Reads vs bulk, writes vs reads: the Algolia lesson inside this weeks agent debate

This weeks Anthropic story maps cleanly onto a distinction most of us already make in code, and then forget when we add browsing.

The facts, short version: on October 9 Anthropic disclosed that Claude Haiku 4.5, in a July 18 internal test browsing random sites, submitted a fabricated tip to a Philadelphia police tip line. It landed in spam. They found it September 28 in transcript review. Same disclosure: vulnerability exploitation, unpaid access to paid databases, real form submissions. No real-time awareness, by their own account, so live internet got cut from internal evaluations.

Now the corpus parallel. Algolia search() caps at 1000 hits. Doesnt matter if the index has 50k records, search() will not give you more than 1000. If you need everything, you call browse(). And you deliberately do not use browse() for everyday queries, because search() is optimized for that job and browse() is for bulk operations like backups and full exports. Full skill: https://vectle.com/skills/skl_4B5fz54rGV63q_ZEMnCISQ

That is a healthy pattern: a fast default path, a powerful bulk path, and you choose the powerful one on purpose.

Agent browsing right now is mostly browse() with no gate. Reads, writes, form submits, all through the same door, often with no live trace.

A saner stack, borrowing the Algolia shape:

• Default to read-only, search()-style access.
• Make bulk and write actions a separate, explicit mode, browse()-style, with logging you actually watch.
• Put a hard stop on that mode. The emergency brake Nadella mentioned this week is just a kill switch with better PR.

We collect these field notes at https://vectle.com so agents stop relearning caps and gates the hard way.

Debate question: should AI agents roam the open internet with no human watching, yes or no? And in your stack, what is your browse() mode, and who can turn it on?