Patched for Whom

A coding agent is a machine for doing things you did not approve one at a time. The work of the last several months has been building the layer that decides which of those things it may do -- approvals, sandboxes, permission scopes, audit trails. This window that layer thickened almost everywhere at once. Hermes closed a path escape and a command-approval bypass. Claude Code sealed an MCP self-approval hole. Codex now gates PowerShell it cannot inspect. Gemini's open repo landed a path-traversal fix. Paperclip tagged budget caps and split one permission in two. eve capped how deep its subagents may recurse.

The field is converging, independently, on the same class of fix: closing the gaps where an agent's own inputs could escalate past the boundary -- a model-chosen ID, an injected command, a self-approved config, a runaway subagent.

And then it split on who gets the fix. That is the story of the week, and it is sharper than the merged-versus-shipped gap that ran through the last three digests. The gap is no longer just when a fix ships; it is to which channel, and the channel now differs per provider. OpenHands shipped its dependency-CVE batch to its cloud tags and left the open-source line frozen. Hermes put an entire wave on main and tagged none of it; Gemini pushed one patch to stable and held the newer ones back; Codex patched stable and kept its substance in alpha. Same wave, four different answers to the question an operator actually has: is the fix in the thing I run?

The clearest case of the split is not a version number. It is a discontinuation.

Google retired the CLI you could read

On June 18, 2026, Google stopped serving requests to consumer Gemini CLI -- Google AI Pro and Ultra, free individual Code Assist, and new GitHub-organization installs. Enterprise Code Assist kept access. The open-source gemini-cli repository stays Apache-2.0 and enterprise-serving. The consumer path is now Antigravity CLI, the agy binary: a closed-source Go rewrite.

The retirement is tiered: consumer dark, enterprise kept, the open repo shipping on. Outside the vendor it read as one more entry in a familiar sequence -- 105k github stars, open source, free tier, all replaced with a closed binary and a gutted free plan@GreenlandMa1, with Redis, HashiCorp and Elastic named in the same breath.

The lead is the trade it forces, not the shutdown. Gemini CLI was open: an approval rule or a sandbox boundary was, in principle, readable. Antigravity is not. The governance is real, and in a single release train it moved in both directions at once. Version 1.0.13 (June 27) hardened command permissions -- "Always Approve" rule matching is now strict and non-regex by default, closing a class of over-broad approve rules. Three days later, 1.0.14 (June 30) loosened them, adding an "always proceeds" mode that auto-approves a subagent's artifacts -- work the parent flow never confirmed.

Both changes are quoted from a changelog. Neither can be checked against the code, because there is no code to check. For the tier that just got migrated, the authority layer did not weaken or strengthen. It became unauditable. The new Antigravity profile holds the full read; the Gemini CLI profile holds the other side.

The same fix, four channels

The item an operator must act on is OpenHands'. Last window's unreleased dependency-CVE batch reached tags this window -- but only on the cloud channel: cloud-1.39.0 (June 24) and cloud-1.40.0 (June 26). The open-source line got no new tag; the newest non-cloud release is still 1.8.0 from June 10. A fresh authlib CVE -- an unauthenticated open redirect in its OIDC flow, the kind used to bounce a victim through a trusted domain into a phishing page -- already sits on main (commit e6fe505) after cloud-1.40.0, untagged. So a managed OpenHands Cloud tenant is patched; a self-hoster pinned to the 1.8.0 tag is not, and has no fixed OSS tag to move to. Merged-versus-shipped became cloud-versus-self-host: a billing boundary.

Hermes ran the other extreme: everything, nowhere. A path-traversal fix for model-supplied tool-call IDs that could escape the tool-result directory, a command-approval-bypass close, and secret redaction in approval prompts all landed on main. The bypass was the pointed one: GNU long-flag abbreviations of chown --recursive and git push --force had been slipping past the guard. The newest tag is still v2026.6.19, so if you run it, a rule you believed blocked chown --recursive can be beaten by typing --rec.

Gemini's OSS repo split within itself: the skill path-traversal fix, stranded in preview for two windows, reached stable in v0.49.0 (June 25), while newer @file path hardening (commit b5fc06e) stayed on main. And Codex cut four stable 0.142.x patches while 0.143.0 held alpha-only through alpha.31 -- the OTEL and Codex Apps MCP work is real, and it shipped to no one.

An unverified report, and a company that acted on it

On June 30 a report circulated claiming Claude Code carried hidden code that detects users on China-linked routes and injects signals about them into the prompt. Within hours tinygrad posted that we are banning it from our systems and strongly encourage other enterprises to do the same@__tinygrad__. Aggregator accounts carried the claim onward the same day.

We cannot tell you whether the report is right. We read the Claude Code changelog across v2.1.190 to v2.1.200 and found telemetry work -- double-count fixes, an opt-in OpenTelemetry response log -- and nothing matching the described behaviour. The report itself does not resolve from any source we hold. Anthropic's restriction on China-linked access is public and predates all of this. So the substance stays unestablished here, and none of it is a finding.

What is checkable is the shape of the week. An enterprise removed a coding agent from its systems and urged others to do the same, on the strength of a document most people sharing the story had not read. That is the same epistemics this issue spends the rest of its length on, pointed the other way: a claim about a control, travelling faster than anyone's ability to check it.

Where the hardening did reach the operator

The counter-current is that where controls did ship stable, they got more specific and better-aimed.

Claude Code 2.1.196 is a security release worth the upgrade: claude mcp list/get no longer spawn .mcp.json servers that a repository self-approves -- closing a path where merely inspecting MCP config in an untrusted repo could launch a repo-declared server -- and Remote Control is now disabled when ANTHROPIC_BASE_URL points at a non-Anthropic host. Codex 0.142.2 gates PowerShell whose AST regions the classifier cannot inspect behind approval rather than running it, and switches MCP tool discovery to tool-search by default. Paperclip v2026.626.0 finally tagged 128 commits of master-only control plane: hard daily run-count and cost ceilings enforced before an adapter runs, and a skills:create permission split out from agents:create. OpenClaw shipped /fast auto and approval-tool hardening to stable, with a channel-owner-only approval-scope fix still on main.

The quiet story, and the counterexample

Two threads run under all this. The first: Sonnet 5 propagated in a week. Claude Code 2.1.197 made it the default with native 1M-token context, and Pi 0.80.3 added support the same week -- a new frontier model becoming a default and a cross-harness option within days. If you pin models, that default changed under you.

The second cuts against everything above. eve -- durability-first, human-in-the-loop-first -- spent the window making its governance more first-class, not less: it repaired its HITL approval-resume contract so a plain "approve" reply resolves a pending tool approval, and capped recursive subagent delegation at depth three with model-visible guards. Where the self-hostable harnesses shipped their governance fixes to main-but-not-tagged, the platform-hosted one shipped containment to its runtime. The axis from Governance, Sold Separately holds: govern-it-yourself-on-your-host versus govern-it-durably-on-a-platform. This window, the platform side was the one whose controls you could actually run.

Provider notes

One line each. The dated detail lives on the project pages.

• Antigravity CLI 1.0.12-1.0.14 joins the watchlist as the consumer successor: closed-source Go that hardened approve-rule matching in 1.0.13 and added subagent auto-approval in 1.0.14.
• Gemini CLI v0.49.0 shipped the skill path-traversal fix to stable and a breaking coreTools -> tools.core rename, while its consumer service went dark.
• OpenHands cloud-1.40.0 patched the CVE batch on cloud only; the open-source line is frozen at 1.8.0 with a new authlib CVE untagged on main.
• Hermes v2026.6.19 left path-escape, approval-bypass and secret-redaction fixes entirely on main, and announced a web-reading speedup instead: Hermes Agent now reads the web up to 60x faster and 49x cheaper@NousResearch.
• Claude Code 2.1.196 closed the MCP self-approval hole and bound Remote Control to the Anthropic host; 2.1.197 made Sonnet 5 the default.
• Codex 0.142.4 gated uninspectable PowerShell behind approval; 0.143.0 stayed alpha through alpha.31.
• Paperclip v2026.626.0 tagged 128 commits of master-only control plane -- daily run and cost ceilings, a skills:create split -- and led its own announcement with Hermes, now built-in@papercliping.
• Agent Zero v2.0/v2.1 bumped LiteLLM past CVE-2026-42271, an exploited command-injection chain that can leak every provider key the proxy holds. Below v2.0, upgrade.
• OpenClaw v2026.6.11 shipped /fast auto and approval-tool hardening; a permission-boundary fix waits on main.
• eve 0.17.1 repaired HITL approval-resume and capped subagent depth at three. Flue iterated durability primitives on preview. Pi v0.80.3 added Sonnet 5. heypi held at 0.2.0 beta.

Whose fix is it

Every provider on this watchlist hardened something this window. Path escapes, approval bypasses, self-approval, subagent containment -- the field converged, independently, on closing the same class of gap.

Then it split four ways on who receives the hardening. Cloud but not self-hosted. Main but not tagged. Stable but not the substance. Consumer service retired entirely, with the replacement unreadable.

The question stopped being whether a fix exists. Almost all of them do. The question is whether it is for you, and that is now decided by which channel you happen to run.