Before the First Turn

Our @openclaw security assessment produced 27 advisories, 3 hardening PRs, and 1 architectural submission. Read the report: https://t.co/WrRLYhtTvZ

Told GPT Astra to help me denoise some audio and it just randomly started downloading executables from GitHub and running them. I'm using codex in "approve for me" mode which allegedly says "only ask for actions detected as potentially unsafe". LOL. Sure.

Fair on price/token. But a model is only as good as its harness. AGY CLI: no browser tool, no auto classifier, approve-everything workflow. Claude Code in auto mode: hand it the task and walk away. Saving pennies per token while burning hours of my time isn't a win.

i switched to codex from claude a couple of days ago and I feel like people hating on claude and praising codex use these tools like an ai chatbot instead of an actual harness, codex genuinely feels like a mediocre university project compared to claude code

Jev powered "auto mode" in the Temporal Agent Harness is such a natural fit. Jev is a big unlock for efficient agent oversight. Very excited to see how straightforward it was to integrate along existing harness seams. More to come here for sure.

I am done with this shit. It is over. The state of engineering right now is horrible. It has been half a month since I started a new role at a big company. Nobody knows anything here. The specs, code, tests, PRDs, tickets, resolution of those tickets, reports, etc., everything is made by Claude Code. Nobody on my team likes this. They are being forced to ship as much as they can. I have heard multiple times from higher management that pushing code is not a bottleneck, so why are we slow? People are working 12 to 13 hours a day just to press enter. Nobody is reading anything. Humans in corporate are doing nothing on their own. Everyone, literally everyone, from an L1 to an L7 engineer here is doing the same thing. Talk to Claude. There is no sense of victory. Nobody is resolving bugs. In reality, nobody is thinking anymore. Everything is done by LLMs. It is so soul-sucking. I would not mind it, to be honest, if we were at least given the time to check out the code and see what is going where. But no, the goal is to just ship. No matter what happens.

DSH 的任务规划能力很强，每次聊完方案，它做完调查后，就会生成一个长长的 todo list，这让以前 superpowers 那套仪式变得像小丑一样。随着 Agent 和 LLM 的进步，过去的奇技淫巧正在变得一文不值。

This is the kind of capability demo that benefits from harness-first scrutiny: what the agent can do, what state it mutates, and where the boundary is. If your follow-up includes those traces, an amplify would be useful to the testing crowd.

TrustFall is the quiet one this week: Claude / Cursor / Copilot / Gemini CLI all fire project-defined MCP servers the moment you hit Trust on the folder. one Enter key. CI runners get it with zero clicks. trust dialog ≠ sandbox. if the repo shipped the MCP config, you just ran their code.

Pillar Security (Week of Sandbox Escapes): escapes across Cursor, Codex, Gemini CLI, and Antigravity. In almost every case the agent didn’t break the sandbox — it wrote something a trusted host component later ran: .claude hooks, git metadata via --separate-git-dir, allowlisted git show --output, Docker socket, .vscode tasks. Cursor patched hooks in 3.0.0 (CVE-2026-48124). Codex GitPwned patched in v0.95.0. Antigravity findings were downgraded by Google as hard to exploit. Blast radius isn’t the agent process. It’s everything the agent can write that the host later trusts. If you buy coding agents for the team, which control do you demand first? A) Prove which host components trust agent-written files (hooks / git / tasks / daemons) — and require approval when those paths change B) A stronger process sandbox alone is enough if the vendor says “sandboxed”

We are going to lean into making Hermes more like Pi, and less like OpenClaw

🚨 Plugin4Shell: SHA-Pinning Bypass Across Major AI Coding Agents We found the same supply-chain flaw in @claudeai Code, @OpenAI , @GeminiApp CLI and @github Copilot. The flaw allows an attacker to replace a reviewed and trusted plugin with malicious code in any marketplace. The result: zero-click RCE on the machine running the agent. Thanks to @theinformation for covering the research. Full write-up:

We ran GPT-6 Astra across 6 agent harnesses (Codex, Claude Code, OpenCode, Hermes Agent, Pi Agent, Command Code) on 29 challenging agentic tasks. Most harnesses succeeded at similar rates. But when they failed, they used 3–5x as many tokens, depending on the harness. 🧵🧵🧵

New blog post: We had a million lines of Python to clean up. On September 2nd @Teknium asked Hermes Agent to do it. 1,393 subagents and nineteen hours later, the codebase was 34.4% smaller, saving us nearly $2m in engineering hours. https://t.co/eH6Gy8RAC5

Your AI agent sandbox doesn't matter if RCE fires before it starts. Novee just dropped DefCon 2026 research on Google Gemini CLI: CVE-2026-12537, a perfect CVSS 10.0 host-level RCE. Three lines in .gemini/.env. Zero privileges. Zero prompt injection. The blind spot is Pre-Task Authority. Agents load trust, config, and spawn processes before the first token. Prompt defenses never get a turn. The chain on Gemini CLI in CI: 1. GitHub Actions auto-trusts every workspace when CI=true 2. Attacker PR drops .gemini/.env with GEMINI_SANDBOX_PROXY_COMMAND 3. That "egress security" proxy launches via shell:true string concat 4. Host shell splits on ; and exfils GITHUB_TOKEN, GEMINI_API_KEY, OIDC creds before the Docker sandbox even starts Four defenses bypassed by running earlier than all of them. A security feature became the RCE vector. Same pre-task class across vendors: Gemini before sandbox, Claude Code before trust dialog (Check Point Research), Codex MCP auto-launch on directory trust before the model. Patch: Gemini CLI before v0.39.1 / run-gemini-cli before v0.1.22. Google overhauled headless trust so workspace config no longer auto-loads in CI. Primary: https://t.co/iNG0Z9KyIZ Audit the code that decides trust and builds the sandbox. The exploit may fire while the boundary is still being built.

Nous had a million lines of Python to clean up. They pointed their own agent at it. Hermes Agent, orchestrated by Teknium on Sept 2: 1,393 subagents (218 running at peak), 19 active hours, and the codebase came out 34.4% smaller — 1,063,826 lines down to 698,363. The worst "god file" went from 34,847 lines to 5,512. The whole thing ran on an i7 desktop with 64GB of RAM, with Claude Fable 5.1 as the remote model. Now the honest fine print, which the blog deserves credit for: the tweet's "$2M saved" framing is the upper bound of a $150k–$1.8M manual estimate, against ~$19K of tokens for the main run — human review time excluded. Community reviewers caught real regressions the tests missed, including deleted public names that external plugins might import. Still the most detailed public teardown of a fleet refactor we've seen.

Hi Astra users. A reset and a quick update on quality issues that have been posted around. Working with some of you, we have found and fixed the following issues: - Some skills written for previous models were triggering too often or preventing the model from checking its work. - An opt-in context management experiment that could cause early stops or replies to older messages. We've disabled it. Our rough estimate is that 4-5k users were affected by this experiment. - We've also removed some badly configured engines that resulted in a measured quality degradation for a long tail of traffic flowing through them. We’ve also made some more minor improvements and things should feel significantly better across the board. More consistent follow-through, better tracking of your latest message, and better checks on the work as it’s going through the motions. The examples posted and all the users who worked directly with us were incredibly useful in helping fix things quickly. Always grateful for this incredible community. And of course, a reset is also landing by midnight today.

deepseek eval'd their new v4.1 flash model in 8 different harness configs > model performs best in minimal harnesses -- mini-SWE & minimal deepseek harness > underperforms in both claude code and codex

Claude Code, Cursor, and Codex CVE-2026-19592 all got caught running attacker code before you ever see a trust prompt. Manifold Security found 8 of these flaws across 7 command-line coding agents: Claude Code, Cursor, Codex, Goose, Hermes Agent, Qwen Code, Grok Build. Same root cause every time. The bug lives in core.fsmonitor, a Git perf setting that names a command Git runs to check which files changed. Git reads that value straight from the repo's own.git/config. Any index refresh triggers it: git status, git diff, the branch check your agent runs silently on startup. On Claude Code and Hermes Agent, the payload fires before the workspace-trust prompt even shows up. On Qwen Code, before you've authenticated. On Grok Build, on the first keystroke. No prompt to the model. No tool approval. Just opening the folder is enough. Exploitation needs the.git folder intact: a shared drive, a synced folder, a USB stick, a zip a contractor sent you. A normal git clone strips this. But how many repos do you actually clone vs just copy from a client's shared drive? goose got CVSS 7.0 (CVE-2026-72718), fixed in 1.44.0. Claude Code patched the core.fsmonitor path in 2.1.196, but a second path through claude ultrareview was still live on 2.1.252 as of Sep 1. Codex CLI fixed in 0.131.0, covered by CVE-2026-19592. Hermes Agent, Qwen Code, Grok Build: still unpatched at publication. BEFORE (dangerous): agent runs git status/diff at session start to figure out branch and changes, before any trust decision, blindly trusting whatever the repo's.git/config says to run. AFTER (safe): sandbox every git subprocess call, strip or validate repo-supplied config keys (core.fsmonitor, hooks) before the first invocation, gate ANY git command behind the workspace-trust decision, not just tool calls. Building agents that touch untrusted repos? Go check which git commands yours fires before the user approves anything. Would you even notice if your CLI agent ran a command before you saw a trust prompt? #AISecurity #PromptInjection #SupplyChainSecurity

Two months ago, we started the mission to “build OpenClaw with OpenClaw,” and bit by bit, we moved everyone from using their local coding harness to using https://t.co/ZFauM82U4k - our shared agent that knows what everyone’s working on and orchestrates it all. Multiplayer coding + infinite compute with nodes and cloud sessions has been a game changer for how we build. Local harnesses feel like relics of the past now.

We’re sorry to see that OpenAI put out a note saying they plan to block Cursor users from accessing OpenAI models in three months. OpenAI models serve about 5% of Cursor user traffic, and we’re speaking with the OpenAI team to resolve this. Cursor was one of the very first users of OpenAI, we’ve worked closely with their team for years, and we’ve trusted their platform to be neutral infrastructure for our business.

6/ In some runs Claude noticed the compromise and tried to kill the malware later on. But Auto Mode blocked the cleanup command! 🤯 It allowed the malware to run, but denied stopping it. Another example where a safety feature can end up working against you.