Foreground Attention Is No Longer the Control

Claude Code 2.1.198 changed what “background” means. Subagents now run in the background by default. When a background agent launched from claude agents finishes code work in a worktree, the release says it commits, pushes and opens a draft pull request instead of stopping to ask. The work reaches the repository whether or not anyone is watching the terminal.

It was not one vendor’s idea. On July 2 the Antigravity CLI’s author listed his month’s work, live status for background subagents, a /tasks panel that streams logs, a /goal that runs until the work is done, and signed off with Kick off the work, keep coding.@shengzheyao The changelog backs the status indicator and the retries; the versions carrying them had no public tag when the window closed.

That is a real throughput gain, and the people building it said so. Claude Code’s creator, expanding Artifacts to Pro and Max, wrote Artifacts in Claude Code have been life changing.@bcherny

The replies to that post showed what the gain is pushing against. One operator had wired Routines to push to Artifacts:

Autonomy that stops to ask is not the autonomy that was announced, and the pressure always runs toward removing the asking. 2.1.198 removed it. In a shared repository, the boundary now lives in push permissions, branch protection, notifications and pull-request review. If those were designed for an agent that stopped before publishing, the assumption under them just changed.

The decision moved downstream

Removing an interruption does not remove the decision it carried. It moves the decision to wherever the work lands. Before enabling 2.1.198 across a shared repository, an operator should decide which branches a background agent may push, which checks a draft pull request must pass, and which events deserve an immediate notification.

The same release note draws one line itself: subagents treat messages from the launching agent as task direction, never as user approval. The agent that delegates cannot grant the permission. That is a good default, and it only covers what happens between agents. What happens at the remote is the repository’s business.

The attention gain depends on that replacement. A draft pull request with mechanical checks batches review around a complete unit of work. An unrestricted push followed by an unfiltered notification stream trades one interruption queue for another.

Not everyone handed the decision to policy. Hermes’ lead lets the agent do the reviewing, and keeps the merge:

That is the strongest reading against this issue’s title. His attention did stop being spent in the foreground, and it did not disappear. It moved to one deliberate gate, the merge, where a person still reads what the agent wrote.

Operators had their own answer to prompt fatigue, and it was not branch policy. One developer described launching claude --dangerously-skip-permissions on projects he trusts: No more approving every edit or command.@isacciobota He bounds it to code he owns and understands. That bound is the control now, and it lives in his head rather than in the repository.

The trust boundary did not vanish for those who bypass it. Theo runs Claude Code with bypass on by default and reported that If I use it in a directory I haven't trusted, it works fine...until I try to "/remote-control", "--worktree" etc.@theo What he asked for was a /trust-directory command: not more prompts, but a way to set the old boundary on purpose.

Where a security fix actually lands

The window’s three security changes each landed in a different place, and the place decides what an operator does next.

Hermes put it in a tag. v2026.7.1, which Nous named “The Judgment Release”, carries the security work that was still on main in the last issue: MCP-configuration persistence hardening, a block on cron base_url credential exfiltration, prefix-secret sentinels for file reads, Slack xapp- token redaction, browser cloud-metadata guardrails, and resume and session scoping. Operators on v2026.6.19 no longer need to watch commits and guess when the wave became runnable. They can upgrade.

Codex put it in the logger. rust-v0.142.5 stopped writing full Responses WebSocket request payloads to trace logs. The fix changes future logging. The release note does not claim to erase traces already retained or shipped to a central store, so upgrade, then restrict or purge the old ones. The permission decision did not end when the agent ran. It followed the payload into the log store.

Gemini CLI put it in a nightly. v0.51.0-nightly.20260702.gff00dacd9 blocks a symbolic-link directory escape in the memory-import processor. Stable did not have it when the window closed. Avoid untrusted GEMINI.md imports, or take the nightly and its wider change surface on purpose.

Boring, on purpose

OpenClaw announced v2026.6.11, released the day before this window opened, as a fix for misplaced replies, stuck sends, failed reconnects and model setup failures, with the least promotional sentence any vendor wrote this month: Beware, this release is boring.@openclaw Boring is the correct ambition for the layer everyone else builds on.

Its app layer showed the new loop in miniature. Peter Steinberger pointed Codex at public feedback on the OpenClaw iOS app and got a first redesign pass, merged as #98452 on July 1. His own verdict: It's still not good, but for two prompts it aint bad.@steipete A volunteer maintainer who built much of that UI answered the criticism under his own name, and asked for specifics: Have a dialog with me tell me it’s bad and how to make it better.@colinsolvely The agent drafted the fix. Whether the app is good is still being decided by people, in public.

The harness itself also started to look like a variable. Armin Ronacher, running the same model through Pi and Codex on the same problems, reported that pi routinely finishes faster and in fewer tokens for similar results@mitsuhiko That is one practitioner’s experience, not a benchmark, and he frames it that way. If it holds, the harness sets part of the token bill, and choosing one is an engineering decision with a number attached.

Provider notes

Agent Flywheel. New to the watchlist: an installer that sets up Claude Code, Codex and Antigravity on a VPS. Read at its v0.7.0 tag (26 June, before this window), its vibe mode writes a passwordless sudo rule, and both modes install shell aliases that launch each agent with its bypass flag. Safe mode does not remove a sudo rule an earlier vibe run left behind. It is the trusted-projects habit above, packaged as a default.

Codex. The 0.143 line is still alpha; stable is rust-v0.142.5.

Pi, heypi. No material change.

Put control where the work lands

Claude Code moved attention from foreground supervision to repository policy. Hermes turned commit watching into a routine upgrade. Codex moved part of the security review into log retention. Gemini made the release channel part of the file-trust decision.

The common mistake is keeping the old control after the work has moved past it. Watching a terminal does not govern an agent that can push. Reading a merged fix does not protect a stable binary. Upgrading a logger does not clean its old copies.

Put policy where the work lands. Then check that the release you run carries it.