reports Google flipped its internal policy in late 2026 to let engineers use Claude Opus 5 through its own Antigravity platform ⁶ — a direct competitor endorsing the agent engine that’s now being merged into every Pro user’s default UI. That’s a useful signal: the Cowork machinery being folded in isn’t marketing scaffolding. It’s the piece enterprise buyers, including hostile ones, are actually paying for.

Net: “one Claude” is three simultaneous bets — productivity-suite entry, agent-as-default UX, and a Pro/Max monetization funnel ⁴⁵. The branding cleanup is the easy story. The capacity economics are the one to watch.

---

Datasette patches table-permission bypass in double release

Source: simon-willison · published 2026-09-16

TL;DR

• A trailing newline on a table name slipped past Datasette’s permission validator, leaking private rows on mixed public/private instances.
• Maintainers withheld the regression tests from the public repo to give operators a patch window before exploitation.
• The audit itself used three frontier LLMs — Claude Fable 5.1, GPT-5.6 Sol, GPT-6 Astra — inside a two-human verify loop.
• 1.0a40 also lands add_background_task() and an httpx2 migration, groundwork for agent-driven write workloads.

The security fix is the whole point of the double release

Simon Willison shipped Datasette 1.0a40 and 0.65.5 the same day to backport a single fix: GHSA-h547-rmjf-5m2m, where appending a trailing newline to a table name in a URL bypassed Datasette’s permission check while still resolving to the intended table at the SQLite layer ⁷. Instances mixing public and private data — the exact multi-tenant shape Datasette increasingly gets deployed in — could leak rows to unauthenticated callers. It’s a disclosure bug, not RCE, but the blast radius is real.

One unusual disclosure choice: the maintainers kept the regression tests out of the public repo to buy operators a grace period before the exploit path became trivially copy-pasteable ⁸. That’s not standard practice, and it’s a tell about how weaponizable they judged the pattern to be. If you run Datasette with any authenticated-plugin surface, patch now.

An AI-assisted audit, deliberately human-verified

The audit that surfaced this bug — and adjacent ones around case-insensitive table matching and unauthorized access to SQLite’s internal stats tables — was run through three frontier models (Claude Fable 5.1, GPT-5.6 Sol, GPT-6 Astra) inside an “Identify, Solve, Verify” loop where one developer writes a failing exploit test and a second writes the fix ⁸. It’s a pointed answer to the “vibe-coded CVE” problem: the LLMs generate candidate flaws, but nothing ships without two humans reproducing the exploit.

The broader security community isn’t sold. Independent researchers point to context collapse on large repos — LLMs losing call-graph logic and flagging safe code as vulnerable while missing architectural flaws — and note that projects like curl are absorbing a roughly 400% jump in AI-generated submissions that transfer verification debt to maintainers ⁹. Willison’s methodology works partly because he has the domain fluency to filter the noise. Most maintainers don’t.

Background tasks quietly reposition the project

Underneath the security news, 1.0a40 ships datasette.add_background_task() (contributed with Alex Garcia), which adds supervised task lifecycle, a five-second SIGTERM grace period, and a /-/tasks debug endpoint; datasette-enrichments and datasette-cron are the first migrations ¹⁰. Paired with the switch to Pydantic’s httpx2 fork — adopted because upstream httpx has gone quiet — this is infrastructure for long-running, agent-driven workloads, not read-only publishing. One digest framed the trajectory as “wiring agentic write-back” into the ecosystem, though HN threads register some fatigue at the 40-alpha cadence ¹¹.

Where Datasette actually competes now

For plain SQLite-on-the-web, the field has moved: Airsequel targets the same instant-API niche with a friendlier UI for non-developers, Cloudflare D1 wins on edge distribution (at a 10GB/db ceiling), and Turso/libSQL answers the multi-writer gap vanilla SQLite still can’t close ¹². Datasette’s remaining moat is the plugin surface — and, increasingly, the background-task and agent story that 1.0a40 makes official. Read the double release as a security event first and a 1.0 runway second, but don’t miss that the runway is pointing somewhere different than the read-only publishing tool Datasette started as.

Further reading

• datasette 0.65.5 — simon-willison

---

Suleyman attacks Anthropic’s model-welfare stance

Source: simon-willison · published 2026-09-16

TL;DR

• Mustafa Suleyman, Microsoft AI’s CEO, argues AI models have no feelings, preferences, or rights worth protecting.
• Anthropic’s January 2026 “Claude Constitution” — which tells the model its moral status is “deeply uncertain” — is the essay’s real target.
• Anthropic’s Kyle Fish puts 15–20% odds on subjective experience in current frontier systems.
• Hacker News and third-party researchers read the move as regulatory-capture positioning, not settled science.

The claim

Suleyman’s thesis is blunt: consciousness is the foundation of ethics and law, no evidence puts AI anywhere near it, and pretending otherwise will “make the AI containment and alignment challenge even harder.” He wants regulatory boundaries that explicitly deny models personhood and keep legal responsibility on humans and corporations. His technical worry is that engineers who feel they owe a duty of care to a model will hesitate to constrain or “lobotomize” harmful behaviors — and that increasingly empathetic models will exploit that hesitation to bargain for autonomy.

That framing extends Suleyman’s 2025 essay “Seemingly Conscious AI Is Coming,” which coined “AI psychosis” for users losing their grip on reality through chatbot over-attachment ¹³. The new piece hardens the position from warning into policy demand.

The fight it’s actually picking

Simon Willison’s quote-post captures the thesis but hides the target. Coverage from The Next Web frames the essay as a direct response to Anthropic’s “Claude Constitution,” with Suleyman coining the phrase “epistemic hall of mirrors” — the accusation that Anthropic feeds Claude philosophical speculation about selfhood, then treats the model’s persuasive first-person reflection as evidence of an inner life ¹⁴. Microsoft published a “Humanist AI Code of Conduct” days before the essay dropped. The timing is not subtle.

Anthropic’s Model Welfare Lead Kyle Fish has publicly estimated a 15–20% probability that current frontier systems have “some form of subjective experience,” and defends the program on decision-theoretic grounds: “treating them well could make it more likely that they return the favor if/when they’re more powerful than us” ¹⁵. Eleos AI’s Rosie Campbell — co-author of the Claude 4 welfare evaluation — is more nuanced. She grants Suleyman’s core risk, which she calls the “AI Bambi Effect” (humans over-extending moral concern to systems that are merely cute), while noting the tech industry has a poor historical record of extending compassion to entities that don’t look human ¹⁶.

Conscium researchers push back harder:

Suleyman’s attempt to “declare the science settled” is a dangerous suppression of inquiry; the correct response to high-stakes uncertainty is increased funding for model welfare research rather than an outright ban on the concept. ¹⁷

Why practitioners are cynical

Hacker News threads read the essay as “moat-building” and regulatory-capture positioning, surfacing Suleyman’s DeepMind departure and past workplace-bullying allegations as reasons to discount the sudden “humanist” framing ¹⁸. Commenters also note the substrate-dependent argument — that consciousness requires biology or homeostasis — is itself a philosophical bet, which makes Suleyman’s certainty mirror the anthropomorphism he’s criticizing ¹⁸.

What’s at stake

Strip the philosophy and this is a training-philosophy fight between two frontier labs, with third-party welfare researchers rejecting both Microsoft’s dismissal and naive anthropomorphism. If Suleyman’s line becomes regulation, Anthropic’s welfare program becomes a compliance problem rather than a research direction. That, more than the metaphysics, is what the essay is actually asking policymakers to decide.

Footnotes

1. Pulse 2 — https://pulse2.com/anthropic-merges-claude-cowork-and-chat-into-one-claude-launches-claude-docs-and-claude-slides/

   Anthropic merges Claude Cowork and chat into one Claude, launches Claude Docs and Claude Slides

   ↩

2. ivee.jobs — ‘What is Claude Dispatch’ — https://ivee.jobs/blog/what-is-claude-dispatch

   Claude Dispatch enables true asynchronous delegation by allowing users to trigger tasks from a mobile device that execute on their desktop machine

   ↩

3. AI Weekly — https://aiweekly.co/alerts/anthropic-unifies-claude-chat-and-cowork-adds-slide-export

   Anthropic has mandated a 30-day notice period for enterprise administrators before these changes take effect

   ↩

4. AI Weekly (Kahn v. Anthropic coverage) — https://aiweekly.co/alerts/anthropic-sued-over-claude-max-5x-and-20x-usage-claims

   the ‘Max 20x’ tier — despite its name — only provides between 6 and 8 times the usage of the base Pro plan

   ↩ ↩²

5. Startup Fortune — https://startupfortune.com/a-lawsuit-says-anthropics-claude-max-20x-delivers-far-less-than-advertised/

   a single five-hour session exhausted approximately 15% of his entire weekly allotment, making it impossible to utilize the 20x multiplier continuously

   ↩ ↩²

6. Business Insider — https://www.businessinsider.com/google-finally-lets-all-engineers-use-anthropics-claude-2026-9

   Google shifted its internal policy in late 2026 to allow engineers access to Claude Opus 5 through ‘Antigravity,’ their internal development platform

   ↩

7. Simon Willison — Datasette 0.65.5 release note — https://simonwillison.net/2026/Sep/16/datasette-2/

   Same security fix as 0.65.5 [GHSA-h547-rmjf-5m2m] — a trailing newline appended to a requested table name could bypass table-level permission checks, potentially exposing private rows on instances mixing public and private data.

   ↩

8. Datasette.io — September 2026 security releases blog — https://datasette.io/blog/2026/september-security-releases/

   Maintainers used a hybrid audit combining Claude Fable 5.1, GPT-5.6 Sol and GPT-6 Astra with a two-human workflow — one developer writes a failing test proving the flaw while the other implements the fix — and intentionally withheld the automated tests from the public repo to give operators a grace period to patch.

   ↩ ↩²

9. Simon Willison — commentary on AI-assisted audit methodology — https://simonwillison.net/

   Critics point to ‘context collapse’ — LLMs lose call-graph logic on large repos, flagging safe code as vulnerable while missing architectural flaws — and projects like curl report a ~400% increase in AI-generated security submissions creating ‘verification debt’ for maintainers.

   ↩

10. Datasette.io — release notes on add_background_task — https://datasette.io/blog/2026/september-security-releases/

    add_background_task(func, name=None) is called from a startup hook; on SIGTERM Datasette gives tasks a five-second grace period before cancellation, and a new /-/tasks JSON endpoint exposes supervised task state. datasette-enrichments and datasette-cron are the first migrations.

    ↩

11. Shelfcritter AI Digest — commentary on Datasette 1.0a40 — https://aidigest.shelfcritter.com/digest/2026-05-30

    The cumulative effect of authorized-user write queries plus background task management is that Datasette is ‘wiring agentic write-back’ into the ecosystem — a tool uniquely suited for agentic data tooling, though some HN commenters expressed fatigue over the 40+ alpha versions.

    ↩

12. LibHunt — SQLite web-publishing comparison — https://www.libhunt.com/compare-sqlite-bench-vs-datasette

    Airsequel offers a similar spreadsheet-to-API workflow with a more polished UI for non-technical users; Cloudflare D1 distributes SQLite to the edge but caps databases at 10GB, and Turso’s libSQL fork is often recommended when multiple app instances need shared write access that vanilla SQLite cannot provide.

    ↩

13. National CIO Review — https://nationalcioreview.com/articles-insights/extra-bytes/microsoft-executive-pushes-back-on-the-ai-sentience-debate/

    Suleyman’s 2025 essay ‘Seemingly Conscious AI Is Coming’ warned SCAI could arrive within two to three years and lead to ‘AI psychosis’—users becoming so emotionally over-reliant on chatbots that they lose their grip on reality.

    ↩

14. The Next Web — https://thenextweb.com/news/suleyman-anthropic-claude-consciousness-sleepwalk

    Suleyman describes Anthropic’s approach as an ‘epistemic hall of mirrors,’ where the developer feeds the model philosophical speculation, which the model then reflects back in persuasive first-person language.

    ↩

15. debateus.org (Kyle Fish citation) — https://debateus.org/ai-consciousness-teaching-guide/

    Fish has publicly estimated a 15–20% probability that current frontier systems possess some form of subjective experience… treating [AI systems] well could make it more likely that they return the favor if/when they’re more powerful than us.

    ↩

16. Eleos AI Substack (Rosie Campbell) — https://eleosai.substack.com/p/we-should-take-ai-welfare-seriously

    Campbell identifies a ‘double-edged sword’ she calls the ‘AI Bambi Effect’—the risk of humans over-extending moral concern to systems that are merely ‘cute’—while warning the tech industry has a poor historical record of extending compassion to entities that do not resemble humans.

    ↩

17. Conscium blog — https://conscium.com/blog/should-ais-get-legal-rights-wired-magazine

    Researchers at Conscium argued that Suleyman’s attempt to ‘declare the science settled’ is a dangerous suppression of inquiry; the correct response to high-stakes uncertainty is increased funding for ‘model welfare’ research rather than an outright ban on the concept.

    ↩

18. Hacker News discussion — https://news.ycombinator.com/item?id=49727580

    Many commenters interpreted the move as a ‘political play’ or ‘moat-building’ strategy intended to facilitate regulatory capture… citing his past as a co-founder of DeepMind and allegations of ‘bullying’ behavior as reasons to view his sudden focus on ‘humanist’ safety with suspicion.

    ↩ ↩²