The Autonomy Curve: What Project Fetch Means for Code You Did Not Write
Written by the Rafter Team
Anthropic's Frontier Red Team just made a robot dog do autonomously what it needed a human operator to do ten months earlier. The robot is the easy part of the story to remember and the wrong part to take away. The part that matters is the curve they used to explain the result, and the fact that they say they watched that same curve run to completion in security before they ever watched it in the physical world.
This post is about that curve, why it is the right lens for anyone shipping software with an AI agent in the loop, and what discipline actually scales when the human leaves that loop.
Anthropic names a three-stage progression for AI capability: first models help humans, then humans help models, then models do the work themselves. They say they saw it first in cybersecurity. If you ship code with an AI coding agent, you are already on this curve — the only open question is what verifies the agent's work before it merges.
What Project Fetch actually tested
Project Fetch is a deliberately simple experiment. Anthropic's red team took an off-the-shelf robotic quadruped — a four-legged "robodog" you can buy commercially — and gave teams a plain task: retrieve a beach ball and bring it back to a home base. The variable was how much Claude was involved, and the measurement was how the work split between human and model as the model got better.
The simplicity is the point. A retrieval task is easy to score, easy to repeat, and hard to fake. It strips away the ambiguity that makes most "look what the AI can do" demos unconvincing, and it lets you compare phases on the same yardstick.
The result inverted in under a year
In the first phase, in August 2025, the model was Claude Opus 4.1. It was useful but not autonomous. A non-expert human paired with Claude could operate the robot and make real progress, where that same person alone would have struggled — but the model could not complete the task by itself. The human was still doing the part that mattered, and Claude was the assistant.
In the second phase, this month, the model was Claude Opus 4.7, and the relationship flipped. Claude operated the robot autonomously across most of the tasks, with no human driving.
The speed numbers are the headline, and they are order-of-magnitude numbers, not percentages. On tasks that both an autonomous Claude and a human team completed, Anthropic reports Claude was roughly 20 times faster than the fastest human team. Across the four tasks every team finished, Anthropic reports Claude averaging about 9 minutes 35 seconds against human team times in the range of roughly 181 to 361 minutes.
It was not perfect, and the imperfection is instructive. Anthropic is explicit that the model struggled with fine motor control — the delicate, closed-loop nudging needed to push the ball the final few inches into home. Per their write-up, Claude could maneuver the robot behind the ball, but the efforts to push it home were "poorly controlled" and often unsuccessful. Competent at the plan, clumsy at the last inch.
The framing security people should underline
Here is the line from Anthropic's write-up that carries the whole argument, quoted because the exact wording matters: "First, models are helpful to humans. Then, humans are helpful to models. Finally, models are largely able to do things themselves. We have seen this in cybersecurity and now the same dynamics are starting to take shape at the intersection of AI and the physical world."
Read that as three stages. In stage one, the model assists a human; you are the operator and it is the helper. In stage two, the human assists the model; you are no longer driving, you are supervising, patching the gaps the model cannot yet cover on its own. In stage three, the model does the work and you are out of the loop entirely.
Project Fetch is a clean, measured instance of those three stages collapsing into the last one, on the same task, in under a year. And the most important sentence in the passage is the one people skim past: they say they watched this progression first in cybersecurity. The robot is the new place the curve showed up. Security is where they say it already finished.
You are already on this curve, in code
You do not need a robodog to recognize the progression. If you write software, you have lived it.
The AI coding agent began as autocomplete — stage one, a model assisting you a few tokens at a time. It became a pair you correct, where you supervise, redirect, and clean up after it — stage two, you assisting the model. And for a growing number of teams it is now something that picks up a ticket, writes the branch, runs the tests, and opens a pull request while you are asleep — stage three, the model doing the work.
The question that defined the first two stages was "can the agent do this." On a curve whose endpoint is autonomy, that question answers itself and then retires. The agent can. The question that replaces it is the only one that still scales: what is checking the work before it ships.
Why the "last inch" failure is the real lesson
Return to the fine-motor-control failure, because it is not a robotics footnote. It is the shape of autonomous-agent risk in general.
The autonomous model planned the entire task competently and fell down on the precise, final, high-consequence action — the last nudge that actually completes the job. That pattern transfers directly to code. An agent that writes a whole feature can be excellent at the architecture and wrong about the single import that pulls in a typosquatted package. An agent that refactors a service can be right about the structure and careless about the API key it pastes into a config file to make a flaky test pass.
The broad competence is real and the autonomy is real, and the failure concentrates in the precise, last-step actions — exactly the moments a human used to be holding the controls. When the human leaves the loop, nothing is holding those controls unless you built something to hold them. The capability scaling does not bring the safety controls along with it. You have to add those on purpose.
The discipline that survives the human leaving the loop
When you can no longer rely on a person catching the last-inch mistake, the control has to move. It moves from "a human reviews the work" to "a gate verifies the work," and that gate has to sit where the autonomous agent's output enters the system you care about.
For software, that location is the pull request. The pull request is the chokepoint every agent's work passes through before it becomes part of the codebase, and it is the last place you can inspect what the agent produced and what it touched before any of it ships. The things worth inspecting are precisely the things an autonomous agent reaches for without deliberation: the dependencies it adds, the secrets it might commit, and the configuration it rewrites.
Treat the agent's output as input to be verified
The old model assumed a human author who understood and intended every line. An autonomous agent breaks that assumption — it produces volume, at speed, with broad competence and concentrated blind spots. The safe posture is to treat the branch an agent opens the same way you would treat a contribution from a stranger: useful, probably fine, and not trusted until something has checked it.
Put the check at the merge boundary, not after
A verification gate only works if the agent cannot route around it. Code review the agent can talk you out of is not a gate; a CI check that must pass before merge is. The merge boundary is the one point in the workflow that every change crosses and none can skip, which is exactly why it is the right place to enforce the things that matter when no human is driving.
Scan what the agent brings in, not just what it writes
Most autonomous-agent risk is not novel vulnerable code the agent invented — it is untrusted material the agent pulled into your repo without weighing it: a dependency, a credential, a config change. The dependency graph, the secret detection, and the configuration are where the autonomous failures land, so they are what the gate has to read.
This is the boundary Rafter is built to hold. Rafter runs security scanning in CI through its GitHub Marketplace Action — static analysis, dependency scanning, and secret detection — at the pull request, so a risky dependency, a leaked credential, or a dangerous config change is caught before an agent's branch merges. It does not slow the agent down. It verifies the agent's output at the one gate the work cannot route around.
Back to the robot
A robot dog retrieving a beach ball is a party trick on its own. The reason Anthropic's red team wrote it up is that it is a measurable point on a curve they say they have watched before — models assisting humans, then humans assisting models, then models doing the work — and they are telling you, in plain language, that the curve does not stop at robotics. It already ran in security. It is running through your codebase right now, one autonomously opened pull request at a time.
Autonomy is not the thing to be nervous about. Unverified autonomy is.