You Approved Something Else

On August 7 a Claude Code maintainer made a claim about safety that is easy to misread as marketing and is not: auto mode is safer than --dangerously-skip-permissions *and* manually approving everything@lydiahallie The next day, asked how that could be true when the bypass flag skips checking entirely, she gave the mechanism: dsp just doesn't check at all.@lydiahallie

She is right about the comparison, and the study behind it is not decoration. Over a thousand testers were shown a clearly dangerous command inside an ordinary approval prompt. They caught it around one time in seven, and got worse the longer a session ran. The classifier caught the same commands about nine times in ten and did not degrade. If you have ever clicked yes forty times in an hour, you already know which of those numbers describes you.

So the case for taking the click away is a real case, built on measurement.

Now put it next to what the same fortnight's release notes say the click was doing. In v2.1.221, a Bash permission check could be walked past by hiding commands inside zsh regex conditionals. In v2.1.223, a crafted command could "hide parts of itself from permission checks," and commands padded with tabs or invisible Unicode could "hide part of the command from the approval dialog." In v2.1.224, sandbox deny rules written with a trailing slash, the way anyone would naturally write a directory, were silently bypassable on Linux and macOS.

Four holes, one shape: the string a human was shown was not the string that ran.

That is not a rebuttal of the safety argument. It is the uncomfortable fact sitting beside it. The dialog people are being asked to stop relying on is also the dialog that, this fortnight, could be shown less than what it was approving. An operator reading both at once is entitled to ask which control they actually have.

The boundary is not where most people think it is

The sharpest reply to the auto-mode thread came from an engineer who had read the documentation rather than the announcement. the boundaries you state in chat aren’t stored as rules. the classifier re-reads them from the transcript on every check@EliaAlberti

We should be careful here, because it is tempting to promote that into more than it is. He is not describing any of the defects above. He is describing a different property: where a spoken instruction lives. The release notes describe a display problem in a dialog. He is describing a memory problem in the thing replacing the dialog. Those rhyme, and they are not the same bug.

What makes it worth quoting is that it is checkable against the vendor's own docs, and he did: docs recommend a deny rule for a hard guarantee, which means the conversational layer is the soft one.@EliaAlberti

That inversion is the week in one sentence. The layer an operator experiences as authoritative, the one where they say "don't push to main," is the advisory one. The layer that binds is a config file most people never open.

Two other projects shipped the same lesson from different angles. Pi merged support for an AGENTS.override.md that lets any directory replace the operator's context file, and it loads before project trust is resolved: a guard consulting the thing it is guarding, which is the defect class this publication recorded in June when a workspace-trust backend read its own trust value out of the workspace. And Antigravity disclosed in 1.1.11 that a malformed allowlist entry auto-approved every command. A rule that widens permission when you write it wrongly is not a rule. It is a suggestion with a syntax error.

The same release disclosed that MCP admin controls were skipped for the first five minutes of every session. Windows are harder to reason about than broken rules, because the control is present and correct and simply not in force yet. Any CI job or scripted run that finishes inside five minutes spent its entire life in that window.

Authority moved toward the human, too

A week reported as nothing but approval holes would be a defect log, and this one was not.

Hermes made writes to AGENTS.md, CLAUDE.md and SOUL.md always stop for a human. Read against Pi's override defect, that is the better fix by design: if the instruction file is the thing an untrusted directory can replace, then making every write to it unconditionally interactive removes the class instead of patching the routes into it. The same release lets an operator mark a server untrusted, after which every write-capable tool asks. Codex made a smaller version of the move, demanding an explicit trust decision for unfamiliar project directories, and it named its new automatic-review flag --approve-for-me, which is at least honest about what it does.

Claude Code also spent the week widening what the agent can operate, on purpose. it now copies your session into a new background session while you keep working in the current one@lydiahallie The old in-session subagent that reported back became /subtask. Sessions can now message each other by name.

That is worth holding next to Paperclip, where standard-trust agents got default-open write access to any company-visible issue they could read. On a platform whose whole proposition is many agents inside one organisation, a default's blast radius is the number of agents, not the number of people.

Reference

Breaking changes this window: Pi replaced its session and harness API wholesale with a lane-based v4 model and removed the legacy repositories; eve replaced continuation-token sessions with fixed ID-addressed handles across every public surface; Codex removed codex exec --full-auto outright.

Security advisories: none published by any watched source in this window. The authority defects above were disclosed in release notes rather than advisories, which is worth noting if you track advisory feeds to decide your own exposure. Four of them would not have reached you that way.

Provider notes

Gemini CLI shipped v0.54.0 with HTTPS enforced for Google credential auth and keychain tag validation, then jumped from 0.54.0 to 0.54.4 in 27 hours with 0.54.1 through 0.54.3 never published. OpenClaw's extended-stable line moved during the window and moved without the workspace-boundary fix, which is now 21 days beta-only and confirmed absent from both stable tarballs at file level. Omnigent shipped its worktree_guard fix in v0.8.0 about ten hours after the merge, closing the carry-forward from the last issue. Agent Zero, Flue, eve, heypi, agent-flywheel and the two newest sources are covered in the run's findings.

What you actually have

The honest position at the end of this week is not that the classifier is worse than you. The measurement says it is better than you, and pretending otherwise would be a nicer story than the truth.

The position is that you have been handed a new gate while the old one was being quietly repaired underneath you, and only one of those two facts arrived with an announcement.

Which brings us to the smallest exchange of the week and the one that will outlast it. A practitioner noticed which model was answering a built-in tool: it seems to still be used by the Claude Code WebFetch tool, which means hallucination risk any time you fetch a URL!@simonw The reply came from the team, and it is the whole argument in a sentence: working on removing Haiku from WebFetch now that automode is default@trq212

Once the human is out of the seat, what sits in it becomes a product decision.