Who's Allowed to Say Yes

Before 13 June, Hermes Agent would stop an agent writing to your SSH keys the obvious way and wave it through the side door. A safety rule denied redirecting output into ~/.ssh/authorized_keys. It said nothing about copying a file there. So cp evil ~/.ssh/authorized_keys, an implant and a foothold on the operator’s machine, sailed past a guardrail that existed on paper. The commit that closed it called an unpaired write deny what it was: “theater.”

The pressure behind the fortnight was depth. On 9 June Claude Code’s creator posted Just landed nested subagent support in Claude Code@bcherny, and a reader did the arithmetic the announcement skipped: An agent can now spawn an agent that spawns an agent, four layers down@crepesupreme, each layer multiplying invocations and context. Another took on the launch’s stated purpose, better context management, and turned it around: Nesting doesn't manage context. It launders it.@EdwinRubioIam OpenHands became a platform where the first person to log in owns the organization. Paperclip began routing untrusted pull requests and comments to agents that can be prompt-injected.

A per-action prompt does not scale to a five-deep delegation tree or a shared tenant pool. So nine of ten providers spent the window deciding, in advance and in code, who is allowed to say yes. The catch is that several of the sharpest answers were merged and not released.

Authority caught up with depth

Across provider after provider, a control that used to be a prompt, a default or an honor-system check became enforced, inspectable state. It happened along four fault lines.

Recursion. Claude Code agents can now spawn subagents that spawn subagents, five levels deep. (Correction: foreground spawns did not respect that cap until 2.1.181.) Real capability, and at once a governance problem: a great-grandchild could request what the top-level policy would block. A builder named the default he wanted the next day: Privilege reduction at each spawn level should be the default, not an option.@DarshanSays What shipped is narrower than that ask. The same line taught the auto-mode classifier to evaluate a spawn before it launches, added a Tool(param:value) grammar so a rule can match arguments (Agent(model:opus) blocks Opus subagents), and fixed server-level MCP denials being silently ignored inside a subagent. It also stopped a relayed SendMessage from a peer session carrying user authority. Each of those carries the parent’s limits down the tree. None makes a child’s scope shrink by default.

Hermes pushed from the other side with fire-and-forget background subagents whose results re-enter the conversation as a new turn. The same week it removed the default ten-minute worker timeout. Where Claude Code picked the depth, Hermes’s lead said the operator does: You can configure width (how many subagents an agent can spawn) and depth (how many layers of subagents spawning subagents)@Teknium, set in config.yaml or the dashboard. The width half is in the commit, a delegation.max_async_children cap that defaults to three; the depth half is his word.

Tenancy. OpenHands spent the window becoming a tenant-provisioning system: a default-organization bootstrap keyed to a database flag, per-org and per-user concurrency limits enforced with HTTP 429, and a BYOK gate that locks an org to a curated, proxy-served model set. It was also candid about a limit. Its hide-personal-workspaces flag is, in its own docs’ words, “not an access-control boundary.” Paperclip closed a tenant privilege escalation (below), isolated plugin tables per tenant, and stopped HTTP error logs writing plaintext passwords and bearer tokens to disk.

Untrusted input. As agents read code and messages they did not write, providers drew the boundary around the input. Paperclip’s deny-by-default “low-trust review” preset gives an agent reviewing a hostile pull request narrower authority than usual and quarantines its output from higher-trust context. Its maintainer put the promise plainly: you can have an agent review untrusted inputs and if he’s prompt-injected it won’t pwn the rest of your Paperclip org@dotta, with the condition in parentheses that instances are sandboxed. Pi’s project trust refuses a repo’s local settings, instructions and packages until the operator approves. Hermes stopped skills poisoning every connected memory store and an agent-triggered skill delete from escaping its directory, a fix ported from an incident that did exactly that to another tool’s user. Gemini CLI fixed three path traversals at skill install (below). OpenClaw moved the install decision itself to the operator, announcing that security.installPolicy lets operators approve or block skill/plugin installs with a trusted local command.@openclaw Switched on but unable to run, it fails closed.

Guardrails caught not holding. The most telling commits were providers finding their own controls hollow. OpenClaw’s security boundary sweep made exec approvals “fail closed on timeout,” so a pending dangerous command that times out is denied. Paperclip found its review gate matched negated phrasings: a comment reading “NOT APPROVED” could auto-complete an issue, and the comment and status change were not atomic. Agent Zero narrowed the trust set on its public Tailscale tunnel to the active origin. Codex made remote controllers listable and revocable and bound approvals to an environment identity.

None is a headline feature. Together they are the field auditing the authority it advertised against the authority it enforced.

The fixes no tag carried

The awkward part is the channel. Hermes tagged v0.16.0 on 6 June and landed its fail-closed wave on main a week later. Paperclip put its whole multi-tenant cluster on master. OpenHands shipped one frontend CVE fix in 1.8.0 and left the other, and its plaintext-token fix, on main. Gemini CLI’s skill fix was in no tag, stable or preview, when the window closed.

An operator on the newest release of all four was running without them. The difference between a merged fix and a tagged one is the difference between being protected and believing you are.

The market started to move

Underneath the authority work, the agent-CLI market repositioned, and one practitioner named what that means for a stack: Vendor risk used to mean "what if they raise the price." In 2026 it means "what if they delete the product.@gthimmes

Google began routing Gemini CLI users to another product. A transition banner, cherry-picked into stable v0.45.2, was exempted from the usual five-times cap, so “Antigravity is coming to town” shows every session it is active. A preview build added migration commands and a built-in skill pointing to “Antigravity CLI,” a separate agent CLI with its own binary, installer domain and docs. The marketing is in stable; the tooling is a preview away. It reads less like a feature than a managed succession.

OpenAI came at switching costs from the other side. Codex app 26.608 added Migrate-to-Codex flows that import supported setup from Claude Code and Claude Cowork, including during onboarding. Paperclip retired its “zero-human companies” tagline for “the app people use to manage AI agents for work,” and the fortnight’s engineering backs the new line: board visibility, an audited recovery action for stuck agents, and the approval gates above. The autonomous company is being repriced as human-in-the-loop operating software.

The counter-position shipped the same fortnight. Flue 1.0 Beta arrived designed around an open agent harness with zero LLM lock-in@FredKSchott, and an engineer was porting the code review agent we use across all of our OSS repos to Flue as we speak@elithrar on launch day. Whether that promise holds is not yet known. That it is the pitch, in the fortnight Google began moving users off an open CLI to a closed one, is the market answering itself.

The model moved, and people noticed before the benchmarks did

On 9 June Claude Fable 5, a “Mythos-class” model, reached Claude Code 2.1.170. Its maker’s verdict was the expected one: Fable is the best model I have used for coding, by a wide margin@bcherny. A vendor’s claim about its own model is worth what it cost to make.

What followed was worth more. Over the next week, unprompted, practitioners reached for the same shape of description. One found that a few days with Fable is making the subsequent days without it feel like an intelligence blackout@bayeslord. Another put it flatly:

Going back to Opus after a few days with Fable is akin to re-hiring an employee you fired for being stupid.

We ran no evaluation. What is observable is the reaction: a step change registered as people describing going backwards, within days.

The speed is the operator consequence. Within days OpenClaw and Pi supported it, Pi with xhigh reasoning effort. If your allowlist pins model IDs, it went stale in days. If it does not, your delegated trees changed capability without a release note on your side. Claude Code shipped the lever for exactly this: an enforceAvailableModels setting and fixes in 2.1.175 and 2.1.176 that make an org’s model allowlist bind even against the default model and env-var overrides.

The same release line also added a fallbackModel chain of up to three models for when the primary is overloaded, which means a session can change model mid-flight. On launch day plus one, a security researcher told another user to check /model, because in his own session Claude still claimed it's using fable in my case, but it actually got downgraded to Opus@wunderwuzzi23. He caught it only after switching the behavior off in /config so the session stops instead. His report does not say what triggered the switch. It does say which witness not to trust: the model’s account of itself.

Computer use grew up, and got metered

Codex app 26.609 added Developer mode for the browser, giving the agent “controlled” Chrome DevTools Protocol access. CDP can read network traffic, run arbitrary JavaScript in the page, and drive the debugger: a far larger surface than clicking and typing.

The same build added per-app access controls for computer use on Windows and opened it to Enterprise users. On 16 June Codex made computer use available in the EEA, the UK and Switzerland. It also previewed Chronicle, an opt-in feature that builds the agent’s memory from recent screen context. Keep it off on confidential machines.

Here the capability and its governance lever arrived in the same build, not a quarter apart.

Access widened, too

Not everything was lockdown. OpenClaw shipped a measured WCAG 2.1 AA pass on its browser dashboard: muted text lifted above the 4.5-to-1 contrast floor it had failed in dark mode, a real keyboard focus ring, and a 12-pixel font floor across 136 elements. An agent harness treating low-vision and keyboard-only users as engineering, not someday, is rare enough to note. It is a beta build.

On a stable release OpenClaw also stopped auto-selecting key-free web search providers, giving up some zero-config convenience to make the user choose where their queries go. Consent over default, pointed at the user instead of the agent.

Codex brought /goal, branch and worktree selection, and inline code review to the iPhone. Hermes shipped a native desktop app and a browser admin panel that take install to first message in seconds. The panel is a new authority boundary, and its hardening is the unreleased wave above.

Breaking changes and security notes

OpenHands. CVE-2026-42342 in react-router is fixed in 1.8.0, uncredited under “Many UI bug fixes.” The moderate XSS CVE-2026-41305 in postcss is on main. So is the sharper fix: a PluginSpec.source holding a git token (https://oauth2:token@...) was persisted to the database in plaintext because the conversation object was serialized whole. New writes are redacted.

Gemini CLI. A malicious skill package could write outside .gemini/skills or, through a metadata-driven uninstall fallback, delete sibling directories. The fix replaces prefix checks with real traversal validation.

Hermes Agent. Besides the cp fix, 13 June commits stop an unauthenticated /api/status from leaking host paths and the gateway PID on exposed binds, and make chat adapters such as WhatsApp and WeCom fail closed without an allowlist, as the project’s own security policy already required.

Paperclip. In cloud_tenant auth mode every tenant on a shared pool was silently an instance admin, with reach into every other tenant’s data. The fix removes the grant and purges stale admin rows. A companion change gives each company its own JWT signing key and cuts token lifetime from 48 hours to one. Both are on master.

Claude Code. The OTEL certificate-path fix is in 2.1.169 and the background-worker fix in 2.1.172.

Provider notes

Claude Code (2.1.163 to 2.1.178) was the most authority-focused provider of the window. Authority was the product, not a setting.

Gemini CLI (v0.45.2 to v0.48.0-nightly) is the Antigravity story. Stable v0.46.0 also began moving flash workloads to gemini-3.5-flash behind an experiment flag, so one binary can route different users to different models. Re-baseline any cost or eval assumption pinned to the old flash.

Codex (CLI 0.137.0 to 0.140.0, app 26.602 to 26.609, iOS 1.2026.153). A remote-control grant you can list and withdraw is rarer than it should be.

Paperclip (v2026.609.0) tagged Company Artifacts and structured approvals.

OpenHands (1.8.0) mostly consolidated May’s work; the multi-tenant platform is on main.

Hermes Agent (v0.16.0, “The Surface Release”) tagged the desktop app, browser admin and remote-gateway connect.

Pi (v0.78.1 to v0.79.5) added project trust and two billing-accuracy fixes. OpenClaw (v2026.6.5 to v2026.6.8) paired fail-closed exec approvals with the accessibility work. Agent Zero (v1.20) spent one maintenance day on CSRF and WebSocket-origin hardening.

Flue (0.10.0 to 1.0.0-beta.1) reached its 1.0 beta with durable, recoverable execution on a built-in SQLite store, and swapped WebSocket and SSE for a proprietary Durable Streams transport, which makes run events harder to consume from outside the SDK.

Who is left to answer

The fortnight’s authority work was not about whether an agent may act. Every one of these systems already lets it. The work was about who is left to answer when it asks.

Nine of ten providers narrowed that list, and the direction is consistent: fewer questions reach a person, more are settled by a rule, and more still by a classifier reading intent. Each step is defensible. The sequence has a destination.

Depth forced it. An agent that spawns agents four layers down cannot stop at every layer to ask, so somebody decides in advance. This fortnight, that somebody stopped being you.