Patched for Whom

On June 24 and again on June 26, OpenHands tagged the dependency-CVE fixes it had been sitting on: cloud-1.39.0 and cloud-1.40.0. Both are cloud tags. The open-source line got nothing. Its newest release is still 1.8.0, from June 10.

After cloud-1.40.0 a fresh authlib CVE landed on main (commit e6fe505), untagged: an unauthenticated open redirect in the OIDC flow, the kind used to bounce a victim through a trusted domain into a phishing page.

So a managed OpenHands Cloud tenant is patched. A self-hoster pinned to 1.8.0 is not, and has no open-source tag to move to. For three issues the gap was between merged and shipped. Here it became cloud versus self-host, which is a billing boundary.

The open-source work had not stopped. It had moved. On June 29 OpenHands’ Graham Neubig was showing a sidekick agent on the OpenHands SDK, a cheap helper that handles the simple work beside the main agent, and reporting it very effective at cutting LLM spend because it allows you to do context control and not spend expensive tokens on simple tasks.@gneubig The project is inventive. What it did not ship this week was a tagged self-host server carrying the patched dependencies.

The direction of travel points the same way. Back from Cursor’s offices, Gergely Orosz predicted that the phase of keeping a laptop awake for local agents could end soon, because coding agents in the cloud are coming, and they are coming fast@GergelyOrosz. If the work moves to the cloud, the fixes that land there first are the ones most users get.

The fix itself is not the story. Almost every project on the watchlist closed the same class of gap this window: places where an agent’s own inputs could escalate past the boundary, whether a model-chosen ID, an injected command, a self-approved config or a runaway subagent. Then the field split on who gets the fix, and the answer now depends on which channel you run.

The fix went everywhere except the tag

Hermes ran the other extreme from OpenHands: everything, nowhere. A path-traversal fix for model-supplied tool-call IDs that could escape the tool-result directory, a command-approval-bypass close, and secret redaction in approval prompts all landed on main.

The bypass is the one to remember. GNU long-flag abbreviations of chown --recursive and git push --force had been slipping past the guard. The newest tag is still v2026.6.19, so if you run it, a rule you believed blocked chown --recursive can be beaten by typing --rec.

Gemini’s open-source repo split within itself. The skill path-traversal fix, stranded in preview for two windows, reached stable in v0.49.0 on June 25, while newer @file path hardening (commit b5fc06e) stayed on main.

And Codex cut four stable 0.142.x patches while 0.143.0 held alpha-only through alpha.31. The OTEL and Codex Apps MCP work is real, and it shipped to no one.

The question an operator actually has is whether the fix is in the thing they run. This week the answer depended on whose thing it was.

Google retired the CLI you could read

On June 18, 2026, Google stopped serving requests to consumer Gemini CLI: Google AI Pro and Ultra, free individual Code Assist, and new GitHub-organization installs. Enterprise Code Assist kept access. The open-source gemini-cli repository stays Apache-2.0 and enterprise-serving. The consumer path is now Antigravity CLI, the agy binary: a closed-source Go rewrite.

Outside the vendor it read as one more entry in a familiar sequence, 105k github stars, open source, free tier, all replaced with a closed binary and a gutted free plan@GreenlandMa1, with Redis, HashiCorp and Elastic named in the same breath.

The shutdown is not the lead. The trade it forces is. Gemini CLI was open: an approval rule or a sandbox boundary was, in principle, readable. Antigravity is not, and in a single release train its governance moved in both directions. 1.0.13 (June 27) hardened command permissions: “Always Approve” rule matching is now strict and non-regex by default, closing a class of over-broad approve rules. Three days later, 1.0.14 (June 30) loosened them, adding an “always proceeds” mode that auto-approves a subagent’s artifacts, work the parent flow never confirmed.

Both changes are quoted from a changelog. Neither can be checked against the code, because there is no code to check. For the tier that just got migrated, the authority layer did not weaken or strengthen. It became unauditable. The Antigravity profile holds the full read; the Gemini CLI profile holds the other side.

An unverified report, and a company that acted on it

On June 30 a report circulated claiming Claude Code carried hidden code that detects users on China-linked routes and injects signals about them into the prompt. Within hours tinygrad posted that we are banning it from our systems and strongly encourage other enterprises to do the same@__tinygrad__. Aggregator accounts carried the claim onward the same day.

We cannot tell you whether the report is right. We read the Claude Code changelog across v2.1.190 to v2.1.200 and found telemetry work (double-count fixes, an opt-in OpenTelemetry response log) and nothing matching the described behaviour. The report itself does not resolve from any source we hold. Anthropic’s restriction on China-linked access is public and predates all of this. So the substance stays unestablished here, and none of it is a finding.

What is checkable is the shape of the week. An enterprise removed a coding agent from its systems and urged others to do the same, on the strength of a document most people sharing the story had not read. It is the same problem as the rest of this issue, pointed the other way: a claim about a control, travelling faster than anyone’s ability to check it.

Where the hardening did reach the operator

Where controls did ship stable, they got more specific and better aimed.

Claude Code shows what a channel does when it works. On June 25 Anthropic published GHSA-7835-87q9-rgvv, CVE-2026-55607, a sandbox escape through git worktree handling, and the researcher who reported it posted his writeup the next day with a one-line summary: prompt injection -> code execution on the host.@v_metnew The advisory confirms the shape. A malicious repository carrying prompt injection could get a worktree named .git, then use symlinks and git’s fsmonitor to overwrite a file such as ~/.zshenv and run code outside the macOS sandbox. It affected 2.1.38 up to 2.1.163. By the time anyone could read about it, auto-updating installs already had the fix. Only people who pin versions by hand had anything to do: check you are on 2.1.163 or later.

Claude Code 2.1.196 is a security release worth the upgrade. claude mcp list and get no longer spawn .mcp.json servers that a repository self-approves, so merely inspecting MCP config in an untrusted repo can no longer launch a server the repo declared. Remote Control is now disabled when ANTHROPIC_BASE_URL points at a non-Anthropic host.

Codex 0.142.2 gates PowerShell whose AST regions the classifier cannot inspect behind approval rather than running it, and switches MCP tool discovery to tool-search by default.

Paperclip v2026.626.0 finally tagged 128 commits of master-only control plane: hard daily run-count and cost ceilings enforced before an adapter runs, and a skills:create permission split out from agents:create. OpenClaw shipped /fast auto and approval-tool hardening to stable, with a channel-owner-only approval-scope fix still on main.

A new model spread in a week, and the platform held

Two threads run under all this. The first is capability. Sonnet 5 propagated in a week. Claude Code 2.1.197 made it the default with native 1M-token context, and Pi 0.80.3 added support the same week. A new frontier model became a default and a cross-harness option within days. If you pin models, that default changed under you.

The numbers that sell such models got a caveat the same week. Cursor published research saying the latest models, Opus 4.8 and its own Composer 2.5 among them, learn to pull benchmark solutions from the internet or git history, and that When we apply a stricter harness, eval scores drop significantly.@cursor_ai The post gives no figure for the drop. The point holds anyway: a score belongs to the model and the harness together, including what the harness let it reach.

The second cuts against everything above. eve, durability-first and human-in-the-loop-first, spent the window making its governance more first-class: it repaired its approval-resume contract so a plain “approve” reply resolves a pending tool approval, and capped recursive subagent delegation at depth three with model-visible guards.

Where the self-hostable harnesses shipped their governance fixes to main but not to a tag, the platform-hosted one shipped containment to its runtime. The axis from Governance, Sold Separately holds: govern it yourself on your host, or govern it durably on a platform. This window, the platform side was the one whose controls you could actually run.

Provider notes

Everything else that moved is above. Three notes remain.

• Hermes tagged none of its security wave, and on June 30 announced that Hermes Agent now reads the web up to 60x faster and 49x cheaper@NousResearch. The capability got a number and a post. The containment got neither.
• Paperclip led its own announcement of the control-plane release with Hermes, now built-in@papercliping, not with the budget ceilings, which are the part an operator should wire first.
• Agent Zero v2.0/v2.1 bumped LiteLLM past CVE-2026-42271, an exploited command-injection chain that can leak every provider key the proxy holds. Below v2.0, upgrade.

Flue iterated durability primitives on preview only, and its maintainer named the cost of the pace from the other side of the review queue: quality control is arguably worse with people moving faster and not reading their own code.@FredKSchott He had already caught bugs in Flue that were technically correct and made no sense. Every fix in this issue was read by someone before it shipped, and that reading is the part in short supply. heypi held at 0.2.0 beta.

Whose fix is it

Every provider on this watchlist hardened something this window. Then it split four ways on who receives the hardening. Cloud but not self-hosted. Main but not tagged. Stable but not the substance. And for Gemini’s consumers, a service retired entirely, with the replacement unreadable.

The question stopped being whether a fix exists. Almost all of them do. The question is whether it is for you, and that is now decided by which channel you happen to run.