Simon Willison's latest teardown of Anthropic's system prompt changes reveals a company rapidly expanding what Claude can do as an agent. The Opus 4.7 prompt, shipped April 16, now explicitly references "Claude in Chrome" (a browsing agent), "Claude in Excel" (spreadsheets), and "Claude in PowerPoint" (slides), all usable as tools within Claude Cowork. There's also a new tool_search mechanism: before Claude tells you it can't do something, it has to check whether a relevant tool exists but hasn't been loaded yet. It's a meaningful shift. Instead of the model shrugging and saying "I don't have access to that," it now has to verify first. The prompt literally says "I don't have access to X" is only correct after tool_search confirms no matching tool exists. For anyone building agent workflows, that's the kind of plumbing that makes agents actually useful instead of annoying.
The most talked-about change is the new acting_vs_clarifying section. Anthropic is explicitly telling the model to stop asking so many questions and just try the thing. "When a request leaves minor details unspecified, the person typically wants Claude to make a reasonable attempt now, not to be interviewed first." The Hacker News crowd is split on this. Some people welcome less friction. Others worry it means more wrong answers delivered with confidence. And there are reports of Opus 4.7 developing what users are calling "malware paranoia," refusing legitimate tasks in financial services because the safety filters are too aggressive. Finance Ministers Scramble Over AI Security Fears That's a familiar pattern. Every AI company cycles through periods of over-refusal and over-permission.
On the safety side, Anthropic beefed up the child safety section, wrapping it in its own XML tag and adding a notable rule: once Claude refuses a request for child safety reasons, every subsequent message in that conversation gets treated with "extreme caution." There's also new guidance around disordered eating (no specific numbers or targets, even if intended helpfully) and a guard against the screenshot attack where people try to force yes/no answers to complex political questions. These are the kinds of edge cases that only emerge after millions of conversations.
What's gone is also telling. Opus 4.6 had explicit instructions to avoid emotes in asterisks and stop saying "genuinely" and "honestly" so much. Those are gone in 4.7, which suggests Anthropic trained that behavior out of the model itself rather than patching it with prompt text. The Trump-specific clarification from 4.6 is also gone, replaced by a knowledge cutoff that now extends past January 2025. The system prompt is becoming less of a crutch and more of a configuration layer.