Who's Allowed to Say Yes

Before June 13, Hermes Agent would stop an agent from writing to your SSH keys the obvious way and wave it through the side door. A safety rule denied the agent from redirecting output into ~/.ssh/authorized_keys. It said nothing about copying a file there. So cp evil ~/.ssh/authorized_keys, an SSH-key implant and a foothold on the operator's machine, sailed past a guardrail that on paper existed. When a maintainer closed the gap, the commit message put it plainly: an unpaired write deny is "theater."

That word could stand over the whole fortnight. Across ten coding-agent makers, the most consequential pattern of the last two weeks was not another capability. It was authority catching up to one: who is allowed to do what, and whether the rule a provider had written was the rule its runtime enforced. Nine of the ten shipped work in that register. Several of the sharpest fixes are not yet in a tagged release, which turns out to be its own story.

What is driving it is depth. Agents stopped being a single assistant taking a single turn. On June 9 Claude Code's creator posted that he had Just landed nested subagent support in Claude Code@bcherny, and a reader did the arithmetic the announcement skipped: An agent can now spawn an agent that spawns an agent, four layers down@crepesupreme, with every layer multiplying invocations and context.

Depth is not the only thing that grew. OpenHands turned into a multi-tenant platform where the first person to log in owns the organization. Paperclip started routing untrusted pull requests and comments to agents that can be prompt-injected. Codex extended real desktop control to Europe.

Each is a new way for an agent to exceed what its operator meant to allow, and the per-action permission prompt the whole field was built on does not scale to a five-deep delegation tree or a shared tenant pool. So the providers spent the window building something sturdier, and auditing what they already had.

The authority build-out

Strip the window down and the same enforcement gap appears at provider after provider: a control that used to be a prompt, a default, or an honor-system check is being turned into enforced, inspectable state. It shows up along four fault lines, all of them consequences of agents getting deeper.

Recursion. Claude Code agents can now spawn subagents that spawn subagents, five levels deep. That is real new capability, and it immediately became a governance problem: a great-grandchild agent could request an action the operator's policy would have blocked at the top. So the same release line taught the auto-mode classifier to evaluate a spawn before it launches, added a Tool(param:value) permission grammar so a rule can finally match a tool's arguments (Agent(model:opus) blocks Opus subagents), and fixed server-level MCP denials being silently ignored inside a subagent's tool restrictions. It also stopped a relayed SendMessage from a peer session carrying user authority, the multi-session version of the same confused-deputy risk. Hermes pushed from the other side, shipping fire-and-forget background subagents whose results re-enter the conversation as a new turn, though it also removed the default ten-minute worker timeout, leaving runaway detection to heartbeats.

Tenancy. OpenHands spent the window becoming a tenant-provisioning system. A new default-organization bootstrap makes the first user to sign in the owner, keyed to a database flag; on top of it sit per-org and per-user concurrency limits enforced with HTTP 429, and a BYOK gate that lets an admin lock the whole org to a curated, proxy-served model set and hide the custom-key fields. OpenHands was also unusually candid about a limit: its new hide-personal-workspaces flag is UI-only and, the docs say explicitly, "not an access-control boundary." Paperclip's tenant work was the privilege-escalation fix above, plus plugin-table tenant isolation and a fix for HTTP error logs that had been writing plaintext passwords and bearer tokens to disk.

Untrusted input. As agents start reading code and messages they did not author, providers are drawing a trust boundary around the input itself. Paperclip shipped the clearest version: a deny-by-default "low-trust review" authority preset that gives an agent reviewing a hostile pull request narrower authority than a normal agent and quarantines its output so it cannot flow into higher-trust context. Pi added a project-trust system that refuses to load a repo's local settings, instructions, and packages until the operator approves them. Hermes closed two ways a skill could turn on its owner: skills were poisoning every connected memory store with their raw body, and an agent-triggered skill delete could escape its directory and wipe the working tree, a fix ported from an incident that did exactly that to another tool's user. And Gemini CLI's skill path-traversal fix, in the advisories above, is the same lesson learned at the install step.

The theater thread. The most telling commits were the ones where a provider caught its own guardrail not holding. Hermes's "theater" line is the motto, and it had company. OpenClaw shipped a security boundary sweep across a dozen surfaces whose load-bearing item is that exec approvals now "fail closed on timeout," so a pending dangerous command that times out denies rather than proceeds. Paperclip found that its review-approval gate matched negated phrasings, so a comment reading "NOT APPROVED" could auto-complete an issue, and that the comment and the status change were not even atomic. Agent Zero tightened the trust set on its public Tailscale tunnel to only the active origin. Codex made remote controllers listable and revocable and bound permission approvals to an environment identity. None is a headline feature. Together they are the field auditing the gap between the authority it advertised and the authority it enforced.

A separate pattern: the market starts to move

Underneath the authority work, the agent-CLI market spent the window repositioning. Three of the moves are vendors going after each other's users directly, and a fourth is a model crossing all their borders at once.

For anyone who had built on the product being repositioned, it landed as a category shift: Vendor risk used to mean "what if they raise the price." In 2026 it means "what if they delete the product.@gthimmes Gemini CLI got about a month's notice.

The counter-position shipped in the same fortnight. Flue 1.0 Beta arrived designed around an open agent harness with zero LLM lock-in@FredKSchott, and an engineer was porting the code review agent we use across all of our OSS repos to Flue as we speak@elithrar on launch day. Whether that promise holds is a next-cycle question; that it is the explicit pitch, in the week Google retired an open CLI for a closed one, is the market talking to itself.

Google started routing Gemini CLI users to a different product. A transition banner, cherry-picked into the stable v0.45.2 release, was made exempt from the usual five-times display cap, so "Antigravity is coming to town" now shows every session it is active. Behind it, a preview build added in-product migration commands and a built-in skill pointing users to "Antigravity CLI," a separate Google agent CLI with its own binary, installer domain, and docs, described in the bundled skill as a "next-generation terminal interface." The marketing is already in stable; the migration tooling is a preview away. Read together, it looks less like a feature than the start of a managed succession for Gemini CLI itself.

OpenAI came at switching costs from the other direction. Codex app 26.608 added Migrate-to-Codex flows for importing supported setup from Claude Code and Claude Cowork, including during onboarding, an on-ramp off Anthropic's coding agents. And Paperclip quietly retired its "zero-human companies" tagline for "the app people use to manage AI agents for work." The new line is backed by the same fortnight's engineering, which added human board visibility, an audited recovery action for stuck agents, and the approval gates above. The autonomous-company dream is being repriced as human-in-the-loop operating software.

The model layer crossed borders. Anthropic launched Claude Fable 5, a "Mythos-class" model, in Claude Code 2.1.170, and within days at least two other harnesses, OpenClaw and Pi, added support, Pi with xhigh reasoning effort. Claude Code also tightened the governance around which models run: an enforceAvailableModels setting and a cluster of fixes that finally make an org's model allowlist binding, even against the default model and env-var overrides, which is exactly the lever an enterprise needs to decide whether a model like Fable 5 is reachable.

Gemini, separately, began moving flash workloads to gemini-3.5-flash in its stable v0.46.0, gated behind an experiment flag and auth-type access logic, so the same binary can route different users to different models. Anyone with cost or eval assumptions pinned to the old flash should re-baseline.

The model moved, and people noticed before the benchmarks did

The fortnight's other event has no CVE and no changelog line worth quoting. On June 9, Fable 5 reached Claude Code, and its maker's assessment was the one you would expect: Fable is the best model I have used for coding, by a wide margin@bcherny. Vendor claims about vendor models are worth exactly what they cost to make.

What followed was not. Over the next week, unprompted and uncoordinated, three practitioners reached for the same shape of description. One found that a few days with Fable is making the subsequent days without it feel like an intelligence blackout@bayeslord. Another put it flatly:

Going back to Opus after a few days with Fable is akin to re-hiring an employee you fired for being stupid.

We ran no evaluation and we are not asserting the model is better. What is observable is the shape of the reaction: a step change registers as how people describe going backwards, and it registered within days.

That speed is the part with operator consequences. A frontier model reached at least two other harnesses inside a week. If your allowlist pins model IDs, it went stale in days; if it does not pin them, your delegated trees changed capability without a release note on your side.

Computer use grows up, and gets metered

Authority showed up as capability governance most visibly in computer use, where Codex pushed real desktop control further into the mainstream and wrapped it in controls at the same time. Codex app 26.609 added Developer mode for the browser, giving the agent "controlled" Chrome DevTools Protocol access. That is a far larger surface than clicking and typing: CDP can read network traffic, run arbitrary JavaScript in the page, and drive the debugger.

The same build added per-app access controls for computer use on Windows and extended computer use to Enterprise users, and on June 16 Codex made computer use available in the EEA, the UK, and Switzerland, putting desktop control in front of a European operator base it had been walled off from. It also previewed Chronicle, an opt-in feature that builds the agent's memory from recent screen context, a new and sensitive data-capture surface to default off on confidential machines.

Agent Zero, the window's other real-computer source, spent its single active day hardening the tunnel that exposes its desktop rather than expanding it. Here the capability and the governance lever arrived in the same release, not a quarter apart.

The humane surface

The week was not only about locking things down. A counter-current kept widening who can reach an agent and on what terms, led by OpenClaw, with Codex and Hermes opening access from other angles. OpenClaw shipped a measured WCAG 2.1 AA pass on its browser dashboard: muted text lifted above the 4.5-to-1 contrast floor it had been failing in dark mode, a real keyboard focus ring, and a 12-pixel font floor across 136 elements that had been smaller. An agent harness treating legibility for low-vision and keyboard-only users as real engineering, not a someday, is the kind of thing this field does too rarely to pass over. The catch is the channel: it is a beta build, not yet stable.

OpenClaw also made a sharper, quieter choice on a stable release: it stopped auto-selecting key-free web search providers, trading a bit of zero-config convenience to force an explicit choice about where a user's search queries go. Consent over default, in the same fortnight as the authority work, is the same instinct pointed at the user instead of the agent.

The reach widened in plainer ways too. Codex brought /goal, branch and worktree selection, and inline code review to the iPhone, putting long-horizon work and real code review on the smallest surface there is. Hermes shipped a native desktop app and a browser admin panel, collapsing install-to-first-message to seconds, though the panel is a new authority boundary whose hardening, as above, is still unreleased. Each of these narrows the gap between frontier capability and an ordinary operator, which is the half of the frontier that decides whether any of the authority work above ever gets used.

Security advisories: know what your build contains

The window's security work splits into what to patch now and, more awkwardly, what is not yet in a binary you can run. Several of the sharpest fixes sit on a default branch, not in a tagged release. The difference is the difference between being protected and believing you are.

OpenHands: two frontend CVEs and a plaintext-credentials-at-rest fix, on two different channels. OpenHands closed CVE-2026-42342 in react-router, which shipped in release 1.8.0 (uncredited, under "Many UI bug fixes"). The moderate XSS CVE-2026-41305 in postcss is on main and unreleased. So is the sharper item, which carries no CVE: a PluginSpec.source containing an embedded git token (https://oauth2:token@...) was being persisted to the database in plaintext because the conversation object was serialized whole. New writes are redacted; rotate any token that was embedded in a repo URL before the fix lands in your build.

Gemini CLI: three path-traversal holes in skill installation, fix on main only. A malicious or corrupted skill package could write outside the .gemini/skills directory or, through a metadata-driven uninstall fallback, delete sibling directories. The fix replaces fragile prefix checks with proper traversal validation. It is the clearest confirmation this window that agent skill packages are an untrusted-input boundary, and as of June 16 it is in no tagged release, stable or preview. Treat third-party skill installs as untrusted until the carrying version ships.

Hermes Agent: a fail-closed wave the release binary does not have. Hermes v0.16.0 (June 6) is a major release, but the security wave that fixes its own guardrail gaps landed on main a week later. Besides the cp-into-.ssh fix above, June 13 commits stop an unauthenticated /api/status endpoint from leaking host paths and the gateway PID on network-exposed binds, and make own-policy chat adapters (WhatsApp, WeCom and others) fail closed when enabled without an allowlist instead of trusting the entire external network, which the project's own security policy already forbade. The v0.16.0 release does not protect you. Run main or wait for the next tag.

Paperclip: a multi-tenant privilege escalation, fixed but unreleased. In Paperclip's cloud_tenant auth mode, every tenant on a shared pool was silently granted instance-admin. Any paying customer was an administrator of the whole instance, with reach into every other tenant's data. The fix removes the grant and purges stale admin rows at the auth boundary; a companion change gives each company its own derived JWT signing key and cuts the token lifetime from 48 hours to one. Both are merged to Paperclip's master branch, not a tagged release. Shared-pool operators should provision a separate non-cloud-tenant admin identity before upgrading, because the purge is destructive by design.

Claude Code: trust-boundary fixes. Upgrading past 2.1.172 closes two of them: untrusted project settings could set OTEL client-certificate paths without a trust prompt (2.1.169), and pre-warmed background workers could read another directory's .mcp.json approvals and trust state (2.1.172). A separate line of work, in 2.1.175 and 2.1.176, made org model allowlists actually binding, which matters more this week than usual and is covered below.

Provider notes

Claude Code (2.1.163-2.1.178) was the most active and most authority-focused provider of the window: the Tool(param:value) permission grammar, nested subagent spawning behind an auto-mode spawn gate, SendMessage authority hardening, and a binding enforceAvailableModels allowlist. Authority as the product, not a setting.

Gemini CLI (v0.45.2-v0.48.0-nightly) is the Antigravity story: an uncapped transition banner in stable, migration commands in preview, both steering users toward a separate successor CLI. The skill path-traversal fix stayed main-only.

Paperclip (v2026.609.0 plus post-release master) shipped Company Artifacts and structured approvals in the release, then put the whole multi-tenant authority cluster -- cloud-tenant deprivileging, per-company JWT keys, approval atomicity, plugin isolation, log redaction -- on master, unreleased.

OpenHands (1.8.0 plus heavy main activity) became a multi-tenant platform on main while 1.8.0 mostly consolidated May's work. Same split, same direction: the enterprise cluster is later.

Hermes Agent (v0.16.0 plus post-release main) tagged "The Surface Release" -- desktop app, browser admin, remote-gateway connect -- and then landed the fail-closed security wave, skill memory-poisoning and recursive-delete fixes on main behind it.

Codex (CLI 0.137.0-0.140.0, app 26.602-26.609, iOS 1.2026.153) pushed computer use outward (CDP developer mode, Windows per-app controls, three new regions) and added listable, revocable remote-control grants -- a grant you can see and withdraw, which is rarer than it should be.

Pi coding agent (v0.78.1-v0.79.5) added the project-trust system and two billing-accuracy fixes. OpenClaw (v2026.6.5-v2026.6.8) is the accessibility headliner, with a WCAG 2.1 AA pass and plain-language mobile provider states alongside fail-closed exec approvals. Agent Zero (v1.20) spent one active maintenance day on CSRF and WebSocket-origin hardening and expanded no capability.

Flue (Tier 2; 0.10.0-1.0.0-beta.1) reached its 1.0 beta with durable, recoverable execution against a built-in SQLite store -- and swapped WebSocket and SSE for a proprietary Durable Streams transport, narrowing how easily run events can be consumed from outside the SDK.

Who is left to answer

The fortnight's authority work was not about whether an agent may act. Every one of these systems already lets it act. The work was about who is left to answer when it asks.

Nine of ten providers spent the window narrowing that list, and the direction is consistent: fewer questions reach a person, more are settled by a rule, and an increasing number are settled by a classifier reading intent. Each step is defensible on its own and the sequence has a destination.

Depth is what forced it. An agent that spawns agents four layers down cannot stop at every layer to ask, so somebody has to decide in advance. This fortnight, that somebody stopped being you.