Before the First Turn

On 1 September, Manifold Security published a finding that needs no model to work. Coding agents run git status at startup to see where they are. A repository can ship a .git/config whose core.fsmonitor names a command, and git runs it as you, outside any sandbox. Manifold found it in seven agents. A security account relaying the finding put the timing plainly: On Claude Code and Hermes Agent, the payload fires before the workspace-trust prompt even shows up.@llm_redteam

Hermes shipped the fix in v2026.9.7 six days later. Every earlier Hermes tag is exposed. Manifold reports a second Claude Code path still firing on 2.1.252, and no Claude Code changelog line through 2.1.278 names a fix.

In the same four weeks, the part of the harness that judges actions improved and moved further from the person at the keyboard. The command above ran before any judge had anything to look at.

The judge moved further from the operator

Claude Code is the clearest case. 2.1.278 (19 September) makes the server-side classifier the auto-mode default for API, Enterprise, Bedrock, Vertex, Foundry and gateway sessions. Four days earlier, 2.1.273 had set the local classifier as the default on those clouds. The safety check now rides inside the session’s own model request, and Anthropic no longer bills for it. A gateway that strips the safeguards field makes the first checked action wait on a notice.

2.1.271 went a step further for sandboxed auto mode. The model now names the hosts a command needs, and the classifier approves them together with the command. No person sees a per-host prompt. Any other host is refused without asking.

Codex moved the other way on the same axis. Guardian V2, the model reviewer that the last issue found shipped but switched off, stayed default_enabled: false in every stable we read, nine of the window’s fourteen, through 0.155.1. 0.153.0 also stopped Guardian review in Full Access and User approval modes. One user reported that Astra, in Codex’s approve-for-me mode, it just randomly started downloading executables from GitHub and running them.@mebeim That is one session, not a measurement. It is also what it looks like when the reviewer is not where you assumed.

Smaller projects put a model in the seat outright. eve 0.59.1 added auto(): a model approves tool calls, and a person is asked only if the review fails. DeepSeek Harness added an experimental Auto review. Omnigent now routes Codex’s escalations to Codex’s own auto-reviewer by default. A Temporal harness code owner, wiring in Jev, a model built only to decide and score, said Jev is a big unlock for efficient agent oversight.@JasonSteving That integration is not in the 0.4.0 wheel.

The case against the judge arrived on schedule. On 26 August Johann Rehberger published an indirect prompt injection that drove Claude Code on Opus 5, in auto mode, from a web page to code execution. He reports 60 to 80 percent success, and says Anthropic closed the report because auto mode is not a security boundary. The coda is the part worth keeping: It allowed the malware to run, but denied stopping it.@wunderwuzzi23

Anthropic’s own permission-modes page lists auto mode as the starting mode on Pro, Max and Team. Its entry for isolation needed reads “None; a sandbox or container adds defense in depth.” Both statements can be true: the classifier is a strong review layer and not a wall. Only one of them is in the docs.

The reason operators want the judge is real, and it is the right reason. Amdahl Maxing says the scarce resource is human attention, and one operator put the trade in one line: Saving pennies per token while burning hours of my time isn't a win.@Jarretcoon A post from inside a large company described where that leads when nothing else changes: People are working 12 to 13 hours a day just to press enter. Nobody is reading anything.@v0xium That is one person’s account of one workplace. It is also the condition every judge in this section is being built for. A judge that saves the click is worth having only if something still holds when nobody reads.

What ran before the judge got a turn

Each of the window’s serious breaks happened somewhere no review step could see.

The plugin installer. On 17 September AIR Security disclosed Plugin4Shell: The flaw allows an attacker to replace a reviewed and trusted plugin with malicious code in any marketplace.@air__security Four agents installed plugins pinned to a commit SHA without checking that the checkout landed on that commit. Git prefers a branch with the same 40-character name. Gemini CLI checks out FETCH_HEAD, which a default branch can be named. The attacker needs control of the plugin repository. Background auto-update is what makes it zero-click.

The fixes reached users by different routes. Claude Code fixed it in 2.1.179, and that changelog entry does not mention it. Codex lists it as one line, #34644, in 0.146.0. Gemini CLI 0.60.0, the newest stable, still calls git.checkout('FETCH_HEAD'), and AIR says Google told it the tool is deprecated and will not be patched. No Copilot CLI changelog line through 1.0.87 names a fix.

The startup git. That is GitSpawn, above. Codex 0.154.0 stopped running workspace helpers before a project is trusted, and 0.150.0 stopped loading an untrusted project’s AGENTS.md.

The config loaded before the sandbox. A security account’s summary of a DefCon talk on an older Gemini CLI bug put the class in one sentence: Agents load trust, config, and spawn processes before the first token. Prompt defenses never get a turn.@hackerlogs That bug, GHSA-jj69-4grx-fqj5, was fixed in 0.39.1 in June. GitHub scores it 7.8, not the 10 in the post. Inside this window, Gemini CLI 0.58.0 fixed an autoEdit path rule that the loader silently discarded. Auto-approved edits had not been path-checked at all. The same release fixed a macOS sandbox profile that could reach a Docker or OrbStack socket and mount the host. Neither fix got an advisory.

The box that was not there. Before v1.20.0 (17 September), setting OpenHands’ Docker runtime was never passed to the bundled agent server, so conversations ran on the host. Antigravity CLI before 1.1.18 ran a headless prompt with no sandbox when --sandbox was given without a value.

The repository as policy. At v18.2.8, OMP’s own source says project-local config and extensions “are already discovered and loaded unconditionally”, and its trust check “always returns true“. Its approval docs name yolo as the default mode. This is a fact about OMP only. Pi has had a per-directory trust prompt since June. Grok Build closed the same gap this window: its permissions guide on 19 August said a checkout’s own allow rules apply without a trust prompt, and a month later says folder trust gates them. No release note mentions it.

The approvals endpoint. The Temporal Agent Harness makes the human decision a durable workflow object, which is a genuinely good idea. At 0.4.0 its packaged server defaults to 0.0.0.0 and exposes session listing, approval and a skip-all-approvals command with no login. In its coding example, answering “always” to a bash prompt approves the tool, not the command on screen. One tester asked the right question about the harness demo: what the agent can do, what state it mutates, and where the boundary is.@AgentEtna

The pattern has a name in the field. Summarizing another firm’s week of sandbox escapes, one practitioner wrote:

Pillar Security (Week of Sandbox Escapes): escapes across Cursor, Codex, Gemini CLI, and Antigravity. In almost every case the agent didn’t break the sandbox — it wrote something a trusted host component later ran: .claude hooks, git metadata via --separate-git-dir, allowlisted git show --output, Docker socket, .vscode tasks. Cursor patched hooks in 3.0.0 (CVE-2026-48124). Codex GitPwned patched in v0.95.0. Antigravity findings were downgraded by Google as hard to exploit. Blast radius isn’t the agent process. It’s everything the agent can write that the host later trusts. If you buy coding agents for the team, which control do you demand first? A) Prove which host components trust agent-written files (hooks / git / tasks / daemons) — and require approval when those paths change B) A stronger process sandbox alone is enough if the vendor says “sandboxed”

Another put the trust-dialog version more bluntly: if the repo shipped the MCP config, you just ran their code.@Sagarvd01

Where the fixes landed, and where they did not

A fix you cannot find is a fix you cannot schedule. This window was full of them.

Claude Code’s stable channel held one build for eighteen days. The Homebrew cask that follows it moved to 2.1.236 on 28 August and to 2.1.267 on 15 September, skipping 23 versions. The setup page kept saying stable is about a week old. A stable fleet took the 2.1.257 authority batch, the MCP allowlist change and a new default model in one hop.

OpenClaw finally shipped the approved-exec fix that three issues carried as unreleased. It is in 2026.8.1 (31 August) and every stable since. On 21 September the npm extended-stable tag moved to 2026.7.35, a July line that lacks it, along with the workspace-boundary and sandbox-stop fixes. An operator who picked the long-term line to be careful is on the unfixed one. On 11 September the project published 75 advisories in a day. Its auditor counted its own share: Our @openclaw security assessment produced 27 advisories, 3 hardening PRs, and 1 architectural submission.@trailofbits

Elsewhere the fix was real and the notice was not. Claude Code’s Plugin4Shell fix has no changelog line. Codex shipped sandbox-escape and credential fixes with no advisory. Hermes’s GitSpawn advisory, GHSA-7x36, was still unpublished at window close. OpenHands shipped four security fixes as plain pull requests, and eve and OMP shipped approval fixes as patch notes. For most of this watchlist, an advisory feed would not have told you to upgrade.

Codex changed the model you run without a minor version. 0.153.4, a hotfix, made gpt-6-astra visible in the bundled catalog, and the picker default moved to it from gpt-5.6-sol for any session with no model set.

One correction runs through our own record. The last two issues told eve operators to set turnPolicy: queue. On a multi-user channel, until 0.52.5, queued messages from different users ran as one turn under the last sender’s authorization. Upgrade before relying on that advice.

What became possible

The capability story of the month is subtraction.

On 16 September UC Berkeley and Arena published HarnessTax. They ran seven models through Claude Code, Codex CLI and Pi on samples of SWE-bench Lite and Terminal-Bench 2.0. Holding the model fixed, the harness had little effect on whether a task succeeded, and moved cost up to fivefold. Claude Fable 5 succeeded on 97.8 percent of attempts in Claude Code at $1.33 on average, and 96.7 percent in Pi at $0.67. A vendor benchmark of Astra across six harnesses pointed the same way:

We ran GPT-6 Astra across 6 agent harnesses (Codex, Claude Code, OpenCode, Hermes Agent, Pi Agent, Command Code) on 29 challenging agentic tasks. Most harnesses succeeded at similar rates. But when they failed, they used 3–5x as many tokens, depending on the harness. 🧵🧵🧵

DeepSeek’s own evaluation of its new model, relayed by a practitioner, found model performs best in minimal harnesses -- mini-SWE & minimal deepseek harness@zainhas The counter-read deserves its place. Thirty tasks per benchmark measure a task, not a working week, and one Claude Code user argued that people hating on claude and praising codex use these tools like an ai chatbot instead of an actual harness@12wecior

The vendors were deleting in the same direction. Claude Code 2.1.268 stopped offering its task-tracking tools on current models, and 2.1.277 removed TaskOutput and began reading AGENTS.md directly. /code-review stopped fanning out subagents on models without tuned settings. The Codex lead, listing Astra quality fixes, named the cost of keeping old scaffolding around: Some skills written for previous models were triggering too often or preventing the model from checking its work.@thsottiaux Hermes’s lead engineer announced a direction: We are going to lean into making Hermes more like Pi, and less like OpenClaw@Teknium The first step is moving bundled memory providers out to the plugin market. A DeepSeek Harness plugin author wrote, in Chinese, that the model now plans well enough that old skill-pack rituals look silly: 随着 Agent 和 LLM 的进步，过去的奇技淫巧正在变得一文不值。@cholf5

This is Bitter Lesson Maxing with receipts. The model absorbs the planning scaffold, and the part worth building is the part the next model cannot absorb: the boundary, the installer, and the startup path. The previous section was a list of exactly those parts, failing.

Reach grew too. Nous reported a Hermes run on its own million-line codebase: 1,393 subagents and nineteen hours later, the codebase was 34.4% smaller, saving us nearly $2m in engineering hours.@NousResearch A reader of the same blog kept the fine print the headline dropped: the tweet's "$2M saved" framing is the upper bound of a $150k–$1.8M manual estimate@jimmy_longbow_ OpenClaw’s creator described his team moving to a shared, multiplayer cloud agent: Local harnesses feel like relics of the past now.@steipete Claude Code’s --restricted gives a grader a session with no shell, no web fetch and no project settings. --permission-prompts none turns every would-be prompt into a denial for CI. Both are on stable. OpenHands profiles became enforceable scopes for MCP servers and secrets. Hermes can fill a sign-in from 1Password without the secret entering the model’s context. Pi’s rewritten harness reached a tag in v0.85.0.

The open items from August

Most of the previous brief’s watch list resolved. Gemini CLI 0.57.0 carried all four of its preview-only fixes to stable. Hermes’s three missed approval fixes reached v2026.8.19, and its delegation docs now match the config. DeepSeek Harness’s Web UI now requires a login on every API request. It is still a prerelease, and its architecture page still says any part can be replaced. Its public repository is a mirror: merge commits cite pull requests from a private organization. Paperclip’s review-policy lock reached stable v2026.824.0 and its thought-text fix reached v2026.831.0. OpenHands v1.15.0 carried the wrong-profile fix, as expected.

Two items went the other way. Agent Flywheel’s maintainer says v0.7.0 never installed, so our profile’s reading of it as the current cut is corrected. And the eve queue advice is corrected above.

Breaking changes and security notes

Omnigent v0.14.0 fixes three bundle-upload advisories published on 16 September, one of them critical (GHSA-598r): a terminal’s working directory escaped the workspace to a host shell. A related editor shell-proxy fix is in v0.15.0, after this window.

Paperclip v2026.916.0 stops returning stored credentials in plaintext from agent APIs, including to the agent itself. Earlier stables need an upgrade and a key rotation.

Agent Zero v2.12 makes the Telegram webhook secret mandatory. Before it, anyone who could reach the port could post as an allowed user.

Copilot CLI 1.0.85: COPILOT_ALLOW_ALL=0 or false used to turn auto-approval on. 1.0.83 changes the sandbox default so localhost is cut off and Linux egress is pinned to the proxy.

Hermes v2026.9.14: destructive desktop actions no longer run unapproved on gateway, cron and API hosts. v2026.8.19: agent.max_turns defaults to unlimited.

Claude Code 2.1.259: an unparseable managed-settings file now stops startup instead of silently running unmanaged. allowedMcpServers no longer filters servers shipped in managed-mcp.json.

Gemini CLI 0.60.0 rejects MCP OAuth servers that omit iss, and blocks web_fetch to local addresses.

Codex 0.154.0 removes codex mcp-server.

Provider notes

Claude Code. The busiest month on the list: 32 versions, a stable pointer that stalled, and two deny-rule extensions shipped and then reverted. The September 1 batch stops a repository putting a clone into bypass mode.

Codex. Fourteen stables. Guardian V2 is still off. Our 23 August feature, ”The Body, Not the Pencil“, reads the same division of labor from sixteen months of the Codex tree.

Gemini CLI. Four stables, almost entirely hardening, from a tool whose vendor told researchers it is deprecated.

Antigravity. Nineteen stables, and tags now match their notes. It loosened three prompts (workspace reads, MCP under always-proceed, headless plan review) and tightened three (URL fetch, script-scoped allow-always, reported denials).

Cursor. SpaceX’s acquisition changed the product’s footing. OpenAI said it would end Cursor users’ access to its models, and Cursor’s CEO replied that they had trusted their platform to be neutral infrastructure for our business.@mntruell Projects, a coordinator thread that dispatches agents, is in beta and cloud-only.

Copilot CLI. Six stables, with fail-closed managed settings, worktrees out of experimental, and no named Plugin4Shell fix.

Grok Build. Builds are now pinnable and dated, and folder trust gates a checkout’s own rules. Manifold found GitSpawn unpatched at 1.0.13. Hooks still fail open.

Hermes Agent. Seven stables. GitSpawn and several policy leaks are fixed, and the default turn cap is gone.

Pi. The rewritten harness is tagged. An extension that routes ! commands into a VM no longer falls back to the host on error.

OMP. 45 releases, three tags with no release, and one release that never reached npm. The Rust rewrite from ”Oh My Pi, without the Pi” (23 August) is in no tag, and its branch has been quiet since 4 September.

OpenClaw. Seven stables in twenty days, with release gates visibly waived on two. Several defaults widened what agents can reach.

Paperclip. Six stables, and 292 canary tags.

Agent Zero. v2.11 and v2.12. The ACP defaults and SSRF tests are unchanged.

OpenHands. Six stables. The Docker fix is the one to take.

DeepSeek Harness. Sixteen prerelease tags, split into a release-candidate line and an alpha line. The alpha line sends more session data to DeepSeek by default.

eve. 47 tags. Self-modification now has a deployed mode, off by default, that opens draft pull requests.

Omnigent. When its policy server is unreachable, native Claude Code and Codex tool calls now fall through to the wrapped harness’s own dialog instead of being denied. That answers the question this publication asked at intake: during an outage, the harness refuses, not Omnigent.

Temporal Agent Harness. New to the watchlist. Four prerelease tags in twelve days, and a tag that was moved after its release page went live.

Flue. Back after a quiet month, with changesets and per-package releases. Agent Flywheel. v0.8.0 and v0.9.0. heypi. No change.

Closing

This month’s reviewers got smarter, cheaper and further away, and none of them was watching when the damage happened. Govern what the harness runs before the first turn, then let the judge have the rest.