The Policy You Wrote Wasn't the Policy You Had

On 31 May Matt Pocock reported what happened whenever he said the word “workflow” in Claude Code, a GitHub workflow included: it tries to enter 'workflow' mode, spinning up dozens of subagents to complete my task.@mattpocockuk A few minutes later he added that it was the most bizarre design choice, who thought this was a good idea@mattpocockuk. The next day Claude Code 2.1.160 renamed the dynamic-workflow trigger to ultracode: the word “workflow” “no longer triggers a run.” Nobody had written a rule saying an ordinary noun launches a fleet. It was policy all the same, and it was in force.

Anthropic’s developer account then split the complaint in two: The issue affected how Opus 4.8 requests were handled, causing the model to trigger more parallel tool calls than intended. It was unrelated to dynamic workflows.@ClaudeDevs A keyword that started fleets, and a request-handling bug that made ordinary turns fan out. Only the first is in the release notes.

The rest of the week ran the other direction: rules operators did write, doing nothing. On 3 June Claude Code 2.1.162 shipped a one-line fix: Read deny rules now hide files from Glob and Grep. Until then, a file an operator had denied for reading was still findable, its path and contents surfaced by any search the agent ran. The rule read correctly in the config and did nothing.

The release’s own highlights led with a second one: Explicit WebFetch(domain:NAME) deny/ask/allow rules now override preapproved hosts, enforcing access control@ClaudeCodeLog. A rule an operator wrote had been losing to a default they never set.

And it runs the other way again. The same day an operator asked, in Chinese, how to stop Claude Code Desktop prompting for permission on everything when he had already switched Bypass Permissions on (our paraphrase):

请教：Claude Code （Desktop）总是弹窗要确认权限，有没有办法避免总是要 Allow，很烦人，已经启用了 Bypass Permissions

A word nobody wrote as policy acted as one. Rules operators wrote acted as nothing. A switch set to bypass kept asking. The setting is not the behaviour.

The rule existed and did nothing

These bugs share a signature, and it is what makes them dangerous. There is no error, no blocked action, no log line. The operator has every reason to think the control is live, which is exactly why nobody goes back to check.

Claude Code’s 2.1.160 to 2.1.162 line had three of them: the Read-deny that search walked around, a WebFetch rule that lost to the preapproved-domain list, and Windows path rules that missed on a backslash or a capital letter. The same line turned a silent write into a prompt for files that grant code execution (.npmrc, .yarnrc*, bunfig.toml, .bazelrc, .pre-commit-config.yaml, .devcontainer/) and for shell startup files such as .zshenv. Those files run on the next login, install or commit.

Gemini CLI’s v0.45.0 stable fixed a deny-list that let a blacklisted MCP tool or server through. A quieter policy-file fix closed a fail-open path: a policy that failed to save or parse left the agent running under no policy at all.

The rest were credential boundaries. In Pi, a malicious OAuth server could hand over a verification link that ran shell commands, a crafted git URL could write outside the install root, auth files were briefly world-readable, and the extension cache sat in /tmp. Hermes’s Docker dashboard dropped its authentication because a heuristic misread the bind host. Flue stopped retaining credentials carried in WebSocket handshake URLs, and OpenHands moved provider credentials off a plaintext channel.

None of it was misconfiguration. The operators wrote the rules correctly, and the runtimes did not enforce them. Claude Code shipped its fixes as ordinary changelog entries, and Pi’s sit in commits on main that no tag in the window carried. An upgrade this week was the moment you learned which of your controls had been decorative. The job after upgrading is to check, not to exhale.

What the fleet actually cost

The week’s biggest capability launch was Claude Code’s dynamic workflows, and the useful number came from outside the vendor. A practitioner ran it on launch day and reported 8 agents in 24.5s. 253k tokens@PawelHuryn. He also made the point the announcement had not: the orchestrator is JavaScript, not a model turn, so the routing spends no tokens. It is one run, his. It was still the only figure anyone attached to the feature that week.

One builder who had argued for this design since 2025 read the launch as his point proven: Deterministic workflows orchestrating small agent loops beats non-deterministic multi-agent or "agent soup" systems every dang time@dexhorthy. Pressed on durability, Thariq, who works on Claude Code, said they had not shipped Temporal inside your terminal: I would model it as roughly as durable as "/resume"ing every subagent@trq212. That is the durability to plan around, and it is less than the launch implied.

The posture being taught alongside it was explicit. A widely shared post relayed an Anthropic engineer saying You’re not supposed to watch Claude Code work. You’re supposed to wake up and review what it shipped@mikenevermiss. We hold no primary source and name nobody. The posture is still clear, and it is Amdahl Maxing in one line: spend scarce human attention on review, where it counts most, not on watching. An operator doing exactly that with Cursor’s auto-review mode, one branch and one diff at the end, named the price: you get the whole flow, you lose steering mid-run. bigger diff to read if it wanders@BrenBuilds. The posture also assumes that every rule held overnight. This issue is a list of rules that did not.

The surface under review keeps growing on its own. One Codex user opened his plugin manager and found 163 skills enabled@cherry_mx_reds. Nobody chooses 163 of anything. Configuration arrives by default, by install, by helpful suggestion, and the surface an operator audited is not the surface they run.

Capability became something you can look up

For most of the short life of agent harnesses, “what can this agent do?” has been answered by code and defaults. Four projects spent the week turning the answer into state.

Paperclip made company skills first-class objects with an install / reset / audit / export / assign CLI. audit and export turn the skills an agent holds into a fact you can hand a reviewer. assign makes granting one a deliberate, recorded act.

OpenClaw came at it from the review side, and said why: Agents should learn repeated work, but not by silently rewriting future runs.@openclaw Its Skill Workshop holds new skills in a pending queue until a human approves them through the CLI or Gateway. The wrinkle is a companion skill_workshop tool that lets the agent file its own proposals. The same day a user asked, in Chinese, for the step to go away, 不要让我审查提案，而是直接让我看结果@LufzzLiz: in our rendering, do not make me review proposals, just show me the result. The question an operator now owns is who may approve, whether the agent ever may, and how long a human keeps wanting to.

Flue pushed the other way. Its activate_skill tool lets an agent pull a skill’s full instructions mid-task. The operator still decides which skills exist; the model decides when one switches on.

Agent Zero shipped the bluntest instrument, a protected API that switches its Office, Desktop and Editor plugins off. It is a real lever for pulling desktop computer use out of deployments that should never have had it. It is a switch, not a register: the release note does not say who may flip it.

Governable is not the same as easy to live with, and the week showed both. Claude Code’s new waitingFor field in claude agents --json, with a done-over-total counter, names what a stalled session is waiting on, so minding a fan-out no longer means opening each agent. Flue’s v0.9.0 forced a hard migration with no automated path. The harnesses got easier to govern. Not all of them got easier to run.

Authority moved onto standing credentials

The choice underneath all of this got compressed into three lines that week, by someone positioning two harnesses against each other:

OpenClaw is Arch. Hermes is Omarchy. I will not elaborate further.

The maintainers answered in kind. Teknium, of Nous Research, which makes Hermes: If you want an empty soulless experience, not ready ootb for anyone, try openclaw@Teknium. When Pi was lumped in with the bare harnesses, Mario Zechner, who wrote it, declined the category: pi is not a claw.@badlogicgames

Assemble it yourself and own every decision, or take the assembled one and own none of them. Both are defensible. Neither is free.

Underneath ran a quieter current, and it did not point toward the operator. Authority kept moving onto credentials that outlive a session. Codex added remote-exec host registration by API key and the option to run its models under AWS IAM through Bedrock. Hermes swapped per-provider keys for a Bitwarden Secrets Manager pool. Claude Code’s Auto mode reached Bedrock, Vertex and Foundry. None is a flaw alone. Together they put more of an agent’s reach behind one secret, where one leak becomes standing authority.

Agent Zero made the sharpest reversal. It returned computer-use screenshots to durable, chat-scoped storage, undoing the ephemeral default it had shipped weeks earlier. The upside is a real audit trail. The cost is that every captured screen, credentials and internal dashboards included, now sits on disk with no automatic redaction. Codex’s new Sites plugin is on by default in Business workspaces, so the power to build and deploy a live web app may be switched on before anyone chose it.

Breaking changes and security notes

Paperclip v2026.529.0 makes a one-time browser claim the way an unclaimed self-hosted deployment gets its first admin. Whoever completes it first becomes admin, so claim a fresh instance promptly and keep it off the network until you have.

Hermes v0.15.0 adds a defense against Brainworm-class prompt injection and closes 19 security-tagged issues. Run your own injection cases against it before exposing the agent to untrusted content.

Flue v0.9.0 moves routing imports from @flue/runtime/app to @flue/runtime/routing, requires provider-id/model-id model values, derives SDK mount paths from baseUrl, and hands Cloudflare Durable Object migrations to the operator’s Wrangler config. Interrupted workflows no longer auto-retry.

Provider notes

Claude Code (2.1.158 to 2.1.162) spent the fortnight almost entirely on making written rules bind. It also loosened a managed-settings policy that had been blocking third-party sessions it should have allowed.

Gemini CLI (v0.44.1 to v0.46.0-preview). The flag-gated Flash rollout means an operator can no longer infer the model from the client version. Moving the PR-size labeler to pull_request_target is low-risk as written, since it only reads line counts, but it gives up the structural safety of pull_request: any later edit that checks out fork code becomes dangerous at once.

Pi shipped a five-part security cluster on main, including HTML-export XSS sanitization, and tagged none of it in the window.

Hermes Agent (v0.15.0 to v0.15.1) turned Kanban into a multi-agent platform with auto-decomposition and a worktree per task.

Codex (CLI 0.135.0 to 0.136.0, iOS 1.2026.146) now displays the custom config behind a named permission profile.

OpenHands tagged nothing; everything above is on main.

Agent Zero (v1.19) also lets Remote Control pick its tunnel provider. OpenClaw (2026.6.1 stable) and Paperclip (v2026.529.0) are covered above.

Flue (v0.8.1 to v0.9.2) made workflow-run retention the operator’s call; the implicit 50-run prune is gone.

A rule you have not tested

Six projects shipped the same unglamorous patch this week: enforcement for rules operators already believed were in place. A deny that denies, a prompt that fires, a boundary that holds in the direction it was written.

These were found because somebody looked. The ones under your own configuration have not been found by anybody, and the runtime is not going to mention them.

A rule you have written is a belief. A rule you have tested is a control.