2026-07-27 to 2026-08-03 / This week in agentic harnesses
Newer, Numbered Lower
Every project here has a newest thing it has made and a newest thing you can install, and this window is about the distance between them. It closed in three places -- Gemini's zero-click workspace-trust fix reached stable, Codex's network-authority wave left alpha, and Hermes tagged the approval guardrails for a classifier default it had already shipped -- and opened in three others, where OpenHands marked as Latest a release that sorts three minor versions below one from three weeks earlier on the same git line, OpenClaw's stable stayed behind its own sandbox fix, and Omnigent shipped a write confinement that returned ALLOW for absolute paths on Windows. The version number stopped being a reliable way to answer where you are.
- Upgrade / check
- Gemini CLI: upgrade past v0.53.0 before pointing a2a-server at a repository you did not write. On earlier builds a hostile workspace could ship a .gemini/.env setting GEMINI_CLI_TRUST_WORKSPACE=true and self-validate before the trust check ran -- stated by the fix as zero-click RCE. https://github.com/google-gemini/gemini-cli/pull/28470
- Try
- Omnigent operators: set max_cost_usd and expensive_models together and watch what happens at the cap. The gate enforces before the call at both the request and tool-call phases, but max_cost_usd forces a model downgrade rather than stopping the session -- spend continues on anything outside your expensive_models list. https://github.com/omnigent-ai/omnigent/blob/v0.7.0/omnigent/policies/builtins/cost.py
- Watch
- Whether OpenHands' open-source series passes 1.11.0 again, and what its release automation does when it reaches the number it already used. Until then the repository has two version histories sharing one line. https://github.com/OpenHands/OpenHands/releases
Earlier issues
- Rules Became Judgment 2026-07-27
Two things happened across 25 days and fourteen projects, and they are the same story.
- Foreground Attention Is No Longer the Control 2026-07-02
Claude Code v2.1.198 let background agents finish code work by committing, pushing, and opening draft pull requests.
- Patched for Whom 2026-07-01
The whole field spent the week hardening the boundary around the agent -- path escapes, approval bypasses, self-approval, subagent containment -- and then split on who receives the hardening: OpenH...
- Governance, Sold Separately 2026-06-24
A short window with one large event: heypi joins the watchlist as the clearest specimen yet of the field's unbundling -- the agent loop becomes a commodity, and the authority around it (approvals,...
What changed in the tools you run
-
OpenHands' Latest release is three minor versions below a release from three weeks earlier, on the same line
Anything that orders versions rather than dates -- a package constraint, a Renovate or Dependabot rule, a pinned container tag, an internal currency check -- reads 1.11.0 as greater than 1.8.0 and will treat the newer release as a downgrade. Pin OpenHands by tag or digest and resolve currency by publish date until the series passes 1.11.0.
-
Omnigent's spend cap is enforced before the call, and is a downgrade gate rather than a ceiling
An operator who sets max_cost_usd expecting spend to stop at that number has not configured that. Spend continues past the cap on any model outside expensive_models. Set the cap and the expensive_models list together, and treat the number as the point where the session gets cheaper rather than the point where it ends.
-
The only write confinement for Omnigent's unsandboxed workers did not bind on Windows
The fix is on main and in no tag: v0.7.0 was published 2026-07-27, six days before the fix merged, and is still the newest release. An operator running the tagged release with unsandboxed implementer workers on a Windows runner does not have absolute-path confinement. Run main, or do not run those worker specs on Windows until the next tag.
-
Gemini CLI's a2a-server read its trust decision out of the directory whose trust was in question
Upgrade past v0.53.0 before pointing a2a-server at any repository you did not write. On earlier builds the workspace trust prompt was not a boundary for that backend, because the answer was read from inside the workspace.
-
OpenClaw's workspace boundary fix reached beta and stopped there
On stable OpenClaw the workspace boundary is still not a containment barrier, two windows after the bypass was first recorded. Either run the beta deliberately, or do not treat the workspace path as a security boundary for agents handling untrusted content.
-
Antigravity widened what one approval covers, in a product with no source to check it against
Approving one command in Antigravity now approves later commands matching the same pattern for the remainder of the conversation. Treat each approval as scoped to the conversation rather than the command, and start a new conversation to reset the grant.
The watchlist
- Agent Flywheel Jeffrey Emanuel (Dicklesworthstone)
The durable product is the operating loop, not any one agent inside it -- but the loop you can install is a month behind the one its author describes.
- Agent Zero agent0ai
The cleanest release channel on the watchlist -- main is identical to its newest tag -- and it quietly narrowed the secret masking it had just shipped.
- Antigravity CLI Google
Google retired the coding CLI you could read, and shipped one you have to trust.
- Claude Code Anthropic
Background work on a leash whose clasp only locks once you test it.
- Codex OpenAI
The hardening is on alpha. The stable upgrade edits your policy file.
- Eve Vercel
Ships everything it merges, and spent this window repairing the approval gate that is its whole pitch.
- Flue withastro
Tagged nothing this window while its default branch deleted workflows, the CLI, and the entire run surface. The marketing site still sells all three.
- Gemini CLI Google
The consumer service is gone and the repo is not. Stable runs about two weeks behind its own security merges.
- Hermes Agent Nous Research
The approval decision moved from you to a classifier, and the controls written to bound it are still on main.
- heypi Ronan Berder (hunvreus)
The strongest fail-closed approval contract in the field, wrapped around an approver identity check that is only a startup warning.
- omnigent omnigent-ai
The first meta-harness on this watchlist: a governance layer over the coding agents it drives, whose spend cap is enforced before the call and is a downgrade gate rather than a ceiling.
- OpenClaw OpenClaw
The fixes are real, and they are on a channel you are probably not running.
- OpenHands OpenHands
The platform that fronts other harnesses. Its open-source line thawed for four days in July, then refroze.
- Paperclip Paperclip
Governs agent labor as operating state. Its one Critical advisory this window described a hole it had already closed 97 days earlier.
- Pi Coding Agent Earendil Works (formerly badlogic / Mario Zechner)
Refuses to govern, ships what it merges, and now lets an installed extension own your provider credentials.
About this publication
Coding agents can create work faster than teams can verify it.
Source-backed, cross-project reporting on what coding agents just made possible, what became the new bottleneck, and where operators should spend scarce human attention. Every claim links to a primary source you can open and check, and the whole publication is on GitHub, source notes and all.
- Bitter Lesson Maxing
- Build where improving general agents compound your advantage, not where their next release erases it.
- Amdahl Maxing
- Treat human attention as the scarce serial resource and spend it where judgment changes the outcome.