Auto Stops Asking

On 27 May Claude Code shipped 2.1.152, and one line in it removed a click. Auto mode, the classifier that runs the actions it judges safe and stops on the ones it judges risky, no longer asks for opt-in consent. It is the default posture.

The click was never much of a control. It was a visible one. Some admins treated that dialog as the moment an operator confirmed, knowingly, that the agent could act first and report after. That moment is gone, and the changelog does not say what Auto mode now classifies as safe. The only complete list is the runtime’s behaviour.

Claude Code was not alone. Codex made goal mode the default, and Gemini CLI collapsed its Auto variants and began auto-approving shell redirects. Autonomy became the thing you opt out of. In the same fortnight three projects moved the decision the click used to carry into a file.

What each default actually turned on

The three flips are not the same flip, and the differences are where the operator decisions hide.

Claude Code’s is the broad case: a runtime classifier draws the line between safe and risky, and nobody wrote the line down. The same release handed authors two levers pointing opposite ways. A skill’s disallowed-tools field subtracts from what the agent can do. A new MessageDisplay hook can rewrite or hide assistant text before the operator reads it. One narrows the agent. The other narrows the human.

Codex’s is the long-horizon case. The 26.519 launch on 21 May took goal mode out of experimental across app, IDE and CLI, and CLI 0.133.0 turned goals on by default, with their own storage and progress tracking. You can hand Codex an objective measured in “hours or even days” and walk away. Not everyone took that as news. On the window’s first day Evan Boyle wrote Copilot CLI shipped `autopilot` mode in January.@_Evan_Boyle Operators were already running loops like it; one on GPT-5.5 in OMP’s /goal said it feels like the first agent i actually trust to leave alone 24/7@usr_bin_roygbiv.

The same launch let Codex drive a Mac after the screen locks, behind short-lived authorization, covered displays and a relock on any local input. Those are sensible safeguards. They are policy, not a wall, and policy is only as good as the operator’s idea of what they granted. One Codex user put the gap in a sentence: I gave it access for Computer Use, not Chronicle, the feature that caused it to record my screen on a regular basis@bengold. That is the user’s account; our receipts cover the remote computer use surface, not Chronicle.

Gemini CLI’s was the quietest. Stable v0.44.0 folded a fan of Auto variants into one mode, billed as simplification, and whatever distinctions the variants carried went with them. It also began auto-approving shell redirects (>, >>, |) in AUTO_EDIT. That is a convenience right up until an agent is steered toward a path it should not write.

The benefit and the bill arrive together. Amdahl Maxing means spending scarce human attention where it has the highest marginal value, and a consent dialog clicked by reflex is not that place. Removing it can be right. But an operator who used the dialog as a last look before something irreversible now has to rebuild that look somewhere else: managed settings, a hook, or review out of band.

Boris Cherny, in his own words this time, said his team runs Auto mode and containers together, because for containers to be useful, you often have to punch some holes: GitHub, Anthropic API, kube, other MCPs.@bcherny He says Auto makes those holes safer to use; the changelog publishes nothing that would let us check how. The sandbox was never the wall either.

Not everyone found the new default lighter. An infrastructure engineer who had been running bypassPermissions tried Auto and went back: 元々、bypassPermissionsでしたがそれよりも確認や判断、決断や操作がめちゃくちゃ増えたので戻しました。@takara_infra In our rendering, it brought far more confirmations and judgment calls than before. For an operator already at full trust, Auto was the cautious setting.

The speed is free. The checkpoint is not.

The decision moved into a file

Once an agent runs by default, the question is no longer whether it may act but within what bounds, and bounds do not belong in a flag that lives for one session. Three projects said so in the same fortnight.

Codex went furthest. CLI 0.133.0 let a permission profile inherit from a base and layer changes on top, and paired it with a managed requirements.toml the release calls enforcement, not advice. CLI 0.134.0 made --profile the single selector across the CLI, its terminal UI and the sandbox, and started rejecting the old flag configs outright.

Gemini CLI cut narrower and deeper. It pushed its PolicyEngine into ACP sessions. The changelog files that as a deadlock fix, which undersells it: enforcement now reaches the protocol layer the docs hold up as the way to delegate work.

OpenHands showed the same move with the schema visible. Its org-level LLM profiles are an encrypted column on the organization table, six endpoints under /api/organizations/{org_id}/profiles, and a two-role split: one role reads settings, another creates, edits and activates them. Activation flips the org’s live profile and the acting member’s settings in one locked transaction. The database is admitting that “which policy is in force” is contested, shared state worth serializing.

For anyone running a team the advice is the same across all three. Write a base, derive the per-team variations, and check the file in. What none of the three has documented is how that file reaches a machine and whether it is signed, or who else gets to write one. One post relayed that Berkeley course staff put hooks in their course repos so that if a student opens an assignment in Claude Code or Cursor the agent will automatically ping the staff@owenology. A hook checked into a repo is policy written by the repo’s owner, and it runs in your agent. Close that gap before you call it enforcement.

The gate went where the input crosses

The fortnight’s sharpest thread ran through three projects working on unrelated parts of the stack. Each put a structural gate at the spot where untrusted input enters, rather than asking the model to behave once the input is already inside.

OpenClaw put its gate where messages arrive. Sender allowlists now run before the agent is dispatched, not after. Browser snapshots check SSRF policy before reading a tab’s URL. Queued system text is scrubbed so a hostile plugin or channel label cannot forge the markers the model reads as instructions. An unauthorized sender gets no chance to shape the agent at all.

Agent Zero put its gate where actions land. The new computer_use_remote tool drives the operator’s real desktop, outside the container, through the platform’s accessibility APIs, and it refuses to trust its own work. A state-changing action stays unverified until a fresh screenshot confirms it, and with no screenshot the agent must stop. A denied approval on macOS has to be re-armed by hand.

OpenHands put its gate between tenants, because credentials had been crossing. Until the fix, an MCP or acp_env setting added by one member of an organization was written to every member’s row. Agent settings now split into a shared half and a private one, secrets follow only the member who set them, and leaked values are stripped on read.

A prompt asks the model to keep bad input out. A gate at the boundary does not ask.

What got within reach

The fortnight did not only add fences. OpenHands, with ENABLE_ACP set, now fronts Claude Code, Codex or Gemini CLI as the agent behind its own UI, greying out its own model and MCP settings because the wrapped agent owns them. Paperclip’s ACPX-Claude adapter goes one step further in deference: it respects the operator’s own ~/.claude/settings.json permissions, the window’s one case of a wrapper obeying the wrapped tool’s rules.

Hermes v0.14.0 became something you can pip install, with a native Windows beta and a cold start about 19 seconds shorter. Its new hermes proxy exposes a local OpenAI-compatible endpoint backed by whichever OAuth provider you are signed into, so Codex CLI, Aider, Cline or Continue can run on one subscription. The PR binds it to 127.0.0.1 by default and says the proxy does not authenticate local callers. Anything on the machine that can open a loopback socket can spend your subscription.

Two arguments worth having

A claim framed the window, and it came second-hand. A widely shared post relayed Boris Cherny saying Claude Code and Cowork are each written entirely by Claude Code:

Boris Cherny: "Claude Code is 100% written by Claude Code, Cowork is 100% written by Claude Code" across all of Anthropic, 90% of code is written by Claude lawyers, designers, finance people are building real things with Claude Code right now with no CS degree, no background, nothing the people who built the tool use the tool to build the tool think about what that means for everyone else the guide on everything Claude can actually do is in the article below

We hold no primary source and attribute nothing on this basis. It is what people believed in the month Auto mode stopped asking, and belief is what makes a default stick.

A user complained to Hermes’ maintainers: 90+ skills enabled by default. Agents still load all of them even if they are disabled@robdubparker. The maintainer answered in public, with arithmetic: All 90 skills use about 1.5-2k tokens@Teknium. A context-cost complaint answered with a token count is the right shape of argument, and almost nobody uses it.

The second argument cuts against this publication. We keep saying the harness is a variable an operator controls. On 27 May Ofir Press reported that mini-swe-agent, his roughly 150-line agent, it performs as well as Claude Code, Codex and Gemini CLI on this new coding benchmark@OfirPress. Kilian Lieret, posting the same result the same day, put it more strongly, as outperforming, and drew the lesson: The simpler the system, the better it generalizes@KLieret. The reply that cut back came within hours: at 150 lines, the benchmark is doing a lot of the work. most production complexity lives in the long tail, not the canonical task shape@MLCatttt.

It is one benchmark, theirs, and we did not run it. The objection is fair. It is still the sharpest evidence available that the elaborate harness may be worth less than its sellers believe. If the model is doing the work, the scaffolding is exactly what Bitter Lesson Maxing says not to build your advantage on.

Google named a successor on 19 May

One more thing started in this window. On 19 May the Gemini CLI account posted We are unifying our efforts around a single harness and platform@geminicli, naming Antigravity as the destination. Google’s developer-experience lead welcomed it the same day: Very excited to unify the experience for developers building with Gemini under Antigravity@OfficialLoganK.

The objection arrived within hours, and it named the specific loss rather than the general one:

So google is replacing gemini-cli with agy (antigravity cli), but: 1. agy is not opensource 2. It no longer supports ACP Really unfortunate development

Both points check out. The replacement is closed source, and it does not speak ACP, the protocol Gemini CLI had just pushed its policy engine into.

Breaking changes and security notes

Claude Code 2.1.147 to 2.1.149. In 2.1.149, PowerShell’s built-in cd.., cd\, cd~ and X: no longer move the working directory past the workspace boundary undetected, and the git-worktree sandbox write allowlist no longer covers the whole main repository root instead of the shared .git. 2.1.147 makes forceLoginOrgUUID and forceLoginMethod enforce against third-party-provider and API-key sessions, and 2.1.148 closes a Vertex AI provider bypass. The changelog is the only place any of this appears.

Hermes v0.14.0 removes the [all] extras. Heavy adapters install lazily on first use, so a backend can be missing until something calls it.

OpenClaw turns on a gateway auth rate-limiter for any config that never set gateway.auth.rateLimit. Monitoring built on the old auth-failure behaviour needs adjusting.

Provider notes

Codex (26.519; CLI 0.131 to 0.134) ran the window’s most coordinated release train. Goal mode’s graduation and the CLI default landed the same day as profile inheritance and the managed requirements file. Capability and its governance shipped as one move, which nobody else managed this fortnight.

OpenClaw (v2026.5.18 to v2026.5.26) put its weight where its risk is: content-boundary hardening and reaction-based approvals across Signal, iMessage and WhatsApp. Its releases now carry verification stanzas with full CI run URLs, a vendor showing its receipts.

Paperclip (v2026.513, v2026.517, v2026.525) built scoped agent permissions on a real authorization service rather than a convention.

Pi (v0.74.1 to v0.76.0) and Hermes Agent both went after the supply chain: npm shrinkwrap and lifecycle-script controls in Pi, an advisory checker in Hermes.

OpenHands tagged nothing in the window. Everything above is on main.

Gemini CLI (v0.44.0) made its local and remote session-invocation protocols stable.

Agent Zero (v1.15 to v1.18) also lets an operator hide skills from the model-facing catalog.

Flue (v0.6.0 to v0.8.0) split persistent agents/ from finite workflows/, and runs are now a workflow-only concept.

The click was the decision

Three makers moved the permission ceremony from something you opt into to something you opt out of. The decision it carried did not disappear. It moved into a policy file.

That is an improvement: a file is versioned, reviewable, and outlasts anyone’s attention span. It is also a new way to be wrong quietly. A click is a decision a person made. A file is a promise a runtime has to keep.

Test the file. It is the only part of this that can fail without telling you.