Protected on Paper

Claude Code 2.1.178 shipped a five-level cap on nested subagents. It did not apply to foreground spawns. Until 2.1.181, a foreground subagent could spawn unbounded nested chains, and the fix says so in one line: they “now respect the same 5-level depth limit as background subagents.”

The same window disclosed a second one. The Agent(type) deny rules and Agent(x,y) allowed-type lists, written in the argument-aware permission grammar that shipped last window, were not enforced for named subagent spawns until 2.1.186. An operator who wrote either rule the day it was announced was protected by a sentence in the docs.

That is one of three places a control can live without being on your machine. It can be written down and not enforced. It can be merged to a branch you do not run. Or it can sit one release newer than yours. This window found protections in all three.

A rule binds when something refuses

Credit where it is due: Claude Code disclosed both gaps in its own changelog. The fixes are the good news. The lesson travels past Claude Code: a permission feature is not a permission boundary until something refuses the disallowed action, and the only way to know is to test it.

The same release train tightened what did bind. 2.1.183 lists the destructive commands the auto-mode classifier refuses unless the operator asked to discard the work, git reset --hard, git clean -fd and terraform destroy among them, and fixes scheduled-task and webhook triggers whose inputs could slip an action past classification. Then 2.1.187 Added sandbox.credentials to stop sandboxed commands reading credentials and secret env vars@ClaudeCodeLog, and made remote MCP calls abort after five minutes instead of hanging. A sandbox that could read the secrets of the environment it sandboxed was not much of a sandbox.

Codex shipped the cleanest example of the shape. CLI 0.142.0 made command and network approvals environment-scoped: an approval granted in one execution environment no longer carries to another, Codex “denies when active-call attribution is ambiguous”, and it fails closed if an environment’s proxy cannot be prepared. The same release lets a rollout token budget abort the turn when it runs out. That is a hard cap on spend, with soft timing: it lands at the next accounting boundary, not mid-call.

Tagged, stable, and failing closed. That is what protection looks like when it arrives.

The fix was merged, and the binary did not have it

Most of the window’s security work never got that far.

OpenHands is still on 1.8.0, from 10 June. Two windows of enterprise and security work sit on main in no tag, including the postcss XSS fix, CVE-2026-41305, and a fix that stops a PluginSpec.source with an embedded git token from being written to the database in plaintext. New writes are redacted; rotate any token that was already embedded in a repo URL.

Gemini CLI left its skill path-traversal fix in v0.48.0-preview.0 for a second week. On stable v0.47.0, a malicious .skill package can still write outside the skills directory. In the same cycle, stable received a built-in antigravity-support skill that hands users a curl ... | bash install of a successor CLI, and the “Antigravity is coming to town” banner lost its five-show cap. A security fix and a growth funnel went through the same release gate. Only one came out the stable side.

Hermes Agent tagged v0.17.0 on 19 June with last window’s fail-closed wave: the cp-into-~/.ssh gate a maintainer had called “theater”, the /api/status host-path leak fix and the fail-closed policy adapters. Two days later a new wave landed on main instead. It rejects MCP entries that write shell payloads into authorized_keys, cron or sudoers, enforces an IOC blocklist at save and spawn time, raises the API-key entropy floor from 8 to 16, and adds a startup audit that warns when a gateway runs as root or serves an unauthenticated API. The commits say it answers an exploitation campaign in the wild. That claim rests on the project’s own narrative, a Reddit thread and a self-named instance; the mechanism and the fixes are verified. Either way, v0.17.0 does not contain it.

Paperclip ran the pattern in reverse. v2026.618.0 (18 June) finally tags last window’s master-only tenant cluster: the instance-admin deprivileging for cloud tenants, every one of whom had been an instance admin on a shared pool; per-company JWT signing keys; plugin tenant isolation; HTTP-log credential redaction; and a review fix for a comment reading “NOT APPROVED” that could auto-complete an issue. Then its newest controls went straight back onto master.

Who the agent is, and what it may spend

The rest of the window’s authority work was about identity and money, and it pulled in both directions.

OpenHands decoupled API-key authentication from Keycloak sessions: “API-key authentication performs zero Keycloak round-trips.” Headless clients stop hitting opaque 401s. The price is a changed revocation contract. Killing a user’s IdP session no longer kills their machine keys, so revocation now happens at the key store. A companion secret enricher injects a user’s linked OAuth token into the sandbox from any conversation start path, and OpenHands moved sandbox images onto a runtime-api control plane that makes per-tenant images possible. The credential now follows the user into whatever runtime they start. All of it is on main.

Hermes came at identity from the other end, with a managed /etc/hermes scope: root-owned, user-immutable config and secrets that win per key over a user’s own files. It is Hermes’s first OS-backed policy pin.

On money, Paperclip’s master adds preflight budget caps that cancel queued work before an adapter starts, and a watchdog whose recovery actors cannot touch approvals. OpenHands went the other way and reverted last window’s per-org concurrency limits outright. Hermes removed the default wall-clock timeout on subagents in the same week it shipped fire-and-forget background fan-out. And OpenClaw stable v2026.6.9 began approving Codex plugins automatically: one gate opened while most of the watchlist was closing them.

Google retired the tool you could read

On 18 June Google moved consumer Gemini CLI users to Antigravity CLI. The product account put it flatly: Gemini CLI has stopped serving requests for Google AI Pro, Google AI Ultra, and free tier individual accounts@geminicli. Enterprise Code Assist and API-key users kept access, and the open-source repository continued. A maintainer called the day End of an era, but the start of something even bigger@ntaylormullen.

The objection that lands is not about the service:

Gemini CLI stops serving free, Pro, and Ultra users today. The replacement, Antigravity CLI, is closed source. The original was Apache 2.0 with over 6,000 community pull requests behind it. Those contributors now get a closed binary they can't inspect or fork. This is the cost of building on tooling one vendor can retire on a schedule. Open source doesn't get sunset out from under you. Kilo is Apache 2.0, the full codebase is on GitHub, and the community keeps it running regardless of any single company's roadmap.

Six thousand community pull requests went into a tool licensed Apache-2.0. What replaced it for consumers cannot be read. This publication’s method depends on checking a claim against the code, so the cost is concrete: for the consumer tier, every governance guarantee from 18 June onward is one you take on trust. The shutdown executed while the path-traversal fix above was still in preview.

The same week put the where-can-I-run-it question to a new framework. Flue’s maintainer, reading Vercel’s eve with evident respect, wrote that eve is vercel-only. You can't deploy it outside of vercel and it requires a full bet on their stack@FredKSchott. An eve engineer answered within minutes: eve is NOT vercel only by design, it uses the same "worlds" adapter approach as Workflow SDK under the hood@jacobmparis, with the adapter held back until a non-Vercel one is ready to publish. Both can be true. Portable by design is a promise; Vercel-only is what shipped.

What became possible

The window was not only gaps.

OpenClaw’s WCAG 2.1 AA pass reached stable v2026.6.8 after a week in beta: dark-mode contrast lifted to 4.5 to 1, real keyboard focus rings, a 12-pixel font floor across 136 elements. A low-vision or keyboard-only operator can now reach the authority surfaces on the default channel. That is the precondition for anyone using the controls the rest of this issue argues about.

Anthropic launched Claude Tag, which puts Claude in Slack channels as a delegate. Its creator marked the launch with a number: 65% of our product team’s new code is created by our internal version of Claude Tag@bcherny. It is a vendor’s claim about its own codebase, with no published method, and still the most specific statement anyone made this window about how much work agents already do. Further down the same thread he described the security model, including that we protect what Claude has access to (websites it can access and it can’t see the credential secrets it uses)@bcherny. That is a vendor’s claim about a product we did not test, and exactly the kind of sentence this issue says to check. The nearest receipt is a different surface: Claude Code’s sandbox.credentials, shipped in the CLI that same day.

At OpenHands, Xingyao Wang started from the bottleneck behind all of it: agents open pull requests in minutes, and on codebases that matter those PRs wait days for a human. His team built a verification stack, and on our own repo, it cut time-to-merge by 58% without lowering code quality@xingyaow_. It is his number, not one we checked, and it is the constructive half of this issue’s argument: a check that runs before the human looks, not a rule that waits in the docs.

Graham Neubig opened a harness-versus-harness evaluation by noting that most benchmarks hold either the model or the harness fixed, when in practice it is the harness + the LLM that determins the overall performance.@gneubig His results: OpenHands generally outperforms Claude Code on both accuracy and cost when using Claude Opus@gneubig, and the ranking flipped when the model changed. If the winning harness depends on the model you point at it, the harness is a setting you tune, not a brand you pick once.

The cost of all this building showed up too. The night heypi 0.2.0 beta shipped, its maintainer wrote Getting close to burnout with my open source projects@hunvreus.

Breaking changes

Paperclip v2026.618.0 purges stale instance-admin rows for cloud tenants. Create a separate admin identity before you upgrade a shared pool.

OpenHands main drops the per-org concurrency columns in migration 124. The 429-based quota some operators were waiting for will not arrive in that form.

Flue 1.0.0-beta.3 removes flue logs in favor of typed SDK run APIs, makes workflow runs private over HTTP unless the workflow exports runs middleware, and rebuilds workflows around Actions.

Provider notes

Claude Code (2.1.179-2.1.187). The most candid provider of the window about its own authority gaps, which is a compliment about the disclosure and not about the gaps.

Codex (CLI 0.141.0-0.142.0). The window’s best-shaped controls, tagged and failing closed. Computer use stays an opt-in macOS research preview, now in more regions.

OpenHands (1.8.0). A second window with its enterprise and security work untagged. The work is substantial; the release is the problem.

Gemini CLI (v0.47.0; v0.48.0-preview.0). Shipped a migration funnel to stable and held a security fix in preview.

Hermes Agent (v0.17.0). Tagged one security wave and started the next on main.

Paperclip (v2026.618.0). The upgrade shared pools were waiting for.

OpenClaw (v2026.6.8-v2026.6.9). Accessibility reached stable, and a gate loosened.

Flue (1.0.0-beta.1-beta.3). A deep rename on the road to 1.0. The run rewrite reached a beta tag before the window closed; no stable carries it.

Pi (v0.79.6-v0.79.10). Compaction events now say why they fired and whether they will retry. No new governance surface.

Agent Zero (v1.20). Nothing on the default branch; the work is on ready.

Three addresses, none of them yours

Nobody lied this window. The permission grammar exists, the depth cap exists, the fixes exist, and an operator running the tagged binary had none of them. The work is being done faster than the release and enforcement plumbing around it can carry it to the machine that runs the agent.

Merged is a place. Shipped is a place. Neither one is your machine.