Auto Stops Asking

Until late May, turning an AI coding agent loose still took a deliberate click. You switched on the mode that let it run commands without stopping to ask, and you knew you had done it. Then Claude Code shipped version 2.1.152, and the click disappeared: Auto mode, the setting that lets the agent act first and report after, became the default for everyone.

Three makers flipped the same switch inside two weeks. Claude Code made Auto mode default-on; Codex graduated its long-horizon "goal mode" out of beta and turned it on across app, IDE, and command line; Gemini CLI folded a menu of Auto variants into one and began auto-approving shell redirects. The permission ceremony that used to stand between an operator and an autonomous agent is no longer the thing you opt into. It is the thing you opt out of, and the only decision left is how to fence it in.

Fencing it in was the fortnight's other half. Once an agent runs by default, signing off on its actions one prompt at a time stops scaling, and three providers reached for the same replacement: a versioned, org-managed policy file the runtime reads before it acts. Codex shipped profile inheritance and a managed requirements.toml; Gemini pushed its policy engine down into the session protocol; OpenHands moved permissions onto org-level profiles. The unit of control is migrating from the session flag you set and forget to the file you check in and review.

What "default-on" actually means

The three flips are not the same flip, and the differences are where the operator decisions hide. Claude Code's Auto mode is the broad case: a classifier runs the actions it judges safe and stops on the ones it judges risky, with the line between them defined at runtime rather than written down. The same release hands authors two new levers that point in opposite directions, a disallowed-tools field that lets a skill subtract from the agent's tool surface, and a MessageDisplay hook that can rewrite or hide assistant text before the operator sees it. One narrows what the agent can do; the other narrows what the human is shown.

Codex's goal mode is the long-horizon case. The 26.519 launch took it out of experimental across the app, IDE, and CLI, and CLI 0.133.0 turned goals on by default with their own storage and progress tracking, so an operator can hand Codex an objective measured in "hours or even days" and walk away. The same launch let Codex drive a Mac after the screen locks, hedged with short-lived authorization, covered displays, and an automatic relock on any local input. The locked-host capability is real; the safeguards are policy choices layered on top, not a wall.

Gemini CLI's change was the quietest and, in its way, the most telling. Its stable v0.44.0 collapsed a fan of Auto variants into a single mode, billed as simplification, erasing whatever distinctions those variants used to carry. It also began auto-approving shell redirects in AUTO_EDIT, a convenience that doubles as a wider attack surface the moment an agent is steered toward a path it should not write.

The benefit and the bill arrive together. An operator who never bothered to enable Auto mode now gets its speed for free; an operator who treated the consent dialog as a last manual look before something irreversible has to rebuild that checkpoint somewhere else, in managed settings, a hook, or out-of-band review. Every default-on change this fortnight made the tools easier to use and a standing authority check harder to see, in the same motion.

The month Google announced the retirement

The other thing that started in this window ran for six weeks and finished somewhere else. On May 19 the Gemini CLI account posted that We are unifying our efforts around a single harness and platform@geminicli, naming Antigravity as the destination. Google's developer-experience lead welcomed it the same day: Very excited to unify the experience for developers building with Gemini under Antigravity@OfficialLoganK.

The objection arrived within hours, and it named the specific loss rather than the general one:

So google is replacing gemini-cli with agy (antigravity cli), but: 1. agy is not opensource 2. It no longer supports ACP Really unfortunate development

Both of his points are correct. What that announcement set in motion executed on June 18, when consumer Gemini CLI stopped serving requests, and the tier that got migrated received governance it could no longer read. Our issue for that window carries the day itself. This is where it was decided.

The policy file becomes the unit of control

Once an agent runs by default, the interesting question is no longer whether it may act but within what bounds, and bounds do not belong in a flag that lives for one session. Three providers said so in the same fortnight, each moving policy into a file that outlives the session and that the runtime treats as authoritative.

Codex went furthest. CLI 0.133.0 added profile inheritance, so a permission profile can derive from a base and layer changes on top instead of redeclaring every grant, and paired it with a managed requirements.toml the release calls enforcement, not advice. CLI 0.134.0 then made --profile the single selector across the CLI, its terminal UI, and the sandbox, and began rejecting the old flag-soup configs outright. Gemini took a narrower but deeper cut, pushing its PolicyEngine into ACP sessions; the changelog files it as a deadlock fix, which undersells it, because enforcement now reaches into the very protocol layer the docs hold up as the delegation primitive.

OpenHands showed what this looks like with the schema visible. Its org-level LLM profiles land as an encrypted column on the organization table, six endpoints under /api/organizations/{org_id}/profiles, and a two-tier permission split: one role reads settings, another creates, edits, and, the load-bearing verb, activates them. Activation flips the org's live profile and the acting member's settings in a single locked transaction, the database admitting that "which policy is in force" is now contested, shared state worth serializing.

For anyone running a team the takeaway is the same in all three: stop keeping policy in per-session flags. Write a base, derive the per-team variations, and treat the checked-in file as the source of truth. The one thing none of the three has documented is how that file is distributed and whether it is signed, which is the gap to close before leaning on it for real enforcement.

Two arguments worth keeping

Before them, the claim that framed the window. A widely shared clip had Boris Cherny saying Claude Code and Cowork are each entirely written by Claude Code, and that most of Anthropic's code is now agent-written:

Boris Cherny: "Claude Code is 100% written by Claude Code, Cowork is 100% written by Claude Code" across all of Anthropic, 90% of code is written by Claude lawyers, designers, finance people are building real things with Claude Code right now with no CS degree, no background, nothing the people who built the tool use the tool to build the tool think about what that means for everyone else the guide on everything Claude can actually do is in the article below

We hold no primary source for that and attribute nothing to anyone on this basis. It is not a finding. It is what people believed was true in the month Auto mode stopped asking, and belief is what makes a default stick.

A user told Hermes' maintainers that the harness had a 90+ skills enabled by default. Agents still load all of them even if they are disabled@robdubparker. The maintainer answered in public, with arithmetic: All 90 skills use about 1.5-2k tokens@Teknium. We have not measured either claim. The exchange is here because a context-cost complaint answered by a token count is the correct shape of the argument, and it is the shape almost nobody uses.

The second cuts against this publication. We keep arguing that the harness is a variable an operator controls -- that the wrapper around the model decides cost, latency and whether a rule binds. On May 27 a researcher reported that his roughly 150-line agent, mini-swe-agent, it performs as well as Claude Code, Codex and Gemini CLI on this new coding benchmark@OfirPress. That is one benchmark, his benchmark, and we did not run it. It is still the sharpest available evidence that the elaborate harness may be worth less than the people selling elaborate harnesses believe. A thesis that only ever meets agreeable evidence is not being tested, so it goes in.

One idea, three doors

The fortnight's quietest thread was also its sharpest. Three providers, working on parts of the stack that have nothing to do with one another, landed on the same instinct: put a structural gate at the exact spot where untrusted input crosses into the agent, rather than trying to talk the agent out of misbehaving once the input is already inside.

OpenClaw put its gate at the front door, where messages arrive. Sender allowlists now run before the agent is dispatched rather than blocking it afterward; browser snapshots check SSRF policy before they read a tab's URL; queued system text is scrubbed so a hostile plugin or channel label cannot forge the markers the model reads as instructions. The through-line is to deny an unauthorized sender any chance to shape the agent's behavior at all, instead of catching specific actions once it has already been nudged.

Agent Zero put its gate at the host, where actions land. Its new computer_use_remote tool drives the operator's real desktop, outside the container, through the platform's own accessibility APIs, and it refuses to trust its own work: every state-changing action stays unverified until a fresh screenshot confirms it, and the agent must stop when no screenshot is available. A denied approval on macOS routes to a flow that has to be re-armed by hand, not a silent retry.

OpenHands put its gate between tenants, where credentials had been leaking. Until the fix, an MCP or acp_env setting added by one member of an organization was written to every member's row; now agent settings split into a shared half and a private one, secrets follow only the member who set them, and the old leaked values are stripped on read so the contamination ends with the upgrade.

A front door, a host, a tenancy boundary: three different doors, one idea. Each provider decided that the way to keep bad input out is a gate at the boundary it crosses, enforced by the system, not a paragraph of prompt asking the model to behave.

Breaking changes, before you upgrade

Claude Code v2.1.149: a PowerShell permission bypass and a worktree sandbox scope bug. Windows operators with PowerShell allowlists are affected by PowerShell built-in cd functions (cd.., cd\, cd~, X:) defeating the workspace boundary undetected. Git worktree workflows are affected by the sandbox write allowlist over-scoping the main repository root instead of the shared .git directory. Anthropic ships these as ordinary changelog entries; the changelog is the de-facto advisory surface, but no separate page exists. Upgrade past 2.1.149 before deploying. v2.1.147 closes adjacent forceLoginOrgUUID and forceLoginMethod enforcement gaps against third-party-provider and API-key sessions; v2.1.148 closes a Vertex AI provider bypass.

Claude Code v2.1.152: Auto mode no longer requires opt-in consent. Auto mode (the permission classifier that runs safe actions without prompting and blocks risky ones) is now the default permission posture across the install base. Admins relying on the consent dialog as a visible posture check have lost that surface. Re-audit managed settings and decide where the equivalent check now lives.

Codex CLI 0.134.0: legacy profile configs rejected with migration guidance. --profile is the canonical permission selector across CLI, TUI, and sandbox flows. Scripts using older permission flag-soup must migrate before upgrade.

OpenHands main (pre-2026-05-22 SaaS deployments): MCP server and acp_env cross-org credential leak. Before PR #14528, MCP server configurations added by an org member were broadcast to every other member's row. The fix splits agent settings into shared and private halves and strips legacy leaked values on read. Multi-tenant SaaS operators on pre-fix deployments should rotate MCP credentials added before that date and confirm they are on a post-fix main build (no in-window tagged release yet).

Hermes Agent v0.14.0: PyPI distribution, lazy adapter install, and the proxy. Installation moves to pip install hermes-agent; the [all] extras are removed in favor of lazy install of heavy adapters on first use. Cold-start drops ~19s. A native Windows beta ships. The hermes proxy command exposes a local OpenAI-compatible endpoint backed by whichever OAuth provider the operator is signed into. The PR body does not specify the proxy's bind address or auth model; default-loopback-only is the safe assumption to verify, not assume.

Provider notes

Codex (26.519; CLI 0.131-0.134) ran the window's most coordinated release train: goal-mode graduation and the CLI's default-on landed the same day, with profile inheritance and the managed requirements.toml alongside. Capability and its governance shipped as one move, which no other provider managed this fortnight.

OpenClaw (v2026.5.18-v2026.5.26) put its weight where its risk is -- content-boundary hardening, reaction-based approvals across Signal, iMessage and WhatsApp, and a gateway auth rate-limiter that is on by default for configs that never set gateway.auth.rateLimit. Its releases now carry verification stanzas with full CI run URLs: a vendor showing its receipts.

Paperclip (v2026.513, v2026.517, v2026.525) built scoped agent permissions on a real authorization service rather than a convention, and its ACPX-Claude adapter respects the operator's own ~/.claude/settings.json permissions -- the window's one instance of a wrapper deferring to the wrapped tool's rules.

OpenHands (main branch, no tagged release in window) consolidated into an enterprise self-hosted shell around third-party agents: org-level LLM profiles, scoped MCP/ACP env, Entra ID OAuth, Data Center source-control integrations, and a batched CVE cluster. None of it tagged.

Pi coding agent (v0.74.1-v0.76.0) and Hermes Agent (v0.14.0) converged independently on supply-chain hygiene -- npm shrinkwrap and lifecycle-script controls on one side, lazy adapter install with an advisory checker on the other. Two providers arriving at the same worry in the same fortnight is the more interesting fact than either shipping it.

Gemini CLI (v0.44.0) made the session-invocation protocols stable, closing the "tests but no observed remote target" gap in the prior AgentProtocol. Two weeks of What's-New digests are unpublished, so the changelog is the trailing surface.

Agent Zero (v1.15-v1.18) added host-machine desktop control with vision verification and, more quietly, skill visibility controls that let an operator hide skills from the model-facing catalog.

Flue (Tier 2; v0.6.0-v0.8.0) split agents from workflows as categories -- persistent agents/ against finite workflows/ -- and made runs a workflow-only concept. The cleanest "what is the receipt?" answer this cycle.

The click was the decision

Three makers moved the permission ceremony from something you opt into to something you opt out of, and the decision it used to carry did not disappear. It moved into a policy file.

That is a real improvement in one respect: a file is versioned, reviewable, and survives the operator's attention. It is a downgrade in another, and this publication has spent every issue since documenting which one. A click is a decision a person made. A file is a promise a runtime has to keep.

Test the file. It is the only part of this that can be wrong without telling you.