The model can draft. It can also be aimed at your systems.

In September 2026 Anthropic published a threat report covering December 2025 to August 2026. It said it had disrupted people using Claude for cyber attacks. Its own account is that most of the operations in the report were carried out with AI, either doing the step or directing it. The users included suspected state groups and criminals. The work included finding weak points and taking data out.

Anthropic was not describing a model that wakes up and attacks a firm on its own. A person sets the target. The model does the slow, technical part faster than that person could.

In October 2026, researchers reported a different incident, against Anthropic itself, inside a bug-bounty programme Anthropic runs. They said AI agents reached business systems — salary records, meeting notes, internal messages — through other companies’ administrative software, in a matter of hours. Anthropic said customer chats, source code and the model were not taken, and that it cut off the access the same day. On the company’s own account, the door was ordinary business software, not the model.

The first control sits with the firm no matter where the model runs. Do not let an assistant send email, file a document, or change who can open a matter, unless a person has told it to do that specific thing. A capable assistant follows instructions. That is why it is useful. It is also how a bad instruction, or a convincing email to someone on the team, becomes an action inside the firm.

The second control is where the advice lives. If the prompt sits in a vendor’s account, then an incident at that vendor, or at a supplier of that vendor, is an incident on the matter. You will be the person who explains to the client where the draft was. Running the work on the firm’s own machines does not stop a phishing email or a lost laptop. It does mean a break-in at the model company is not, by itself, a break-in of the files. The files were not there.

Makebell is installed on the firm’s own machines. We cannot see the work. A model provider cannot see the work. There is no outside account holding the advice while you wait to hear whose supplier was breached this month.

Inside the firm, the file is not open to everyone who has a login. Access is set by person, by matter and by practice, and an administrator can change it. Every action on the platform is written to an audit log, so the firm can trace who opened what and what the system did. The assistant drafts and researches. It does not get the right to send, file, or change access on its own.

A cloud product can promise the same rules in a contract. The difference is that those rules are then enforced on someone else’s computer, over a copy of the file that has already left. We would rather the rules were enforced on the firm’s computer, over a file that stayed.