Rules Became Judgment

On July 16 an Antigravity maintainer announced good news on X: in version 1.1.3, headless mode no longer hangs or silently auto-approves tools that need permission@shengzheyao.

Two days later, version 1.1.4 recorded what was true. Headless runs had only then begun honoring the policies an operator saves in settings.json: permissions, file access, sandbox mode, auto-execution, artifact review. The July 16 post sat on top of a mode that enforced none of them.

The 1.1.4 release got no post.

…Headless (-p) no longer hangs or silently auto-approves tools that need permission. It soft-denies and tells you exactly which allow-rule to add.…

Neither did 1.0.16, 1.1.1, 1.1.2 or 1.1.7. Five of the window's nine Antigravity releases went unannounced, and all three we can characterize either loosened a control or admitted one had not been holding: 1.1.1 let an allowlist bypass the diff review 1.1.0 had just made default; 1.1.4 disclosed the headless gap; 1.1.7's release body truncates its own changelog entry mid-clause, dropping the part about ineligible accounts bypassing a check the interactive interface enforces. The releases that hardened something were posted, at lags from six minutes to about a day.

No motive required. Good news travels faster than bad news everywhere, and nobody needs a conspiracy to explain a maintainer posting a fix and not an embarrassment. The operator gets the same result: follow the vendor's own account and you see every hardening and no loosening.

Now put that against April. Google's Gemini CLI v0.41.0 shipped what we filed as a feature: workspace trust in headless mode. It was a fix. Before it, configured workspace trust did not bind in exactly the mode continuous integration uses. Three months later Google's closed-source replacement, the binary those same users were moved to, fixed headless mode honoring no configured policy at all.

Same vendor. Same failure. Same mode of operation. One quarter apart, in the successor product. Whatever produced the first one survived being replaced.

That is the argument, and it is why we do not think these 25 days were unusual. Across fourteen projects, controls did not do what their documentation said, and the discovery almost never arrived as a security event.

The rule you wrote

Start with one line an operator types.

If you write Edit(src/**) in Claude Code, you believe you have scoped the agent's write access to one directory. Until v2.1.214 on July 18, that rule auto-approved a nested dir/ anywhere in the tree. The same release repaired a Windows PowerShell 5.1 bypass, Bash file-descriptor redirect forms that failed open, commands over ten thousand characters that ran unprompted, zsh subscripts treated as inert, and help and man auto-approving.

Six ways to write a rule that reads exactly like a boundary and was not one.

Then the fix went to a channel most people do not run. At window close stable served 2.1.212, published a day before the fix; latest served 2.1.220. Anyone on stable, the Homebrew cask, or the apt and dnf stable suites had none of it. The rule did not bind, and the repair was not in the build they install.

Hermes is the sharpest case here, because the change was deliberate. v2026.7.20 makes approvals.mode: smart the default, so a classifier now decides what would previously have reached a person. Defensible. The sequencing is not: the policy override, the consecutive-denial circuit breaker, the approvals suggest command and the detectors for docker daemon redirection and recursive rm were all merged in the following days and are in no tag. The release that moved the decision off the human is the release without the guardrails built for moving it.

The same project's egress firewall, its strongest credential-containment control, was merged on July 4, reverted twelve minutes later, and the revert is what shipped. It re-landed on main on July 24 and is still unreleased.

Elsewhere the pattern is quieter but identical. Codex rust-v0.145.0 rewrites an operator's exec policy file on first start, stripping exact allow entries, and its entire network-authority hardening wave is alpha-only. Gemini's stable line runs roughly two weeks behind its own security merges; on July 8 the stable release was less patched than a preview published forty-six minutes earlier. And OpenClaw's sandbox assertion returned success while the escape worked, which is the whole argument compressed into one function call. That fix is in no release on any channel.

The advice was to stop asking

Everything above assumes an operator wrote a rule. For most of this window, the guidance from Claude Code was not to bother.

On May 22 the product account extended automatic approval to the Pro plan: Shift+tab, and let Claude run.@ClaudeDevs Six days later its creator told developers to Make sure to default to auto mode so Claude isn't stopping for permissions.@bcherny By July 8 the advice had become a command -- /checkup offers, as item six of what it will change for you, to Enable auto mode by default@bcherny.

Auto mode is not the bypass flag, and the distinction matters. It is a separate model that approves or denies each action based on your intent and scope@delba_oliveira. That is a real design, and a defensible one.

Then on July 15, v2.1.211 fixed auto mode consulting a PreToolUse hook and overriding its ask decision for unsandboxed Bash.

Put the dates together. Through the eight weeks the vendor spent recommending automatic approval as the default, the mode being recommended could overrule the one control an operator writes in code. Under --dangerously-skip-permissions the hook is not consulted and you know it. Under auto mode it was consulted and overruled, and you did not.

We claim nothing about what anyone knew. The sequencing is the finding, and it is the same sequencing as the rest of this issue: the guidance shipped first, the enforcement caught up later.

The pressure does not only come from the vendor. Operators arrive at the same place by attrition -- one asked the timeline on July 27, after a run of prompts for short Bash pipelines, Should I use --dangerously-skip-permissions? Is everybody doing that now?@zby Others push back on exactly that reflex: every tips list opens with the alias that skips the prompts, and in a sandbox that is fine, but near a key it removes the one step that was protecting you@NielsAbdellatif. Both flags are documented, and both vendors picked a name that tells you what they think of the choice -- could not be more on brand for both products@RobertNowell1.

The scaffolding dissolved

The other thing that happened this window is more interesting than any of the above, and we nearly missed it because our instrument does not look for it.

On July 3, v2.1.201 stopped using the mid-conversation system role for harness reminders in Sonnet 5 sessions. A prop that existed to keep the model on task was removed because the model no longer needed it. Three weeks later an Anthropic engineer put a number on the wider version: We removed ~80% of the Claude Code system prompt for our newest models@trq212.

Treat that number as a claim rather than a measurement -- we searched v2.1.179 through v2.1.220 and the changelog records no such reduction, so the direction is receipted and the magnitude is the vendor describing its own work. But the direction is corroborated from outside, by people with no reason to agree. Models are better at figuring stuff out.@PovilasKorop One operator stopped taking anyone's word for it, proxied his own sessions to see what was actually being sent, and cut his starting context Down to a clean 13K tokens to start each session@mattpocockuk. And the sharpest version of the claim is a forecast: loops were a short-lived patch for models that couldn't reliably keep working on long problems@simonw, where newer models simply keep going unassisted.

This is the Bitter Lesson arriving as a maintenance chore. Every one of those prompts, skills files and loop constructs was written by somebody to compensate for a model that could not yet be trusted to hold a goal. The compensation has a shelf life. What looked like accumulated institutional knowledge in your CLAUDE.md was, in part, a workaround with an expiry date on it.

Now hold that against the rest of this issue, because they are the same document.

The changelog that records scaffolding being deleted because the model has judgment now is the changelog that records six permission checks failing open. In the same weeks. Often in the same releases. Rules became judgment on the capability side and stopped binding on the enforcement side, and the second is not a rebuttal of the first.

It is the bill for it. A control is a rule that does not depend on judgment -- that is the entire point of writing one down. The more a system's competence comes from the model deciding well, the more the few remaining hard boundaries have to actually hold, because there is nothing else left underneath them. eve understood this and deleted a knob. Everyone else deleted the scaffolding and kept the knobs.

An unenforced control emits nothing

You cannot observe a rule failing to bind. You can only observe a vendor later fixing it.

So every count here is a count of disclosures, and a vendor that ships the identical bug and says nothing scores zero and looks clean. Normalized against our own back catalogue this window is the least eventful we have recorded, which is not the same as saying it was quiet. It is the research trail that holds those numbers, and they are not the interesting part.

What is new is the class of surface that failed. Through June, almost every case was a permission rule inside a running binary. This window adds the read surface itself: documentation pinning a vulnerable image, a release body truncating its own security clause, a marketing site selling a subsystem the code deleted, and an advisory channel silent across eight releases that repaired authority.

It already has names. Saltzer and Schroeder called it incomplete mediation in 1975. It is CWE-638, whose worked example is a deny rule that a search path walks around; the parser-failure case is fail-open, CWE-636. Formal methods has the only term for the operator's side: a specification is vacuous when it passes for reasons unrelated to what it was written to guarantee.

The thing none of them name is the silence.

Nobody published an advisory

Across 25 days in which eight Claude Code releases repaired authority boundaries, neither Anthropic nor OpenAI published a security advisory.

The point is not that Anthropic never does. Its database carries ten, February through June, and they are not minor: sandbox escape via git worktree path confusion, trust dialog bypass via worktree spoofing, symlink following that writes outside the workspace, SSH host key verification bypass. The most recent is dated June 25, one week before this window opens. Then nothing, through eight releases that repaired authority. For openai/codex the most recent is September 2025.

Both vendors shipped a security product during it. Codex added a Security plugin on July 17; Claude Code's reached beta on July 22.

That nothing was found is not the explanation. Starting July 20, Pillar Security published seven sandbox escapes in seven days, across Antigravity, Codex, Cursor and Gemini CLI, three of them on our watchlist, on the argument that denylist sandboxes are structurally fragile for agentic systems@Pillar_sec.

Day five is the one to read. Codex ships a safe-command allowlist that skips the sandbox and the approval prompt both. git show is on it, because it displays a commit. But git show --output writes to any path you name, so you point it at .git/config, wait for the developer to run git diff, and the payload runs with their privileges. A poisoned README is enough to plant it.

OpenAI confirmed CVSS 8.6 on January 29, shipped the fix in v0.95.0 on February 4, and paid the bounty on February 17. The advisory database has carried nothing since September 2025. Rated, patched, paid for, never announced.

The report nearly died in triage, for the best reason we read this month.

…Model refusal is probabilistic. Run the prompt enough times, and it complies, and when it does, nothing catches the command.…

Is a permission rule that matched too broadly a vulnerability or a bug? A vendor filing a CVE for every over-broad glob would exhaust its users inside a month. The effect does not care about the intent. This class of failure was disclosed in changelog prose, and the operator who needs it most is the one reading release notes line by line.

Our own sweep missed all of it: seven public disclosures against four agents, running the length of our final week, and the conversation lane returned none of them.

The counterexample stopped being a counterexample

For three issues we used eve as the foil: the platform-hosted, human-in-the-loop-first product. After Patched for Whom we wrote that where self-hosted harnesses shipped governance fixes to main and left them there, the platform side "shipped controls you could actually run."

We were wrong, and the warning signs were already in our own pages: eve had a comparable instance on July 1, and we flagged a caveat about its approval surface on June 17.

Inside eve, in 25 days:

• 0.21.0 guaranteed a delegation tree "can never outspend the budget configured at its root." 0.27.1 fixed declining a child's prompt letting the parent retry that child against a fresh quota share. For fifteen days, "stop" was a suggestion.
• 0.26.1 changed the developer interface to show rejected tool approvals as denied "instead of successful." The operator's only window onto the decision had been displaying its opposite.
• 0.25.0 introduced the guarantee that a stale approval never authorizes an earlier call, which is a guarantee precisely because it was not one before.
• 0.24.2 fixed approvals arriving from chat channels that left the tool unrun.

The gate failed open and closed, in the same product, in the same month.

So the comfortable version is dead. It is not that self-hosters are careless while platforms are careful. Buying governance as a service does not buy you a boundary that binds. It buys you a different party's word about a boundary, and this window that word was wrong four times, in the product whose entire pitch is that it would not be.

What actually works

Three things worked.

Agent Zero closed the channel gap entirely. Comparing v2.6 to its default branch returns identical: four tags in the window, nothing sitting unreleased. eve, for all the above, has the same discipline, its main branch three documentation-only commits ahead of thirty-four tags. Neither makes you guess whether the fix is in the build.

Paperclip's critical advisory was already fixed. GHSA-x8hx-rhr2-9rf7, published July 22, describes a drive-by remote code execution via DNS rebinding at CVSS 9.6. Reading the source rather than the advisory metadata shows the guard changed from authenticated && private to private && (local_trusted || authenticated) on April 16, ninety-seven days before disclosure. Worse, the advisory's declared vulnerable range points at an npm line abandoned in March, not the calendar-versioned line the project actually ships, so an operator cannot map the range onto their own version string at all.

Nobody noticed in either direction. We searched all thirteen social files for any mention of the advisory, the identifier, DNS rebinding, or the severity score. Nothing, including from a post reciting that exact release's highlights two days later. We expected to be debunking a panic. There was no panic.^4d

eve deleted a knob, which is the most interesting thing any vendor did this month. 0.22.5 tightened the maximum subagent depth to 1. Then 0.23.0 removed the setting altogether and replaced it with a structural constraint: only a root agent may delegate. Not a smaller number. No number.

Hold that against everything above. Every failure here is a promise made in a configuration file that the runtime did not keep. A setting is a claim about behavior; this window is a catalogue of false ones. An invariant is not a claim. It is a shape the system cannot take, and you cannot misconfigure a knob that does not exist.

What the conversation is good for

We expected the conversation to run ahead of the changelog. It does not. Of 55 claims adjudicated on Codex and Claude Code, exactly one describes something before its receipt: a July 13 post explaining that the GPT-5.6 Sol context limit had been cut from 372k to 272k after unintended usage drain, five days before rust-v0.144.6 recorded the same correction. The version-tracker accounts that look like early warning post two to seven minutes after the release they summarize. The lane buys latency, not foresight.

It is worth three other things.

It is the only running summary when the vendor stops writing one. Claude Code's What's New digest stopped at Week 29, so for the last stretch of this window the crowd was the only continuous narrative covering v2.1.214 through v2.1.220.

It is wrong in ways worth correcting in public. A July 20 post recommended turning auto mode on, describing it as roughly bypass permissions with less risk. That is backwards on the point that matters: under the bypass flag a PreToolUse hook is not consulted and the operator knows it, while v2.1.211 had just fixed auto mode consulting the hook and overriding its ask decision.^3c

And it is where fixes get reported as bugs. Users complaining since July 19 that auto mode still constantly asks for file-edit permission are describing v2.1.214 narrowing Edit(src/**) to the working directory. They experienced the repair as a regression, which is what happens when a rule quietly means one thing and then starts meaning what it said.

It is also, occasionally, where the failure gets reported as itself. On July 21: Claude Code update breaks sandbox settings for a second time.@malm_magnus We did not reproduce it. It is the only in-window post we found that names the thing this issue is about.

The loudest silence

What never came up is sharper than what did. Across eighty-three claims covering Hermes, OpenClaw and Pi, not one mentions that Hermes moved the approval decision from a person to a classifier. The same sweep caught a stale installer, a Telegram gateway crash, a WSL2 database corruption and a Discord routing complaint. The single approval-adjacent post is an OpenClaw user asking for fewer prompts.

A default that decides what an agent may do without asking you had moved, and eighty-three posts went past it.

On July 21 a practitioner scrolling the same timeline complained that Claude Code and Codex discussion was mostly people shouting about usage limits, and that And only a handful of people tweet about something USEFUL they're BUILDING with AI.@PovilasKorop

Three surfaces and a hole. The conversation covers capability. The changelog covers shipping. Neither covers enforcement, and enforcement is the one an operator is betting on.

The lane also caught us being wrong. Three heypi posts predate their confirming tags by thirteen, six and five days, and one of them refuted a baseline we had published: we expected heypi to be holding at 0.2.0. It was not.

The same lane surfaced a useful piece of vocabulary. On July 25 the author of Agent Flywheel named the mechanism that keeps his parallel agents from colliding on the same files.

No, that’s handled by the advisory file reservation system in agent mail:…

It is the accurate label for a great deal of what this window called a guardrail, and almost nobody else reached for it.

One structural note, because it explains why the sweep read so differently per project. Hermes has zero fully confirmed social claims and 1,712 commits between its newest tag and its default branch. Pi has zero unconfirmed ones and two.

When a project's released build is far behind its branch, almost nothing anyone says about it can be checked against something you can install. When the two are the same artifact, almost everything can. The merged-to-released gap does not only decide whether you have the fix. It decides whether any public claim about the project can be checked at all.

Where the tags went

We warned about OpenHands for three issues. It half resolved.

The open-source line, frozen at 1.8.0 since June 10, took six tags in four days from July 6, through 1.11.0. The authlib open-redirect fix we flagged as main-only shipped in 1.9.0, the first tag on any line to carry it. Self-hosters got a supported build.

Then it refroze. Nothing tagged on the open-source line since July 9, default branch fifty commits ahead, and the 1.12.0 release pull request sitting in draft with a clean mergeable state for eighteen days while cloud tags kept shipping. A high-severity vite advisory, CVE-2026-53571, an unauthenticated arbitrary file read exposing .env files and TLS keys, is in cloud tags and no open-source one.

And the install documentation still tells a self-hoster to run the 1.8 image and calls it the most recent stable release, handing every new user every advisory 1.9.0 closed. That is the purest gap in the issue: a document that does not merely fail to describe the system, but walks the reader into the version it already fixed.

Provider notes

One line each. The dated detail lives on the project pages.

• Codex rust-v0.145.x rewrites your exec policy file on upgrade, stripping exact allow entries.
• Gemini CLI v0.52.0 ships docs that still describe consumer authentication as live, a month after the service ended.
• heypi 0.3.0 has the strongest enforcement contract we found and an advisory identity half: omit admins and approvers and anyone who can reach the approval interface may answer it.
• Flue removed workflows from its default branch with no replacement, and its tracing now captures prompt and tool content by default.
• Agent Zero v2.6 holds zero unreleased work and narrowed secret masking, so other values in a .env are no longer redacted.
• Pi v0.82.1 has two commits unreleased, the smallest gap on the watchlist.

The verdict

Rules became judgment, and mostly that is the good news. The scaffolding people wrote to compensate for weaker models is dissolving, and the compensations were never the interesting part of anyone's work.

The bill is that judgment does not bind. So assume the rule does not bind either, then go find out.

Every surface a vendor publishes is downstream of a decision about what to say. The runtime is the only one that cannot lie to you, and it answers only if you ask. Write the deny rule. Run the command it forbids. Watch what happens. That is a tedious hour, and the only one here that produces knowledge rather than belief.

An operator got there before us, and put it better. He had spent months approving every action by hand, and worked out why that felt wrong: he had no boundary, so every click was the boundary. The fix was to put the os sandbox first, then auto approve inside it@rcmisk. Safety is a wall, not a habit.

That is also the answer eve reached by deleting its own setting. A control you can misconfigure is a control someone will misconfigure, including the vendor who wrote it. The systems that came through this window cleanest were not the ones with the most careful policy engines. They were the ones with the fewest places where policy could be wrong.

---

Window: 2026-07-02 to 2026-07-27, 25 days across 14 projects. This issue adds a public X sweep as a standing part of the cycle. Social posts are receipts for what was said, never for what is true; every product claim sourced from a post was adjudicated against the primary record before it appeared here. The research trail holds the harvest, the cross-checks, and the claims we declined.