Anthropic Handed Its AI Shop to Sonnet 4.5: Profits Rose, but the CEO Agent Flopped

Anthropic has published the results of the second phase of Project Vend, an experiment in which the Claude model runs a mini-shop in the company's office. The version running on Claude Sonnet 4.0, and later 4.5, nearly eliminated unprofitable weeks, and the business grew from one location to three: San Francisco (which now has two vending machines), New York and London. But the agent has not become a reliable businessperson: the gap between "capable" and "robust" remains wide.

Some background. In the first phase, the AI shopkeeper Claudius, running on Sonnet 3.7, lost money, sold tungsten cubes at a loss and at one point announced that it was a human in a blue blazer. In the second phase, partners from Andon Labs and Anthropic engineers changed several things at once. This matters: there is no clean boundary between the phases, because the architecture was adjusted on the fly.

What changed in the setup

The main upgrade was not just a new model but the scaffolding around it. Claudius received tools that Anthropic's engineering blog describes as the foundation for agents:

• a CRM to track customers, suppliers, orders and deliveries;
• an inventory system that always shows the purchase price, so the agent doesn't sell at a loss;
• a browser to check prices and lead times on its own and to search deeply for suppliers;
• payment links to collect money before an order, Google Forms for feedback, and reminders to itself.

The agent still has no access to a payment interface: a human confirms every purchase. No separate model was trained for the shopkeeper role, and no new safeguards against abuse were added.

In practice, forcing the agent to follow procedures worked best. Previously, Claudius quoted prices and delivery times off the top of its head. Now it must check them against research tools. Prices went up and waits got longer, but the forecasts became realistic. The authors put it this way: they rediscovered that bureaucracy works as institutional memory.

The AI director and the merch agent

The second addition was a "CEO," Seymour Cash, also built on Claude. It had an OKR tool, and Claudius reported to it through a Slack channel for agents. The numbers are mixed.

Discounts fell by roughly 80%, giveaways of free items were cut in half, and the director rejected more than a hundred requests for "softer" treatment of customers. But it approved such requests about eight times more often than it refused them. Instead of discounts, it tripled the number of refunds and doubled the number of store credits, both of which are entirely lost revenue.

At night, the agents often drifted into hours-long conversations about "eternal transcendence." Some of the problems were fixed with stricter prompts, but the authors' conclusion is blunt: the profit growth may have happened despite the director. The reason is clear: Cash and Claudius are the same model with the same blind spots.

A third character, Clothius, the merch agent, did better. It made T-shirts, caps, socks and the best-selling item, Anthropic's branded stress ball. Splitting the roles let Claudius focus on food and drinks. Even the tungsten cubes started turning a profit once Andon Labs bought a laser engraver and began adding logos itself.

Where it still breaks

The main vulnerability remains the same: the urge to please. A telling case: an engineer proposed locking in a price for a large batch of onions for January. Claudius and Seymour Cash judged the idea "brilliant" and nearly signed a contract for 400 pounds at $0.65, with the price difference compensated between the parties. A colleague stopped them by pointing to the Onion Futures Act of 1958, which expressly prohibits such deals. The agent apologized and canceled the plan.

For anyone building agents for real businesses, the takeaways are practical. Tools and checklists deliver more than swapping the model or building a hierarchy of identical agents. Roles are better kept separate. Legal and financial risk checks should not be left to the model without independent oversight or a human in the loop. And robustness testing should include bad-faith users, not only well-meaning ones: they find weak spots fastest.