On 27 August 2026, Anthropic previewed something with an unusually large claim attached to it: a way for AI agents to operate physical equipment. Microscopes. Liquid handlers. Robotic arms. Lasers. Plate readers. Quantum computing hardware.
The Model Hardware Standard is, in Anthropic’s own words, “a shared specification for AI agents to safely operate physical devices.” This article is the reference: what it is, how the pieces fit, where it came from, what has been documented, and — just as important — what has not.
One thing governs everything below. As of 31 August 2026, MHS is a gated research preview. The site states plainly: “MHS is starting as a limited research preview… Access is by application during the preview.” There is no public specification, schema, SDK, downloadable documentation or repository. Every architectural claim here, including every one made by anyone else writing about this, rests on a single vendor narrative that nobody outside the partner list can independently inspect.
That is a normal state for a research preview. It is also the single most important fact to hold on to while reading anything about it.
The One-Sentence Version
MCP standardised what an agent can read and call. MHS standardises what an agent can move.
That is the shift worth understanding. When an agent’s output is text, a mistake produces a wrong answer. When an agent’s output is torque, temperature or laser power, the failure mode becomes a broken instrument, a ruined sample, or an injured person.
Everything interesting about MHS follows from that change in consequence.
The Architecture, as Documented
Four pieces, in the order they matter.
1. The driver
The unit of the whole system is “a standardized driver: software that translates between a computer’s operating system and a hardware device.” One driver per device. This is a familiar idea — it is what a printer driver does — but standardising the shape of it is what makes an ecosystem possible.
2. Two primitives
The driver exposes commands “like ‘read’ (for example, ‘get temperature’) or ‘write’ (for example, ‘set temperature’)—that any hardware device can understand and act on.”
Read and write. That is the entire vocabulary, and its minimalism is deliberate: almost any instrument operation can be expressed as reading a value or setting one.
3. Discoverability
Drivers make devices “discoverable in a standard format, so that devices and agents can find each other and communicate across networks without needing a bespoke ‘translator’ program.”
This sentence sounds simple and is the hardest part of the system. More on it below.
4. Natural-language tags, and the reference file
This is the piece that makes MHS genuinely novel, and it is where the interesting questions live.
The driver “contains tags that let the user write this information directly in natural language” — a robot arm’s weight, a laser’s power ceiling, safe speeds — and users “can either do this themselves, or by chatting to an agent that interviews them about their hardware setup.”
From those tags, the driver “automatically produces a reference file with information about a device’s general characteristics, such as what it can measure, what can be adjusted, and what safety limits will be enforced. This file gives the agent everything it needs to know to operate the device.”
So the chain is: a human writes prose → the driver compiles it into a reference file → the agent reasons inside that description.
How agents reach it
Through three routes: “MCP, the command line interface, and code files (APIs),” which Anthropic says “work together to enable orchestration across multiple devices via a single line of code.” MHS is also described as “model-agnostic, and any agent harness can access it using standard protocols, such as the Model Context Protocol.”
MHS Is Not MCP
This confusion is everywhere, so it is worth being precise.
The Model Context Protocol is a way for an AI application to connect to tools and data sources. It is now governed by the Agentic AI Foundation under the Linux Foundation, following Anthropic’s donation of it in December 2025.
MCP is one of three access paths into MHS. It is not the mechanism by which MHS devices are described, and it is not how they discover each other. The relationship is layering, not equivalence: an agent might speak MCP to reach an MHS driver, which then speaks to the hardware.
The two also sit at very different maturity levels — one is a foundation-governed open standard with a published charter, the other is a gated preview. That difference is not a criticism; it is a fact about where each is in its life.
Where It Came From
The origin is unusually specific and worth knowing, because it explains the design.
Arco Bast, a postdoctoral researcher in the Spruston lab at HHMI’s Janelia Research Campus, had a problem familiar to anyone who has worked on a complex rig: his instruments could not talk to each other. Anthropic’s description of the situation is blunt — components come with vendor control software and no common interface, and “they often run in different programming languages, too: the detectors run in MATLAB, the cameras in Python, the electrophysiology in C#.”
The consequence, in one sentence: “A quantity held by one program, such as the position of the stage, is therefore unknown to the others.”
Bast’s fix was to change the topology rather than write better translators: instead of connecting every program to every other program, have all of them share a pool of memory each can read and write directly. Every device’s state lands in one shared dictionary. He reports the integration effort for his own work dropping from months to days — an N=1 self-report about one researcher’s own project, not a benchmark.
That prototype, developed with Anthropic’s Alek Kemeny on the Beneficial Deployments team, became the basis of MHS.
Separately, in Anthropic’s announcement, Virginie Ruetten — a scientist in the Ahrens lab at Janelia, whose rig uses a customized mesoscope — describes the resulting architecture as replacing “those point-to-point connections with a single interface,” where each device is “described and onboarded once, and its variables, controls, and sensor values are recorded in a single dictionary that lives in shared memory.”
(Two different researchers, two different roles. Bast is the origin; Ruetten is a case study in the announcement. Their integration figures have different scopes and are frequently merged by mistake.)
The Question at the Centre of This
Here is the thing to sit with.
The safety boundary is prose. A person types a laser’s power ceiling into a tag — or an agent interviews them and types it for them — and that description becomes what the agent reasons within.
That is a genuinely useful artifact. Knowledge that used to live in paper manuals, vendor software and a senior postdoc’s head becomes machine-readable. But it invites a question with a very clean test:
If the tag were blank, or wrong, would anyone be hurt?
If the answer is yes, the tag was never the safety system, and something else has to be — something that works whether or not the description exists. If the answer is no — a wrong tag costs you a bleached sample, a wasted week — then the tag is doing exactly the job it should.
What Anthropic does and does not claim
This deserves precision, because it is widely misreported in both directions.
Anthropic’s own prose says the reference file carries information about “what safety limits will be enforced.” That describes what the file documents.
The strongest enforcement-sounding sentence in circulation is a researcher’s quotation — Ruetten’s: “MHS enforces device-level safety limits, I don’t need to worry about the agent accidentally using excess laser power, for example, which risks bleaching the fluorescent molecules.” That is a description of relief, not a specification of mechanism.
Anthropic makes no claim, in either direction, about certification or safety-rating. The category is simply not addressed. So the honest statement is that the public material does not say whether a declared limit is enforced by code running regardless of what the model outputs, or is a constraint the model is told about and expected to respect. Those are different guarantees, and summaries frequently describe MHS as providing the stronger one — which is an inference, not something anyone has stated.
Worth noting too: the flagship safety example — preventing excess laser power that would photobleach a sample — protects scientific integrity, not personnel. That is a real win. Presenting it as evidence about human safety is a category error.
What the Evidence Currently Shows
The announcement contains roughly a dozen numbers. Every one is a vendor claim, reported by Anthropic or relayed from a named partner. None has been independently replicated.
They are not all the same quality, and ranking them is fairer than lumping them together:
| Claim | Strength |
|---|---|
| Tetsuwan Scientific — dispense precision ~12% better than the manufacturer’s spec, 31 of 45 runs, sign test p ≈ 0.001, from 9,143 dispenses | The only reported significance test in the announcement |
| QuEra — laser lock recovered in 695 of 700 blind trials (99.3%), against a prior script at 58% | Largest trial count, explicit prior baseline |
| QuEra — PID tuning to 1.55 mV vs an expert’s 15.7 mV, over 363 experiments | Explicit expert comparison, 19-hour holdout |
| CMU — six induced faults, “correctly blocked all six before any device moved” | Real protocol, but n=6 and self-administered |
| CMU — dilution curve in 8 hours vs “multiple weeks” for a vendor engagement | The comparison condition was never run in parallel |
| “Weeks or months → hours or minutes” | A stated goal, not a measurement |
The announcement is also honest about a failure in the other direction: at Janelia, “Claude often stopped to wait for human confirmation before performing an action it deemed even slightly risky, meaning experiments would sometimes pause overnight while Claude waited for approval.” Over-caution and under-caution from the same probabilistic mechanism is the signature of an advisory layer.
Discovery: One of Five Problems Answered
“Devices and agents can find each other” is the easiest-sounding sentence in the announcement and the hardest problem in it.
Every device-discovery system that has ever shipped had to answer five separable questions: identity (what uniquely names this device), capability description (what it can do, machine-readably), addressing (how to reach it), versioning (how interface changes are communicated), and trust (why the thing that answered should be believed).
Measured against those, MHS’s public material answers one in operational detail: capability description, through the reference file. No discovery protocol, namespace model, addressing scheme, versioning scheme or trust model has been published.
That is not damning — it is a map of what remains to be specified. It took OPC UA a standards body and years to answer all five, and it is the only widely-used system that treats trust as part of discovery rather than a bolt-on. Four of six comparable systems shipped without a trust model entirely.
Governance: What “Standard” Currently Means
MHS has no published specification, license, steering body, working-group structure, contribution process or version-numbering scheme. Access is an application form. The only forward-looking statement is that partners are helping develop it “before we open-source it” — no date, license or hosting body named.
The fair comparison is Anthropic’s own track record. MCP launched in November 2024 as a wholly Anthropic project and was donated to the Linux Foundation’s Agentic AI Foundation on 9 December 2025 — thirteen months. That transition required three competing companies (Anthropic, Block and OpenAI) to co-found the foundation, and produced a real charter: Apache 2.0 for spec and code, a tiered maintainer structure, Specification Enhancement Proposals, and membership tied to individuals rather than employers, with “no seats reserved for specific companies.”
So the useful framing is neither cynical nor credulous. A one-day-old preview is not late to lack a charter — MCP did not have one either. But the word “standard” is currently describing an intention rather than a structure, and MCP’s own history shows that closing that gap is neither automatic nor quick.
The Map: Every Article in This Series
This hub is the reference. Each piece below goes deep on one question, and none of them requires the others.
On safety and security
- Advisory Limits Are Not Safety Systems — where a prose description sits relative to ISO 10218, IEC 61508, interlocks and safety-rated control, and why tags describe a device while hazards live in an application.
- Two Fields, One Conclusion — machinery safety and OWASP’s LLM06 arriving independently at the same rule: enforce where the model cannot reach.
- A Driver Is Software That Moves Things — supply-chain provenance for code whose output is motion, and why a signature proves who, never what.
On finding and evaluating
- Six Ways Machines Found Each Other Before AI Needed To — ROS 2, OPC UA, SiLA 2, mDNS, USB and SCPI, scored against the five sub-problems of discovery.
- SCPI and VISA — the 1990s protocol still running every test bench, and the forty-year-old gap MHS is aiming at.
- How to Read a Tech Announcement You Cannot Try Yet — four provenance checks, demonstrated on this launch’s own coverage.
On building something today
- Five Ways Engineers Already Connect AI to Instruments — what you can actually build now with MCP, SiLA 2, OPC UA, ROS 2 and SCPI/VISA.
- LeRobot — the open-source robot-learning library Anthropic name-checked, on its own terms.
On people and institutions
- MCP Took 13 Months to Stop Being Anthropic’s — the governance precedent, with dates.
- How MHS Actually Started — Arco Bast, the shared-memory dictionary, and why the origin explains the design.
On measurement
- Nobody Has Independently Tested Any of This Yet — every quantitative claim, sorted into three evidentiary tiers.
- If an Agent Ran the Experiment Overnight, What Is the Record? — autonomy, reproducibility, and what a sufficient log contains.
And for reading further
- What to Read When the Standard Is One Day Old — six durable fields, free resource first on every rung.
What to Watch
Concrete, checkable milestones, in the order MCP hit them:
- A published specification — the thing that turns every claim here from narrative into something inspectable.
- A license.
- A named host — a foundation or an existing standards body.
- A contribution process an outsider can use.
- An independent evaluation — a fixed task, run by someone who did not build the integration.
- A partner speaking in its own voice — one company blog post would be more informative than another ten names on a list.
The Honest Summary
MHS takes physical knowledge that lived in manuals and people’s heads and makes it machine-readable, so an agent can reason about equipment it has never seen. For reducing integration friction — the n² translators problem that started all this — that is a real and useful advance, and the early reported results are encouraging.
For hazards that can injure someone, the safety stack that existed before 27 August 2026 is the safety stack that exists now. Anthropic does not claim otherwise.
And for everyone outside the preview, the correct status of every claim in this article is: plausible, internally documented, and not yet checkable by anyone else. That will change when the specification is published. Until it does, the most useful thing you can do is learn the fields this sits on top of — because those will still be true afterwards.
Frequently Asked Questions
What is the Model Hardware Standard?
A specification, previewed by Anthropic on 27 August 2026, described in its own words as “a shared specification for AI agents to safely operate physical devices.” Its unit is a standardised driver exposing read and write primitives, making devices discoverable on a network, and carrying natural-language tags that compile into a reference file an agent reasons within. Agents reach it through MCP, a CLI, or code/APIs.
Can I use or build on MHS today?
No. As of 31 August 2026 it is a limited research preview with access by application, and there is no public specification, schema, SDK, documentation or repository. Anthropic has stated it intends to open-source the standard after the preview and safety work progress, but no date, license or hosting body has been named.
Is MHS the same as MCP?
No. The Model Context Protocol is one of three access paths into MHS, alongside a command line interface and code/APIs. MCP is not how MHS devices are described or how they discover each other. They also differ in maturity: MCP is governed by the Linux Foundation’s Agentic AI Foundation following Anthropic’s donation in December 2025, while MHS is a gated preview.
Does MHS make it safe for an AI to operate lab equipment?
The public material does not support that claim, and Anthropic does not make it. MHS supplies an agent with a natural-language description of a device’s limits, which plausibly reduces how often it commands something harmful. Anthropic makes no statement in either direction about certification or safety-rating, and the strongest enforcement-sounding sentence in circulation is a researcher’s characterisation rather than a specification. The useful test: if the tag were blank or wrong, would anyone be hurt?
Has anyone verified the performance claims?
No. Every quantitative claim comes from Anthropic or a named partner, and none has been replicated independently. They vary in quality — Tetsuwan Scientific’s dispense-precision result carries the announcement’s only reported significance test (p ≈ 0.001 over 45 held-out runs), and QuEra’s 700-trial blind laser-lock test has the largest trial count with an explicit prior baseline, while several other claims are single-case anecdotes without a matched control.
Who created MHS?
It originated with Arco Bast, a postdoctoral researcher in the Spruston lab at HHMI’s Janelia Research Campus, whose shared-memory approach let instruments running in different programming languages coordinate through a single dictionary. He developed it into a standard with Alek Kemeny of Anthropic’s Beneficial Deployments team.
📦 Recommended Resources
There is no book about the Model Hardware Standard and there will not be one for years — publishers need a stable, public specification to write against, and there isn’t one. The useful reading is in the durable fields this sits on top of, and much of the best material is free: the OSHA Technical Manual chapter on industrial robot safety, the OWASP Top 10 for LLM Applications, and Richard Cook’s four-page How Complex Systems Fail cost nothing and will each change how you read an announcement like this one.
- Functional Safety: A Straightforward Guide to Applying IEC 61508 and Related Standards by David J. Smith and Kenneth G. L. Simpson — the book that answers this article’s central question properly. It supplies the vocabulary — safety function, Safety Integrity Level, proof-test interval — that makes the difference between a descriptive limit and a certified safety function obvious rather than subtle. If you read one book because of this article, read this one. (2nd edition, 2004; a later retitled edition exists but the ISBN above is the verified one.)
- Engineering a Safer World: Systems Thinking Applied to Safety by Nancy G. Leveson — safety as an emergent property enforced through constraints on system behaviour, rather than a matter of component failure rates. Directly relevant to a system that now closes the loop between a probabilistic reasoner and physical actuation. Pair it with Perrow’s Normal Accidents and read the disagreement between them as unresolved, because it is.
- Reproducibility and Replicability in Science — the National Academies consensus study, free to read online from the publisher. The right framework for the question an autonomous, self-adjusting experiment raises: if an agent adjusted parameters hundreds of times overnight, what exactly is the record, and what does the result establish? Buy the paperback only if you want it on a shelf.
✅ Pro tip: Before reading anything else, spend ten minutes on Anthropic’s own announcement rather than coverage of it. Notice who is speaking in each sentence — Anthropic’s prose, or a named researcher’s quotation. That single habit resolves most of the confusion circulating about what this system does and does not guarantee.