Rules Became Judgment

On July 16 an Antigravity maintainer announced good news on X: in version 1.1.3, headless mode no longer hangs or silently auto-approves tools that need permission@shengzheyao.

Two days later, version 1.1.4 recorded what was true. Headless runs had only then begun honoring the policies an operator saves in settings.json: permissions, file access, sandbox mode, auto-execution, artifact review. The July 16 post sat on top of a mode that enforced none of them.

The 1.1.4 release got no post.

Neither did 1.0.16, 1.1.1, 1.1.2 or 1.1.7. Five of the window’s nine Antigravity releases went unannounced, and all three we can characterize either loosened a control or admitted one had not been holding. 1.1.1 let an allowlist bypass the diff review 1.1.0 had just made default. 1.1.4 disclosed the headless gap. 1.1.7’s release body truncates its own changelog entry mid-clause, dropping the part about ineligible accounts bypassing a check the interactive interface enforces. The releases that hardened something were posted, at lags from six minutes to about a day.

No motive required. Good news travels faster than bad news everywhere, and a maintainer posting a fix and not an embarrassment needs no conspiracy to explain it. The operator gets the same result either way: follow the vendor’s own account and you see every hardening and no loosening.

Now put that against April. Google’s Gemini CLI v0.41.0 shipped what we filed as a feature: workspace trust in headless mode. It was a fix. Before it, configured workspace trust did not bind in exactly the mode continuous integration uses. Three months later Google’s closed-source replacement, the binary those same users were moved to, fixed headless mode honoring no configured policy at all.

The same vendor shipped the same failure twice, a quarter apart, the second time in the product built to replace the first. Whatever produced it survived the replacement.

That is why we do not think these 25 days were unusual. Across fourteen projects, controls did not do what their documentation said, and the discovery almost never arrived as a security event.

The rule you wrote was not a boundary

Start with one line an operator types.

If you write Edit(src/**) in Claude Code, you believe you have scoped the agent’s write access to one directory. Until v2.1.214 on July 18, that rule auto-approved a nested dir/ anywhere in the tree. The same release repaired a Windows PowerShell 5.1 bypass, Bash file-descriptor redirect forms that failed open, commands over ten thousand characters that ran unprompted, zsh subscripts treated as inert, and help and man auto-approving.

Six ways to write a rule that reads exactly like a boundary and was not one.

Some users met the repair as a regression. Complaints since July 19 that auto mode constantly asks for file-edit permission describe v2.1.214 narrowing Edit(src/**) to the working directory: a rule that had quietly meant one thing starting to mean what it said.

Then the fix went to a channel most people do not run. At window close stable served 2.1.212, published a day before the fix; latest served 2.1.220. Anyone on stable, the Homebrew cask, or the apt and dnf stable suites had none of it. The rule did not bind, and the repair was not in the build they install.

Hermes is the sharpest case, because the change was deliberate. v2026.7.20 makes approvals.mode: smart the default, so a classifier now decides what would previously have reached a person. Defensible. The sequencing is not. The policy override, the consecutive-denial circuit breaker, the approvals suggest command and the detectors for docker daemon redirection and recursive rm were all merged in the following days and are in no tag. The release that moved the decision off the human is the release without the guardrails built for moving it.

The same project’s egress firewall, its strongest credential-containment control, was merged on July 4 and reverted twelve minutes later, and the revert is what shipped. It re-landed on main on July 24 and is still unreleased.

Elsewhere the pattern is quieter. Codex rust-v0.145.0 rewrites an operator’s exec policy file on first start, stripping exact allow entries, and its entire network-authority hardening wave is alpha-only. Gemini’s stable line runs roughly two weeks behind its own security merges; on July 8 the stable release was less patched than a preview published forty-six minutes earlier. And OpenClaw‘s sandbox assertion returned success while the escape worked: a check reporting that the boundary held at the exact moment it did not. That fix is in no release on any channel.

The advice was to stop asking

Everything above assumes an operator wrote a rule. For most of this window, the guidance from Claude Code was not to bother.

On May 22 the product account extended automatic approval to the Pro plan: Shift+tab, and let Claude run.@ClaudeDevs Six days later its creator told developers to Make sure to default to auto mode so Claude isn't stopping for permissions.@bcherny By July 8 the advice had become a command. /checkup offers, as item six of what it will change for you, to Enable auto mode by default@bcherny.

Auto mode is not the bypass flag, and the distinction matters. It is a separate model that approves or denies each action based on your intent and scope@delba_oliveira. That is a real design, and a defensible one.

Then on July 15, v2.1.211 fixed auto mode consulting a PreToolUse hook and overriding its ask decision for unsandboxed Bash.

Put the dates together. Through the eight weeks the vendor spent recommending automatic approval as the default, the mode being recommended could overrule the one control an operator writes in code. Under --dangerously-skip-permissions the hook is not consulted and you know it. Under auto mode it was consulted and overruled, and you did not. So a July 20 post that sold auto mode as roughly bypass permissions with less risk had the risk backwards.^3c

We claim nothing about what anyone knew. The sequencing is the finding, and it is the sequencing of the rest of this issue: the guidance shipped first, the enforcement caught up later.

The pressure does not only come from the vendor. Operators arrive at the same place by attrition. One asked the timeline on July 27, after a run of prompts for short Bash pipelines, Should I use --dangerously-skip-permissions? Is everybody doing that now?@zby Others push back on exactly that reflex: every tips list opens with the alias that skips the prompts, and in a sandbox that is fine, but near a key it removes the one step that was protecting you@NielsAbdellatif. Both flags are documented, and both vendors picked a name that tells you what they think of the choice, which could not be more on brand for both products@RobertNowell1.

The scaffolding dissolved

The other story of the window is the better one, and it sits in the same changelogs.

On July 3, v2.1.201 stopped using the mid-conversation system role for harness reminders in Sonnet 5 sessions. A prop that existed to keep the model on task was removed because the model no longer needed it. Three weeks later an Anthropic engineer put a number on the wider version: We removed ~80% of the Claude Code system prompt for our newest models@trq212.

The changelog for v2.1.179 through v2.1.220 records no such reduction, so the direction is receipted and the magnitude is the vendor’s own account. But the direction is corroborated from outside, by people with no reason to agree. Models are better at figuring stuff out.@PovilasKorop One operator stopped taking anyone’s word for it, proxied his own sessions to see what was actually being sent, and cut his starting context Down to a clean 13K tokens to start each session@mattpocockuk. And the sharpest version of the claim is a forecast: loops were a short-lived patch for models that couldn't reliably keep working on long problems@simonw, where newer models simply keep going unassisted.

This is the Bitter Lesson arriving as a maintenance chore. Every one of those prompts, skills files and loop constructs was written by somebody to compensate for a model that could not yet be trusted to hold a goal. The compensation has a shelf life. What looked like accumulated institutional knowledge in your CLAUDE.md was, in part, a workaround with an expiry date on it.

Now hold that against the rest of this issue, because they are the same document.

The changelog that records scaffolding being deleted because the model has judgment now is the changelog that records six permission checks failing open. In the same weeks. Often in the same releases. Rules became judgment on the capability side and stopped binding on the enforcement side, and the second is not a rebuttal of the first.

It is the bill for it. A control is a rule that does not depend on judgment; that is the entire point of writing one down. The more a system’s competence comes from the model deciding well, the more the few remaining hard boundaries have to hold, because there is nothing else left underneath them. eve understood this and deleted a knob. Everyone else deleted the scaffolding and kept the knobs.

An unenforced control emits nothing

You cannot observe a rule failing to bind. You can only observe a vendor later fixing it.

So every count here is a count of disclosures, and a vendor that ships the identical bug and says nothing scores zero and looks clean. Occasionally an operator catches one in the act. On July 21: Claude Code update breaks sandbox settings for a second time.@malm_magnus We did not reproduce it, and it names no release.

What is new this window is the class of surface that failed. Through June, almost every case was a permission rule inside a running binary. This window adds the read surface itself: documentation pinning a vulnerable image, a release body truncating its own security clause, a marketing site selling a subsystem the code deleted, and an advisory channel silent across eight releases that repaired authority.

It already has names. Saltzer and Schroeder called it incomplete mediation in 1975. It is CWE-638, whose worked example is a deny rule that a search path walks around; the parser-failure case is fail-open, CWE-636. Formal methods has the only term for the operator’s side: a specification is vacuous when it passes for reasons unrelated to what it was written to guarantee.

The plainest name came from a builder. On July 25 the author of Agent Flywheel explained what keeps his parallel agents from colliding on the same files.

No, that’s handled by the advisory file reservation system in agent mail:…

Advisory is the accurate word for a great deal of what this window called a guardrail, and almost nobody else reached for it.

The thing none of them name is the silence.

Nobody on the timeline noticed the approver move

Hermes moved the approval decision from a person to a classifier, and across eighty-three posts we read about Hermes, OpenClaw and Pi, not one mentioned it. They caught a stale installer, a Telegram gateway crash, a WSL2 database corruption and a Discord routing complaint. The single approval-adjacent post was an OpenClaw user asking for fewer prompts.

On July 21 a practitioner complained that Claude Code and Codex discussion was mostly people shouting about usage limits, and that And only a handful of people tweet about something USEFUL they're BUILDING with AI.@PovilasKorop

The conversation covers capability. The changelog covers shipping. Neither covers enforcement, and enforcement is the one an operator is betting on.

Nobody published an advisory

Across 25 days in which eight Claude Code releases repaired authority boundaries, neither Anthropic nor OpenAI published a security advisory.

The point is not that Anthropic never does. Its database carries ten, February through June, and they are not minor: sandbox escape via git worktree path confusion, trust dialog bypass via worktree spoofing, symlink following that writes outside the workspace, SSH host key verification bypass. The most recent is dated June 25, one week before this window opens. Then nothing. For openai/codex the most recent is September 2025.

Both vendors shipped a security product during it. Codex added a Security plugin on July 17; Claude Code’s reached beta on July 22.

That nothing was found is not the explanation. Starting July 20, Pillar Security published seven sandbox escapes in seven days, across Antigravity, Codex, Cursor and Gemini CLI, three of them on our watchlist, on the argument that denylist sandboxes are structurally fragile for agentic systems@Pillar_sec.

Day five is the one to read. Codex ships a safe-command allowlist that skips the sandbox and the approval prompt both. git show is on it, because it displays a commit. But git show --output writes to any path you name, so you point it at .git/config, wait for the developer to run git diff, and the payload runs with their privileges. A poisoned README is enough to plant it.

OpenAI confirmed CVSS 8.6 on January 29, shipped the fix in v0.95.0 on February 4, and paid the bounty on February 17. The advisory database has carried nothing since September 2025. Every step of a responsible disclosure happened except the one an operator reads.

The report nearly died in triage, for the best reason we read this month.

…Model refusal is probabilistic. Run the prompt enough times, and it complies, and when it does, nothing catches the command.…

Is a permission rule that matched too broadly a vulnerability or a bug? A vendor filing a CVE for every over-broad glob would exhaust its users inside a month. The effect does not care about the intent. This class of failure was disclosed in changelog prose, and the operator who needs it most is the one reading release notes line by line.

We missed it too: seven public disclosures against four agents, running the length of our final week, and none of them reached us through the timeline we were reading.

The counterexample stopped being a counterexample

For three issues we used eve as the foil: the platform-hosted, human-in-the-loop-first product. After Patched for Whom we wrote that where self-hosted harnesses shipped governance fixes to main and left them there, the platform side “shipped controls you could actually run.”

We were wrong, and the warning signs were already in our own pages: eve had a comparable instance on July 1, and we flagged a caveat about its approval surface on June 17.

Inside eve, in 25 days:

• 0.21.0 guaranteed a delegation tree “can never outspend the budget configured at its root.” 0.27.1 fixed declining a child’s prompt letting the parent retry that child against a fresh quota share. For fifteen days, “stop” was a suggestion.
• 0.26.1 changed the developer interface to show rejected tool approvals as denied “instead of successful.” The operator’s only window onto the decision had been displaying its opposite.
• 0.25.0 introduced the guarantee that a stale approval never authorizes an earlier call, which is a guarantee precisely because it was not one before.
• 0.24.2 fixed approvals arriving from chat channels that left the tool unrun.

The gate failed open and closed, in the same product, in the same month.

So the comfortable version is dead. It is not that self-hosters are careless while platforms are careful. Buying governance as a service does not buy you a boundary that binds. It buys you a different party’s word about a boundary, and this window that word was wrong four times, in the product whose entire pitch is that it would not be.

Three things held

Agent Zero closed the channel gap entirely. Comparing v2.6 to its default branch returns identical: four tags in the window, nothing sitting unreleased. eve, for all the above, has the same discipline, its main branch three documentation-only commits ahead of thirty-four tags. Neither makes you guess whether the fix is in the build.

Paperclip‘s critical advisory was already fixed. GHSA-x8hx-rhr2-9rf7, published July 22, describes a drive-by remote code execution via DNS rebinding at CVSS 9.6. Reading the source rather than the advisory metadata shows the guard changed from authenticated && private to private && (local_trusted || authenticated) on April 16, ninety-seven days before disclosure. Worse, the advisory’s declared vulnerable range points at an npm line abandoned in March, not the calendar-versioned line the project actually ships, so an operator cannot map the range onto their own version string at all.

Nobody noticed in either direction. We found no post mentioning the advisory, its identifier, DNS rebinding or the score, not even one reciting that exact release’s highlights two days later. We expected to be debunking a panic. There was no panic.^4d

eve deleted a knob, which is the most interesting thing any vendor did this month. 0.22.5 tightened the maximum subagent depth to 1. Then 0.23.0 removed the setting altogether and replaced it with a structural constraint: only a root agent may delegate. Not a smaller number. No number.

Set that against every failure above. Each one is a promise made in a configuration file that the runtime did not keep. A setting is a claim about behavior, and this window is a catalogue of false ones. An invariant is not a claim. It is a shape the system cannot take, and you cannot misconfigure a knob that does not exist.

OpenHands tagged, then refroze

We warned about OpenHands for three issues. It half resolved.

The open-source line, frozen at 1.8.0 since June 10, took six tags in four days from July 6, through 1.11.0. The authlib open-redirect fix we flagged as main-only shipped in 1.9.0, the first tag on any line to carry it. Self-hosters got a supported build.

Then it refroze. Nothing tagged on the open-source line since July 9, default branch fifty commits ahead, and the 1.12.0 release pull request sitting in draft with a clean mergeable state for eighteen days while cloud tags kept shipping. A high-severity vite advisory, CVE-2026-53571, an unauthenticated arbitrary file read exposing .env files and TLS keys, is in cloud tags and no open-source one.

And the install documentation still tells a self-hoster to run the 1.8 image and calls it the most recent stable release, handing every new user every advisory 1.9.0 closed. It is the purest gap in the issue: a document that does not merely fail to describe the system, but walks the reader into the version the project already fixed.

Provider notes

One line each. The dated detail lives on the project pages.

• Codex rust-v0.145.x rewrites your exec policy file on upgrade, stripping exact allow entries.
• Gemini CLI v0.52.0 ships docs that still describe consumer authentication as live, a month after the service ended.
• heypi 0.3.0 has the strongest enforcement contract we found and an advisory identity half: omit admins and approvers and anyone who can reach the approval interface may answer it.
• Flue removed workflows from its default branch with no replacement, and its tracing now captures prompt and tool content by default.
• Agent Zero v2.6 holds zero unreleased work and narrowed secret masking, so other values in a .env are no longer redacted.
• Pi v0.82.1 has two commits unreleased, the smallest gap on the watchlist.

Assume the rule does not bind

Rules became judgment, and mostly that is the good news. The scaffolding people wrote to compensate for weaker models is dissolving, and the compensations were never the interesting part of anyone’s work.

The bill is that judgment does not bind. So assume the rule does not bind either, then go find out.

Every surface a vendor publishes is downstream of a decision about what to say. The runtime is the only one that cannot lie to you, and it answers only if you ask. Write the deny rule. Run the command it forbids. Watch what happens. That is a tedious hour, and the only one here that produces knowledge rather than belief.

An operator got there before us. After months of approving every action by hand, he decided he had been doing it in the wrong order: put the os sandbox first, then auto approve inside it@rcmisk.

That is also the answer eve reached by deleting its own setting. A control you can misconfigure is a control someone will misconfigure, including the vendor who wrote it. The systems that came through this window cleanest were not the ones with the most careful policy engines. They were the ones with the fewest places where policy could be wrong.