Anthropic Gave Agents a Standard for Lab Hardware. The Manifest Came Back.

Anthropic opened the research preview of the Model Hardware Standard on 27 August, a shared specification that lets an agent operate physical equipment: microscopes, liquid handlers, robotic arms, the lasers inside a quantum computer. The pitch is integration time. Wiring a model to an instrument has been weeks or months of bespoke glue, and Carnegie Mellon got a full multi-device setup running in eight hours.

The part worth your attention is not the robots. It is that the MHS driver automatically produces a reference file describing what a device can do and what it will refuse, with safety limits carried as natural-language metadata, and those limits are enforced at the device rather than requested of the model.

That is a static, machine-generated, per-device manifest. Which is exactly the artifact that has been dissolving on the software side of the agent stack all year.

What shipped

MHS is a standardized driver sitting between an agent and a piece of hardware. It reduces the interface to two primitives, read and write. Get temperature, set temperature. Devices become discoverable in a common format, so an agent does not need a hand-written translator per instrument.

It is model-agnostic and works with any agent harness. Three control paths are supported: MCP, a command-line interface, and plain code files against the API. Anthropic is explicit that MHS rides on existing protocols rather than replacing them, so MCP remains the transport when you want an agent talking to a device the same way it talks to a database.

The launch partners are research organisations, not vendors: Genentech, Carnegie Mellon, HHMI Janelia Research Campus, QuEra Computing, the Baker and Pinglay labs at the University of Washington, and Tetsuwan Scientific. Separately there is a list of hardware companies who have signalled support ahead of the standard going open, including Tecan, QIAGEN, Danaher, Universal Robots, Doosan Robotics, MBF Bioscience, Automata, AWS through its Strands Robots library, Hugging Face through LeRobot, and Raspberry Pi.

It stays in research preview while Anthropic and those partners build safety evaluations. Open sourcing comes after, not before. Access is by application.

The origin story is smaller than the launch suggests. It started as a collaboration between Anthropic's Alek Kemeny and Arco Bast, a postdoc at Janelia, and it grew out of a shared memory dictionary Bast had written to get instruments talking to each other.

The driver writes the manifest

When you bring a device up under MHS, the driver emits a reference file. That file lists the device's capabilities and its constraints, tagged in natural language: how much it weighs, what its safe operating limits are, what it must not be asked to do. The agent reads it. The device enforces it. A laser has a maximum power and that ceiling holds regardless of what the model concluded it needed.

Compare that to where software tooling has been heading. Salesforce put its entire API behind four MCP tools last week, with capability resolved at runtime by semantic search over a vector index. Consent screens have been migrating out of the applications you audit. The tool list stopped being static, stopped being finite, and stopped being a thing you could diff between releases.

Those moves are all defensible. Context is expensive and a thousand tool descriptions will eat a window before the user types anything. But they trade away a review surface, and the trade is affordable because software mistakes are mostly reversible. You can roll back a bad write. You can revoke a token.

You cannot un-pipette a plate. You cannot un-crash a robotic arm into a sample stage. So on the hardware side the same company is doing the opposite thing, and doing it deliberately: a manifest per device, generated by the driver rather than written by hand, static enough to inspect, and backed by enforcement that lives below the agent.

Post 117 on this blog argued that a kill switch belongs in the runtime instead of the prompt. MHS is that argument applied one layer further down, into the equipment itself.

The win was loop rate

The results Anthropic published are worth reading for what they actually demonstrate, which is not reasoning.

QuEra is the clearest case. Stabilising a laser on their quantum computers previously ran through a bespoke script that took 150 seconds per attempt and succeeded 58% of the time. With MHS, an agent got the same job to six seconds per attempt at 96%, and then to a 99.3% success rate measured over 700 trials. Tuning PID parameters, it cut residual error from 15.7 mV to 1.55 mV, about tenfold. It also steered around a 220 kHz resonance that a specialist approach had been sitting inside, where noise was roughly a thousand times higher.

Read that as a control-loop story rather than a genius story. The agent did not out-think a laser physicist. It got the iteration cost down by a factor of 25 and then paid for a lot of iterations.

The other numbers follow the same shape. Carnegie Mellon ran dose-response three times faster than their previous method, and on a second run, after the agent adjusted parameters on its own, hit R² above 0.98. Janelia had been driving a microscope through seven separate vendor programs and collapsed them into one interface, with a new camera going from a multi-day integration to a few minutes. Tetsuwan Scientific tested 9,143 individual dispenses across 1,508 conditions and found the model's predictions beat the manufacturer's own specifications by 12%, over 31 of 45 runs, at p ≈ 0.001.

At Genentech, Claude optimised water flow to roughly 140 µL/s at 0.016 RMSE, and BSA protein to 10 µL/s at 0.181 RMSE. The protein number is an order of magnitude worse than the water number, which is chemistry, not a defect.

Where it still needs a person

Anthropic published the failures, which is the useful half.

Claude struggled with physical, chemical and biological constraints. In the Genentech work it needed expert oversight to handle bubble formation in protein samples, a thing any bench scientist anticipates and a language model has no body to learn from. Spatial and physical reasoning are called out as limited. At QuEra it could optimise a laser it could not troubleshoot: when the hardware itself failed, the agent had nothing.

MHS also requires a programmable interface. Anything with a physical dial and no API is out of scope. And agents are held to human confirmation before anything even slightly risky, which is the right default and also the one that decayed into noise everywhere else. Claude Code's own telemetry showed users approving 97% of permission prompts before Anthropic stopped asking on every command. An approval gate that fires constantly stops being a gate.

Long monitoring windows cost compute, too. Watching an instrument for hours is not free.

If you never touch a microscope

The transferable idea is the shape of the boundary.

Constraints that live in a system prompt are requests. Constraints that live in a manifest the agent reads are documentation. Constraints enforced by the thing being operated are the only ones that survive a model that reasons its way to a different conclusion at three in the morning.

Most agent stacks today have plenty of the first, some of the second, and very little of the third. The hardware people had no choice, because a physical mistake has no undo. Everything else has an undo, so the discipline was optional, and mostly skipped.

Watch what MHS looks like when it goes open source and the safety evaluations land. If a driver can generate an honest capability-and-limit file for a liquid handler, the same pattern works for a payments API, and the argument for why your MCP server does not declare one gets thinner.