The Policy You Wrote Wasn't the Policy You Had

An operator told Claude Code to keep one file out of reach. They wrote a Read-deny rule, the sort of one-line guardrail security teams lean on, and moved on. The file stayed readable anyway: any Glob or Grep the agent ran could return its path and its contents, deny rule or not.

It runs the other way too. On June 3 an operator asked, in Chinese, how to stop Claude Code Desktop popping up for permission on everything when he had already switched Bypass Permissions on -- our rendering of his question, not his words:

请教：Claude Code （Desktop）总是弹窗要确认权限，有没有办法避免总是要 Allow，很烦人，已经启用了 Bypass Permissions

A rule that under-enforces and a rule that over-enforces are the same defect wearing different clothes. In both cases the setting is not the behaviour.

The window's repair for the first kind is precise about it: Claude Code 2.1.162 made Explicit WebFetch(domain:NAME) deny/ask/allow rules now override preapproved hosts, enforcing access control@ClaudeCodeLog. A rule an operator wrote had been losing to a default they never set.

That deny-rule hole was one of at least six ways this week, across six different makers of AI coding agents, that a safety rule turned out to be advisory. A Pi user signing in through a malicious OAuth server could be handed a verification link that ran shell commands. A Hermes dashboard dropped its authentication because a heuristic misread the bind host. A Gemini CLI deny-list let through a tool it was meant to block. None of it was misconfiguration. The operators had written the rules correctly; the runtimes simply were not enforcing them, and over the week Claude Code, OpenHands, and Flue shipped the same unglamorous patch as the rest: not a new feature, but enforcement for a rule the operator already believed was in place.

The week's other current ran the opposite way, toward more control rather than less. At four providers at once, the skills and plugins an agent can reach stopped being an ambient default and became something an operator can list, audit, and approve. Paperclip, OpenClaw, Flue, and Agent Zero each turned capability that used to be invisible into reviewable operating state.

The enforcement gap

These bugs share a signature, and it is the reason they are dangerous: the rule exists, it reads correctly in the config, and it does nothing. There is no error, no blocked action, no log line. The operator has every reason to think the control is live, which is precisely why no one goes back to check it.

Claude Code's cluster is the clearest case. A Read-deny that search walked right around, a WebFetch rule that failed to override the preapproved-domain list, and Windows path rules that quietly missed on a backslash or a capital letter were three faces of the same false promise. The same release line turned a silent agent config-write into a confirmation prompt for files that grant code execution, and, in the other direction, loosened an over-broad managed-settings policy that had been blocking legitimate third-party sessions it should have allowed.

Once you have the shape, you see it everywhere. Gemini CLI's deny-list that didn't deny is the same failure one layer up, at the tool boundary; its quieter policy-file fix closes a fail-open path where a policy that failed to save or parse left the agent running under no policy at all. Pi spent four commits sealing the gaps a co-tenant on a shared host could slip through, writing auth files at 0o600 instead of world-readable and moving its extension cache out of /tmp. Flue stopped retaining the credentials carried in WebSocket handshake URLs; OpenHands moved provider credentials off a plaintext channel onto an encrypted one; Hermes forced its Docker dashboard to stop guessing whether to require authentication.

The practical reading is uncomfortable. An upgrade this week is not a feature bump; it is the moment you find out which of your controls were decorative. For every provider above, the safe assumption is that something you set on the last build was not holding, and the job after upgrading is to check, not to exhale.

What the fleet actually cost

The window's biggest capability announcement was Claude Code's dynamic workflows, and the useful number came from outside the vendor. A practitioner ran it on launch day and reported 8 agents in 24.5s. 253k tokens@PawelHuryn, then made the point the announcement had not: the orchestrator is JavaScript rather than a model turn, so the routing itself spends nothing. His run, his numbers, one sample. It is still the only figure anyone attached to the feature that week.

The posture being taught alongside it was explicit. A widely shared clip quoted an Anthropic engineer saying You’re not supposed to watch Claude Code work. You’re supposed to wake up and review what it shipped@mikenevermiss. We hold no primary source for that sentence and attribute it to nobody by name, but the posture is unambiguous and it is the one every control in this issue is being measured against. If you are asleep, the rule is the only thing awake.

Which is what makes the accretion worth watching. One Codex user opened his plugin manager and found 163 skills enabled@cherry_mx_reds. Nobody chooses 163 of anything. Configuration arrives by default, by install, by helpful suggestion, and the surface an operator believes they audited is not the surface they run.

Capability you can audit

For most of the short life of agent harnesses, the answer to "what can this agent actually do?" has lived in code and defaults, somewhere an operator had to go and read. Four providers spent the week turning it into something you can look up.

Paperclip made company skills first-class objects with an install / reset / audit / export / assign CLI. The verbs that matter are audit and export, which turn the skills an agent holds from implicit configuration into a fact you can query and hand to a reviewer, and assign, which makes granting a capability its own deliberate, recorded act. OpenClaw came at the same problem from the review side: its Skill Workshop holds new skills in a pending queue until a human approves them through the CLI or Gateway. The wrinkle is that a companion skill_workshop tool lets the agent file its own proposals, so the question an operator now owns is who may approve, and whether the agent is ever allowed to approve itself.

Flue pushed the other way, and the contrast is the interesting part. Its activate_skill tool lets an agent pull a skill's full instructions on demand, mid-task; the operator still picks which skills exist, but the decision to switch one on has moved to the model. Agent Zero, by contrast, shipped the bluntest instrument of the four, a protected API that toggles its Office, Desktop, and Editor plugins off, a real lever for pulling powerful capabilities (Desktop computer-use above all) out of deployments that should never have had them. For now it is a switch, not an audited register: the release note promises a "protected" endpoint without saying who is allowed to flip it.

Catalog, approval queue, on-demand activation, kill switch. Four different shapes, the same underlying shift: "what can this agent do?" is becoming a question you answer by reading state instead of trusting a default. Whether that also makes the tools easier to live with is a separate matter, and the week answered it both ways. Claude Code's new waitingFor field, surfaced through claude agents --json with a done-over-total progress counter, finally names what a stalled session is waiting on, so minding a fan-out of agents no longer means opening each one in turn. Flue's v0.9.0, in the same window, forced a hard migration with no automated path. The harnesses got more governable. They did not get more approachable.

A countervailing drift

The choice underneath all of this got compressed into three lines the same week, by someone positioning two harnesses against each other:

OpenClaw is Arch. Hermes is Omarchy. I will not elaborate further.

Assemble it yourself and own every decision, or take the assembled one and own none of them. Both answers are defensible. Neither is free, and this issue is a catalogue of what the second one costs when the assembly is wrong.

Underneath the week's two visible currents ran a quieter one, and it does not point toward the operator. Authority kept migrating onto standing credentials and managed cloud paths, where a single secret or a one-time approval buys lasting reach. Codex added remote-exec host registration by API key and the option to run its models under AWS IAM through Bedrock; Hermes swapped per-provider keys for a Bitwarden Secrets Manager pool; Claude Code's Auto Mode reached Bedrock, Vertex, and Foundry. None of these is a flaw on its own. Together they mean more of an agent's power now rides on credentials that outlive any single session, the place where one leak or one over-broad grant quietly becomes standing authority.

The sharpest reversal came from Agent Zero, which returned computer-use screenshots to durable, chat-scoped storage and undid the ephemeral-by-default stance it had shipped only weeks earlier. The upside is a real audit trail; the cost is that every captured screen, credentials and internal dashboards included, now sits on disk with no automatic redaction, waiting to be scoped and pruned by hand. Codex's new Sites plugin carries a milder version of the same edge: in Business workspaces it is on by default, so the power to build and deploy a live web app may already be switched on before anyone chose to enable it. The rest was plumbing, a Gemini CLI editor-spam-loop fix, MiniMax M3 support in OpenClaw, and OpenTelemetry tracing in Flue.

Security advisories, before you upgrade

Claude Code 2.1.160 through 2.1.162: three permission-bypass gaps closed at once. Custom WebFetch permission rules now override the built-in preapproved-domain whitelist; Windows permission rules with backslashes or case-variant paths now match; and Read-deny rules now hide files from Glob and Grep results. The sharpest of the three is the last one: a file an operator denied for Read was still discoverable through search tools: its path and contents were surfaceable, defeating the access-control intent. The attacker model is prompt-injection or compromised task content steering the agent toward a denied domain or walled-off path; the fix is gated purely on upgrading, so the operator action is upgrade, then re-audit whether any policy was silently bypassed in the prior window, especially on Windows and any setup relying on Read-deny to hide secrets from search. The changelog ships this as an ordinary entry; treat it as the advisory it is.

Claude Code 2.1.160: execution-granting config writes now prompt even in acceptEdits mode. Two guardrails land together. acceptEdits mode now prompts before writing build-tool config that grants code execution (.npmrc, .yarnrc*, bunfig.toml, .bazelrc, .pre-commit-config.yaml, .devcontainer/), and the agent now prompts before writing shell startup files (.zshenv, .zlogin, .bash_login) and ~/.config/git/. Operators running acceptEdits or auto-leaning modes previously had a silent write path into files that execute on the next shell login, install, or commit. That is the classic agent-persistence and supply-chain escalation vector. The prompt is the guardrail here; blanket-allowing it puts you back where you started.

Pi: OAuth command injection and git-package path traversal closed. Commit ba6e529 validates OAuth verification URIs (rejecting non-HTTP(S) schemes) and launches the browser via spawn() instead of shell exec(), closing a path where a malicious OAuth server could inject $(id>/tmp/pwned)-style commands. Commit a98e087 rejects git URLs with .., null bytes, backslashes, or leading slashes at both parse and resolution time, blocking writes outside the package install root. The attacker is whoever controls the OAuth server or authors the git package; both fixes need no config change, only the upgrade.

OpenHands main: three named CVEs. No tagged release fell in the window, but main closed CVE-2026-44492 (axios 1.16.0), CVE-2026-41238 (dompurify 3.4.0), and CVE-2026-42305 (dulwich 1.2.5). The first two are browser-facing (HTTP client and HTML/DOM sanitizer) and need a frontend rebuild and redeploy; the third is a backend git library and needs a poetry.lock re-resolve and image rebuild. Self-hosters pinning older lockfiles must bump manually.

Gemini CLI v0.45.0: MCP blacklist bypass fixed. The stable release bundles Termux relaunch/resize fixes, session-context filtering on history resume, and the security-bearing item: a fix for a path where a blacklisted MCP tool or server could still be reached. Operators relying on MCP deny-lists for containment should upgrade before trusting the blacklist, and test that blacklisted tools are actually unreachable rather than assume full coverage.

Hermes v0.15.1: Docker insecure binding is now an explicit opt-in. The dashboard no longer infers insecure mode from the bind host; it requires HERMES_DASHBOARD_INSECURE=1 explicitly. This removes a silent path where a misread bind host dropped auth and exposed the dashboard to a network-adjacent attacker. Existing Docker and hosted setups must update env config before upgrading. The same patch fixes a v0.15.0 loopback-mode dashboard reload loop and restores MCP bare-command resolution (npx, npm, node) in Docker.

Paperclip v2026.529.0: first-admin claim is now the bootstrap gate. Unclaimed self-hosted deployments get a one-time browser claim to create the first admin. The flip side is a race: whoever completes the claim first becomes admin, so an attacker with network reach to a freshly stood-up instance could seize control before the legitimate operator. Claim promptly and restrict network exposure during the unclaimed window.

Hermes v0.15.0: Promptware defense, and a migration. The Velocity Release adds a built-in defense against Brainworm-class prompt-injection and closes 19 security-tagged issues. Operators running against untrusted content (web, repos, MCP output) should validate the defense against their own injection corpus rather than assume blanket coverage; novel vectors outside the known class may still pass.

Flue v0.9.0: a hard breaking migration. Routing imports move from @flue/runtime/app to @flue/runtime/routing, provider model values now require provider-id/model-id format, SDK mount paths derive from baseUrl, and persisted beta session state is rejected. Clear or migrate the store before upgrading, or sessions fail to restore. Cloudflare Durable Object migrations are no longer auto-appended; the operator now owns them in the Wrangler config, and interrupted workflows no longer auto-retry.

Provider notes

Claude Code (2.1.158-2.1.162) is the enforcement-gap headliner: the permission and deny-rule cluster, execution-granting config-write prompts, the managed-settings third-party-session unblock, and Auto Mode reaching Bedrock, Vertex and Foundry. A fortnight spent almost entirely on making written rules bind.

Gemini CLI (v0.44.1-v0.46.0-preview) shipped the v0.45.0 stable bundle with the MCP blacklist fix, and a server-flag-gated Gemini 3.5 Flash rollout that decouples the model in use from the client version -- an operator can no longer infer one from the other. Separately, moving the PR-size labeler to pull_request_target is low-risk as written, since it only reads line counts, but it removes the structural safety of pull_request: any future edit that adds fork-code checkout becomes immediately dangerous.

Pi coding agent (commits to main) shipped a five-part security cluster -- git path-traversal rejection, auth files created 0o600 instead of briefly world-readable, extension-cache isolation out of world-accessible /tmp, OAuth launch hardening, and HTML-export XSS sanitization. No in-window tag carried any of it.

OpenHands (main, no tagged release) landed a three-CVE remediation cluster and one change worth reading twice: DELETE /api/organizations now cascade-deletes the requesting user if that org was their only one.

Hermes Agent (v0.15.0-v0.15.1) turned Kanban into a multi-agent orchestration platform with auto-decomposition, swarm topology and worktree-per-task, then spent the patch release fixing a Docker insecure-binding opt-in.

Codex (CLI 0.135.0-0.136.0, iOS 1.2026.146) added named permission profiles with custom-config display, remote-exec API-key host registration, and an optional Face ID lock on iOS.

OpenClaw (2026.5.31-beta.3 to 2026.6.1 stable) shipped the Skill Workshop proposal workflow and bounded request timers alongside enhanced plugin isolation. Paperclip (v2026.529.0) added a skills CLI and catalog and a first-admin claim flow. Agent Zero (v1.19) put its Office, Desktop and Editor plugins behind a protected API and gave Remote Control selectable tunnel providers.

Flue (Tier 2; v0.8.1-v0.9.2) made workflow-run retention operator-owned; the implicit 50-run prune is gone.

A rule you have not tested

Six makers shipped the same unglamorous patch this week, and none of them shipped a feature. They shipped enforcement for rules operators already believed were in place -- a deny that denies, an approval that blocks, a boundary that holds in the direction it was written.

The uncomfortable part is what that implies about every rule nobody happened to test. These were found because somebody looked. The ones underneath your own configuration have not been found by anybody, and the runtime is not going to mention them.

A rule you have written is a belief. A rule you have tested is a control.