Two Reasons Not to Trust the Click

On 7 August a Claude Code maintainer, Lydia Hallie, made a claim that is easy to read as marketing: auto mode is safer than --dangerously-skip-permissions *and* manually approving everything@lydiahallie The next day, asked how auto mode could beat a flag that approves everything, she gave the mechanism. The bypass flag, she wrote, dsp just doesn't check at all.@lydiahallie Auto mode blocks destructive actions you did not ask for and screens tool results for prompt injection.

The study behind the claim is not decoration, though it is the vendor’s own. Anthropic’s write-up describes showing 1,053 paid testers a clearly dangerous command inside an ordinary approval prompt, text only, nothing run. Its developer account gave the result in one line: Testers caught it 13.6% of the time, and closer to 5% after 50 prompts. Auto mode blocked the same commands 89% of the time, flat across session length.@ClaudeDevs If you have ever clicked yes forty times in an hour, you know which number describes you.

So the case for taking the click away is real, and it is built on the vendor’s measurement, with a method it describes and nobody has yet repeated.

The people who build the alternatives argued about it in the open. Pi’s maintainer, whose harness ships no permission dialog, treated the case against it as settled: (they are not, which is why pi doesn't have that security theater built in)@badlogicgames. Peter Steinberger, who created OpenClaw, disputed that the classifier was news at all: We ship such an auto classifier in OpenClaw for quite a while now.@steipete Simon Willison granted the premise and withheld the conclusion: I REALLY want to believe that this fixes prompt injection risks for coding agents, but I'm just not there yet@simonw. And a safety researcher who had moved from Claude to Kimi K3 on Oh My Pi, after refusals, named what he missed. OMP has no built-in classifier for risky tool calls, he wrote. This means K3 could decide to rm -rf / and that would be that!@bgigurtsis

The same week’s release notes show what else was true of the click.

The dialog showed less than what ran

Claude Code’s changelog for the week reads like a list of ways the approval prompt was not showing the whole command. 2.1.221 fixed a Bash permission check that zsh could walk past by hiding commands in [[ ]] regex conditionals. 2.1.223 fixed “a crafted command could hide parts of itself from permission checks”, and commands padded with tabs or invisible Unicode that could “hide part of the command from the approval dialog.”

Three fixes, one shape: the string a human approved was not the string that ran.

The fourth fix is a different failure and a worse one to find. 2.1.224 repaired sandbox deny entries written with a trailing slash, denyRead: "~/.aws/", the way anyone writes a directory. On Linux and macOS they were silently bypassable. Nothing was hidden from anyone. The rule was written, believed and not enforced.

None of this refutes the safety argument. It sits beside it. The dialog people are being asked to stop relying on is the same dialog that, this week, could show less than it was approving.

A boundary stated in chat is not a rule

The sharpest reply to the auto-mode thread came from an engineer who had read the documentation rather than the announcement. In auto mode, he pointed out, the boundaries you state in chat aren’t stored as rules. the classifier re-reads them from the transcript on every check@EliaAlberti

That is not one of the bugs above. It is a property of the thing replacing the dialog: where a spoken instruction lives. He checked it against the vendor’s own docs: docs recommend a deny rule for a hard guarantee, which means the conversational layer is the soft one.@EliaAlberti

The layer an operator experiences as authoritative, the one where they type “don’t push to main”, is the advisory one. The layer that binds is a configuration file most people never open.

Two other projects shipped rules that did not bind where the operator thought they did. Pi v0.84.0 lets an AGENTS.override.md in any directory replace the operator’s context file, and its own security doc says context files load “regardless of project trust.” A cloned repository can change your agent’s instructions before you have decided to trust it, and in headless modes there is no trust prompt at all. Pi has no dialog to fool, which is Zechner’s point; what it has instead is a trust check, and this file loads before it. The feature is genuinely useful in a monorepo; it is also a guard consulting the thing it guards.

Antigravity 1.1.11 disclosed that a malformed allowlist entry auto-approved every command. A rule that widens permission when you write it wrongly is a suggestion with a syntax error. The same release disclosed that MCP admin controls were skipped for the first five minutes of every session. The control was present and correct and not yet in force, and any CI job that finishes in under five minutes lived its whole life in that gap.

Authority moved toward the human, too

The week was not only holes.

Hermes merged a gate on 7 August that makes every file-tool write to AGENTS.md, CLAUDE.md or SOUL.md stop for a human, one operation at a time, with no yolo bypass. Against Pi’s override file, that is the better design: pick the file class that steers every future session and make writing to it unconditionally interactive, instead of patching routes into it one by one. A companion change lets an operator mark an MCP server untrusted, after which every write-capable tool asks. Neither was in a Hermes tag when the window closed.

Hermes’s lead made the argument behind those gates in the auto-mode thread itself. A filter on what reaches the model, he wrote, holds until an attack it has not seen gets through; Hermes puts the lock where the action lands: The user is the classifier of last resort, positioned at the effect layer rather than the input layer.@Teknium The two merges above are that sentence in code.

Codex 0.147.0 now demands an explicit trust decision before a new project directory’s hooks and exec policies load. It also shipped automatic review under a flag named --approve-for-me, which at least says what it does.

Claude Code widened what the agent can do on purpose. /fork, Hallie wrote, it now copies your session into a new background session while you keep working in the current one@lydiahallie The old in-session subagent became /subtask, and sessions can now message each other by name.

Paperclip went the other way. A change merged to master on 4 August gives standard-trust agents default-open write access to any company-visible issue they can read, and its own Risks section says so. It was in no Paperclip stable at window close. On a platform whose whole proposition is many agents inside one company, a default’s blast radius is the number of agents, not the number of people.

Breaking changes and security notes

Pi v0.84.0 replaces its session and harness API wholesale and removes the legacy repositories.

eve 0.31.0 replaces continuation-token sessions with fixed, ID-addressed handles on every public surface.

Codex 0.147.0 removes codex exec --full-auto.

No watched project published a security advisory this window. Every fix above arrived as a release-note line or a pull request.

Provider notes

Gemini CLI. v0.54.0 enforces HTTPS for Google credential auth, then the stable line jumped to 0.54.4 in 27 hours with 0.54.1 through 0.54.3 never published. If you pin by patch number, pin by what exists.

OpenClaw. Its extended-stable line moved during the window and moved without the workspace-boundary fix. Choosing the long-term channel bought this week’s operators an older boundary, not a safer one.

Omnigent. Shipped its worktree_guard fix in v0.8.0 about ten hours after the merge, closing an item the previous issue left open.

Agent Zero, Flue, eve, heypi, Agent Flywheel, OMP, OpenHands, DeepSeek Harness. Nothing that changes this week’s read.

Closing

The measurement says the classifier is a better judge than a tired human, and pretending otherwise would be a nicer story than the truth. What the week adds is that the old gate was being quietly repaired while the new one was announced, and only one of those arrived with a post.

The smallest exchange of the week points at what comes next. Simon Willison, calling Claude Haiku his least favorite model, noted that it seems to still be used by the Claude Code WebFetch tool, which means hallucination risk any time you fetch a URL!@simonw Thariq, a Claude Code engineer, replied that the team was working on removing Haiku from WebFetch now that automode is default@trq212

Johann Rehberger, a security researcher, asked the same question from the attacker’s side. Add a forbidden topic to an attack on Fable 5, he wrote, and the session falls back a model: It will downgrade to Opus 4.8, which is then easy to exploit with research I did 4 months ago...@wunderwuzzi23 We have not reproduced it, and it is his finding, not ours. It is still the right question.

Once the human is out of the seat, what sits in it is a product decision. Read the product notes like you used to read the prompt.