Section
Runtime
The frontier gets serious when an agent leaves the prompt and enters a computer that someone has to bound, inspect, and clean up.
Runtime covers the move from chat or tool calls into bounded execution: terminal, filesystem, browser, code execution, tool creation, sandboxing, persistence, cleanup. Where the agent actually operates.
Other sections
October 2026
-
A third-party Pi MCP adapter drops its interpreter for Pi's native codemode
- Adapter users on current Pi 1.4.0: port script settings and hook matchers before installing adapter 6.0.0, then compare the native composition path with the interpreter or bridge you maintain. A second interpreter is now a concrete maintenance cost that can be removed.
- Test allowed and forbidden calls through proxy, deferred and scripted paths, plus an Executor pause with and without a person present. Recorded tool identities and refusal results would settle the deployed permission boundary; a visible --tools list does not settle it.
- Review project script contents as well as their configuration entries, and reverse the adapter's native-MCP takeover when removing it. Count migration and review time against accepted work before claiming a net attention saving; the author's context benchmark is configuration-specific.
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
-
Claude enables headless forks and reuses completed workflow steps
- CI and SDK integrators: trial latest 2.1.310 with one workflow resumed after a completed child before keeping custom prompt-copy and restart scaffolding. Compare accepted results and recovery interventions; successful journal reuse would justify removing that duplicate work.
- Test max turns, Stop, ended input and denied child tools, including mods and split panes. Record which steps actually rerun and reconcile any interrupted external write before retrying it; a journal entry does not establish exactly-once effects.
- Set the unattended permission mode explicitly and measure cost and review time. CLAUDE_CODE_FORK_SUBAGENT=0 disables forks; claude mcp serve does not offer them. Native delegation can save context assembly while creating more child output to accept.
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
-
Pi Durable checkpoints a wait and releases the invocation
- Durable host builders: back up storage before 1.4 opens it, plan the one-way cutover, split post-wait work into a new phase and supply each document's checkpointWhen predicate. This can replace an invocation kept alive solely to wait.
- Persist the wake outside the dying process. Kill a harmless job around checkpoint commit and alarm registration, then verify it resumes once intended and reconciles any uncertain external effect. Those receipts, not a resumed transcript alone, would establish the host's recovery.
- Measure idle resource use, wake latency and recovery interventions against the old host. Attention moves from supervising live waits to scheduling and storage custody; no current host inherits durable wakes merely by sharing Pi's package family.
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
-
Hermes keeps classic CLI work running after terminal detach
- CLI wrapper and bot operators: use stable 0.22.5, follow the persisted session identity and completion status, and stop treating terminal exit as cancellation. A continuing gateway can replace a wrapper kept alive only to supervise the chat process.
- Configure agent.run_budget_seconds rather than --run-budget on this path; -z does not itself bypass approvals. Use the documented alternative surfaces for unsupported worktree and image invocations. Record the serving gateway, home and profile alongside the client version.
- Detach from a harmless job, reconnect, cancel it deliberately and remove a saved permanent allow. Separately disable a plugin, then test HTTP requests and new websocket handshakes under each served profile. These checks do not establish termination of an already-open socket. Completion and refusal traces would settle the deployed lifetime and consent behavior. Saved terminal supervision may become gateway administration; no net orchestration saving was measured.
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
-
Gemini leaves directory references for the agent to explore
- Users with a working authentication route on 0.65.0: try pointing a fixed task at a repository directory before maintaining an eager directory-packing wrapper. The supported path lets the agent choose what to read instead of assembling every file in advance.
- Name required constraints and files explicitly. Compare files actually read, accepted output, latency, inference spend and human corrections with the old path; those results would settle whether selection saves attention on this repository. No token or task-quality gain was measured.
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
-
Codex's released updater loads network policy before making requests
- Restricted interactive fleets: move to stable 0.164.0 and record the CLI and serving-daemon versions separately. The prior release wait is complete; automatic updates can now be evaluated against the fleet's saved restrictions.
- Before enabling the updater, test a denied destination and invalid configuration using the actual saved policy. Keep updates held until those tests pass. Recorded network refusals and a pinned-install update trace would settle enforcement and update timing in that installation.
- Budget restart and environment administration as well as patching. This replaces waiting for upstream delivery with a bounded deployment check; no daemon was launched, updated or interrupted in this research.
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
-
Copilot's enabled sandbox now permits local-network access by default
- Terminal and ACP fleet owners: install stable 1.0.103 and set sandbox.allowLocalNetwork deliberately. Test a needed development listener and an unintended private service on each host; a functioning local development loop can now replace a workaround while exposing services an operator previously assumed were unreachable.
- Compare new and resumed ACP sessions with saved settings and launch flags, recording the actual server binary. For required containment, verify enabled=true, failIfUnavailable=true and allowBypass=false in managed policy. The 1.0.103 release and package establish delivery even though its final public notes commit is ahead of the source tag.
- Keep host-filter and Windows cases in the test matrix. Platform-specific connection and refusal traces would settle the deployed boundary; the narrow macOS exception does not prove every localhost path works. Use those results to decide whether saved configuration removes per-session repair work.
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
-
Interactive Codex shares a server that can move beyond its CLI pin
- Interactive fleets and evaluation owners: run 0.162.1 and record both codex --version and codex app-server daemon version. Use --no-daemon for a fixed per-launch baseline, or set {"updater":{"autoUpdateEnabled":false}} in CODEX_HOME/app-server-daemon/settings.json and restart the daemon.
- Restart after changing inherited credentials or PATH. Restart keeps the selected server package; it does not undo an earlier update. Shared service operation replaces repeated startup with environment and update administration. Disabling updates returns patch scheduling to the owner.
- Keep the updater off where managed network policy must hold on 0.162.1. A stable containing d570b3632b100e36f931797cdbdb8906d0fcafa8, now preview-only, plus blocked-network and failed-config probes would settle enforcement; a recorded pinned-install update trace would settle actual update behavior.
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
-
Pi's CLI connects MCP servers and composes their tools in JavaScript
- CLI integrators: try a configured MCP server and one multi-tool script on 1.2.0 before maintaining an equivalent bridge. Compare accepted outcomes, setup and review time before removing it; no net time saving or current-version quality comparison was measured.
- Read global and trusted-project mcp.json before launch. Stdio servers inherit Pi's environment and run beside the harness, so contain the whole process or scrub its environment. --no-mcp disables built-in MCP; autoEnableCodemode: false only prevents its automatic codemode activation.
- Keep authorization in hooks and govern script model credentials. Tool declarations and codemode-only presentation do not prove a callable-set restriction. Denial tests covering root calls, nested calls and model spend would settle a particular deployment's boundary; watch for tagged repairs to issue 10426 before relying on only-mode enforcement.
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
-
Restricted Claude graders now filter built-ins registered after launch
- CI and evaluation owners using restricted graders: pin latest 2.1.296; 2.1.295 is the first release with the late-tool fix. Keep sandbox or container restrictions and --permission-prompts none where an ask must stop unattended work. A package on the stable channel is insufficient.
- Enumerate available tools after late registration and try a harmless excluded built-in, a deprecated alias and cross-session messaging. Record denial and absence of side effects before treating the tool set as effective. This acceptance work replaces a false restricted-mode assumption, not the grader's assessment of output quality.
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
-
OpenHands' local terminal inherits a key that reaches excluded secrets
- npm, desktop and Docker-image users running terminal-enabled local conversations: keep production/deploy secrets out of this shared store when agents read untrusted repositories. Inspect the terminal environment and whether its effective key can retrieve a saved-but-excluded test secret.
- Where secret selection must hold, trial OH_CONVERSATION_RUNTIME=docker with OH_CONVERSATION_IMAGE pinned to ghcr.io/openhands/agent-server:1.54.0-python and exclude the automation key from the profile. This construction does not copy the outer alias wholesale; withholding it removes this inherited-key route to automation creation.
- Require a released alias removal, sanitization repair or automation-only key and denied-secret tests on both runtimes before trusting the boundary. Container construction alone is insufficient. The review moves from the profile label to actual terminal credentials and protected-route behavior.
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
-
Omnigent 0.18.0 closes a host escape through bubblewrap helper files
- Linux execution-host owners: install stable 0.18.0 on affected hosts and restart helpers, not only the central server. The 2026-10-13 nightly predates the patch. Until patched, use the advisory's disposable VM or container without sensitive host credentials or mounts.
- Inventory ACP, Goose, Kimi, Pi and Qwen helper processes and their running package versions. Check that launcher-directory write grants are rejected after restart; a patched server does not replace running host helpers.
- A fixed host package, restarted process identity and a test rejecting launcher-directory write exposure would establish deployed remediation. The advisory and source do not measure exploitation or qualify every sandbox backend. The patch requires host maintenance now instead of relying on model approval to contain already executing code.
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
-
Temporal Code Mode waits without storing interpreter snapshots in workflow history
- Temporal teams building multi-step scripts: trial temporal-agent-harness[ui,code-mode]==0.6.0 on every serving workflow worker with pydantic-monty 1.0.0. This can replace batch-snapshot transport and custom wait bookkeeping; inspect the workflow host's execution authority.
- Keep old Code Mode histories on compatible workers until a versioned cutover passes representative 0.5.0-history replay on 0.6.0. Record worker and interpreter versions and outcomes. Replay risk is inferred, not a demonstrated universal failure; blind reset is not an established remedy.
- Authenticate and restrict origins on the approval service, whose 0.6.0 server still binds all interfaces without login and includes wildcard CORS. Make external effects idempotent. Test replay, denied routes and resumed effects before replacing application recovery code; fewer waits in process do not establish exactly-once effects or net attention savings.
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
-
Copilot CLI makes local sandboxing available to every user
- Individual and managed CLI users: install 1.0.97, move user settings to settings.json and try /sandbox enable or copilot --sandbox -p for a controlled job. Inspect /sandbox status and /sandbox policy, then perform one authenticated Git operation and one denied destination test.
- Fleets requiring containment must set sandbox.enabled and sandbox.failIfUnavailable true and sandbox.allowBypass false, verifying supported hosts and managed delivery. Server-managed enabled alone can be declined on unsupported hosts; built-in file tools use best-effort software checks.
- Scope each masked secret's injectHosts and inspect credential files separately. Test localhost workloads on macOS; Windows host rules rely on programs honoring the proxy. Full bypass restores ordinary credentials. Recorded platform-specific denial and credential-use results would settle the deployed boundary. This replaces some repeated credential inspection with maintained host lists and deliberate exceptions, without measured savings.
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
September 2026
-
The harness's own git ran repository code before the trust prompt
- Upgrade Hermes to v2026.9.7 or later. Open untrusted repositories only inside a container or VM; the trust prompt appears after the harness's own git has run.
- Before opening a repo you did not create, check .git/config for command-valued keys such as core.fsmonitor and core.hooksPath.
- Evidence that would settle residual: a Claude Code changelog line or advisory for the second path, and Grok Build's status (unpatched at 1.0.13 per Manifold).
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
-
Asking for Docker got you the host until v1.20.0
- If you set the Docker runtime on OpenHands before v1.20.0, assume those conversations ran on the host and audit what they touched. Upgrade to v1.20.0.
- Evidence that would settle residual: a runtime probe on v1.20.0 showing the conversation process inside the container.
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
-
The harness changed the bill, not the grade
- For API-metered work, measure your own tasks in a minimal harness before assuming the vendor harness earns its overhead. The study is 30 tasks per benchmark; long-horizon and subscription use are outside it.
- Hooks or transcript parsers keyed on TodoWrite or TaskOutput lose their signal on current Claude models; delete CLAUDE.md shims that only point at AGENTS.md once past 2.1.277.
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
August 2026
-
v2.10 ships the ACP bridge and interactive browser; the v2.9 SSRF tests survived
- Upgrade to v2.10 if you want ACP or the live viewport. Then turn ACP off if you do not want an editor-hosted endpoint with host write and host exec, and do not treat chats as separate browsers: cookies are shared.
- The v2.9 tests are still there. Diff plugins/_document_query/helpers/fetch.py after the next plugin extract. Do not read a missing plugins/_document_query/tests/ directory as missing coverage; the tests live at repo-root tests/.
-
Nothing authenticates the Web UI, and the code fence says so in its own comment
- Do not expose that port. Loopback-only is the entire access control, so any tunnel, container port mapping, or reverse proxy in front of it is the whole security boundary.
- Treat a third-party plugin as code you are running in-process with no declared permissions, because that is what it is. Read it before you install it.
Run: 2026-08-17-weekly-digest-2026-08-10_2026-08-17-frontier-v0
-
The only write confinement for Omnigent's unsandboxed workers did not bind on Windows
- The fix is on main and in no tag: v0.7.0 was published 2026-07-27, six days before the fix merged, and is still the newest release. An operator running the tagged release with unsandboxed implementer workers on a Windows runner does not have absolute-path confinement. Run main, or do not run those worker specs on Windows until the next tag.
Run: 2026-08-03-weekly-digest-2026-07-27_2026-08-03-frontier-v0
-
Gemini CLI's a2a-server read its trust decision out of the directory whose trust was in question
- Upgrade past v0.53.0 before pointing a2a-server at any repository you did not write. On earlier builds the workspace trust prompt was not a boundary for that backend, because the answer was read from inside the workspace.
Run: 2026-08-03-weekly-digest-2026-07-27_2026-08-03-frontier-v0
-
OpenClaw's workspace boundary fix reached beta and stopped there
- On stable OpenClaw the workspace boundary is still not a containment barrier, two windows after the bypass was first recorded. Either run the beta deliberately, or do not treat the workspace path as a security boundary for agents handling untrusted content.
Run: 2026-08-03-weekly-digest-2026-07-27_2026-08-03-frontier-v0
July 2026
-
OpenClaw's sandbox check returned success while the escape worked
- Do not treat the workspace boundary as a containment barrier on any current release, and resolve which build you are actually running from the package registry rather than the release page.
Run: 2026-07-27-weekly-digest-2026-07-02_2026-07-27-frontier-v0
-
Claude Code background agents now commit, push, and open draft PRs instead of stopping to ask
- Claude Code v2.1.198 makes subagents background by default and says background agents launched from `claude agents` now commit, push, and open a draft PR after worktree code work instead of stopping to ask.
- Before upgrading shared repos, decide whether background agents may write commits and branches, wire Notification hooks, and rely on branch protection rather than a human sitting at the terminal.
Run: 2026-07-02-weekly-digest-2026-07-01_2026-07-02-frontier-v0
-
Sonnet 5 propagated across harnesses in one week: Claude Code makes it the default (1M context); Pi adds support
- Claude Code v2.1.197 (2026-06-30) makes Claude Sonnet 5 the default model, with native 1M-token context. Pi v0.80.3 (2026-06-30) added Sonnet 5 support (Anthropic-compatible + Bedrock) the same week. A new frontier model became a default and a cross-harness option within days.
- Know your default changed: if you pin models for cost/behavior reasons, confirm whether you are now on Sonnet 5 with a 1M window (and the cost/latency that implies), or set the model explicitly.
Run: 2026-07-01-weekly-digest-2026-06-24_2026-07-01-frontier-v0
June 2026
-
heypi keeps secrets out of chat and the model context, but they rest plaintext-readable in the runtime workspace
- The `secret_request` flow encrypts secrets client-side (WebCrypto) so they are `not stored as chat history and is not sent to the model` -- a genuine win over pasting credentials into a channel. But the docs are equally explicit that secrets land as scoped runtime files (`.secrets/<name>`) and `Anyone who can read the scoped runtime workspace can read saved secrets`.
- Do not treat heypi's secret handoff as a vault. Restrict who and what can read the runtime workspace (and choose a sandboxed runtime accordingly), and remember `pending secret requests are lost on process restart`.
Run: 2026-06-24-weekly-digest-2026-06-23_2026-06-24-frontier-v0
-
For shared or team-facing heypi bots, the sandbox runtime is an explicit choice -- host runtimes ship with only a warning
- The default `just-bash` runtime is an in-process interpreter with a virtual filesystem and network off by default; Docker and Gondolin (a warm QEMU VM per scope) are opt-in isolation. The host runtimes (`host-bash`, `guarded-bash`) run against the real machine and emit only a startup warning: `For shared or team-facing bots, prefer just-bash, Docker, or Gondolin.`
- Choose the runtime before exposing a bot to a channel: a warning is not a boundary. For anything multiplayer, select an isolating runtime explicitly rather than relying on the default or accepting a host runtime past its warning.
Run: 2026-06-24-weekly-digest-2026-06-23_2026-06-24-frontier-v0
-
Sandbox-spec authority moves off a hardcoded list onto a runtime-api control plane
- PR #14849 (merge 56034afe10, merged to main 2026-06-16, NOT tagged) adds a DynamicRemoteSandboxSpecService that fetches available sandbox specs from the runtime-api `GET /api/warm-runtime-configs` endpoint rather than a hardcoded preset list — the foundation for custom and per-tenant execution images, with a companion guardrail refusing a custom image whose agent-server SDK version does not match.
- Operators planning custom or per-tenant execution images should track this; the sandbox is becoming a server-driven, configurable surface. It is on main, in no release.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
A per-user OAuth token now follows the user into the sandbox from any conversation start path
- PRs #14697 and #14650 (merged to main 2026-06-16, NOT tagged) generalize a per-user secret enricher that injects a user's linked Jira Data Center OAuth token into the sandbox from any conversation start path — web, Slack, and API — not just the originating Jira integration. A credential now follows the user into the runtime, with the blast radius that implies.
- Operators must reason explicitly about which start paths carry which secrets into a sandbox; the credential plane widened. It is on main, in no release.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
Pi compaction events now carry reason and willRetry so a harness can tell the trigger apart
- v0.79.10 (PR #5962) adds `reason` and `willRetry` to the extension `session_before_compact` and `session_compact` events, so an extension can distinguish a manual `/compact` from a threshold auto-compaction from an overflow-retry flow. The runtime's context management becomes legible from the outside.
- Harness authors building on Pi extensions can now branch behavior on why compaction fired and whether it will retry, rather than inferring it.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
Flue workflow runs go private by default and flue logs is removed (staged in Unreleased)
- Staged in the CHANGELOG `## Unreleased` section on main (NOT in the in-window v1.0.0-beta.1/beta.2 tags): workflow runs become private over HTTP unless the workflow separately exports a `runs: WorkflowRunsHandler`, admission receipts shrink to `{ runId }`, `streamUrl`/`offset` are dropped, and the `flue logs` command is removed in favor of typed SDK access (`client.runs.get()`/`events()`/`stream()`).
- This is direction, not a shipped default: the in-window beta.1 tag still documents `flue logs` as functional with the old `{ streamUrl, offset }` envelope. Operators should plan migrations off `flue logs` and the old run envelope, but not assume the new default is live until it tags.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
Hermes shipped background fan-out delegation with no wall-clock bound on a busy worker
- v0.17.0 ships background fire-and-forget fan-out delegation (#49734) in the same line of work that removed the default subagent wall-clock timeout (#45149). A heartbeat/inactivity backstop remains for a wedged worker, but the wall-clock bound on a productively-busy runaway worker is gone and not replaced; the only bound on the fan-out is one async-pool slot for the whole batch.
- Operators running long-horizon multi-agent Hermes work should re-introduce a spend or time bound themselves: a busy runaway background worker now has no wall-clock or cost ceiling.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
Skills were poisoning every memory store and a skill delete could wipe the working tree (unreleased)
- June 16 commits (main) stop a /skill invocation poisoning every connected memory provider with its raw body, and add tree-escape validation so an agent-triggered skill delete cannot rmtree outside the skills root (a fix ported from an incident that wiped another tool user's working directory). The self-improving-agent risk class made concrete.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Fire-and-forget background subagents that re-inject results as a new turn (unreleased)
- delegate_task(background=true) (main) dispatches an async subagent and re-injects its result as a new turn, with /stop and /agents as the control surface and a max_async_children cap. The same week removed the default 600s subagent timeout, so runaway detection now rests on heartbeat staleness alone. Changes the unit of work and the receipt boundary.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Three path-traversal holes in agent skill install/link/uninstall (fixed on main only)
- Commit bca5667fc / PR #27767 (main, ahead of every stable, preview, and nightly tag as of 2026-06-16) fixes three path-traversal vulnerabilities so a malicious skill package cannot write outside .gemini/skills or delete sibling directories. The clearest confirmation that agent skill packages are an untrusted-input boundary; treat third-party skill installs as untrusted until the carrying release ships.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Codex CLI adds usage views, permanent session deletion, and managed encrypted Bedrock auth
- CLI 0.140.0 adds /usage cost visibility, permanent codex delete (a data-retention/right-to-delete lever), /import, and managed Amazon Bedrock API-key auth with encrypted local storage; 0.139.0 made sandbox proxy-only networking enforcement more consistent. Use codex delete to purge sensitive sessions; re-validate proxy-only egress.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Hermes closes its own guardrail theater: cp into ~/.ssh, a status leak, fail-open adapters (unreleased)
- June 13 commits (main, post-v0.16.0) gate cp/mv/install into ~/.ssh and credential/shell-rc files (an unpaired write deny the commit calls 'theater'), stop /api/status leaking host paths and the gateway PID on exposed binds, and make own-policy chat adapters fail closed without an allowlist as their own SECURITY.md required. The v0.16.0 release binary does NOT have these; run main or wait for the next tag.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Plaintext git tokens in the DB, a plaintext MCP key, and two frontend CVEs
- OpenHands stopped persisting PluginSpec.source git tokens in plaintext in the DB (#14795, main) and stopped round-tripping remote MCP API keys in plaintext (#14613, main); react-router CVE-2026-42342 shipped in release 1.8.0 (uncredited), postcss CVE-2026-41305 is on main. Rotate any token embedded in a repo source URL or MCP config before the fix; rebuild the frontend.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Untrusted-repo OTEL cert injection and pre-warmed-worker trust bleed closed
- 2.1.169 fixes untrusted project settings setting OTEL client-certificate paths without a trust prompt (credential-path injection from a hostile repo); 2.1.172/2.1.174 fix pre-warmed background workers reading another directory's .mcp.json approvals/trust and inheriting another session's ANTHROPIC_* provider env. Upgrade past 2.1.174 and re-audit background-agent and untrusted-repo workflows.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Gemini routes flash workloads to gemini-3.5-flash on stable, behind an experiment flag
- Stable v0.46.0 began moving flash workloads to gemini-3.5-flash, gated by an experiment flag and auth-type access logic (so the same binary can route different users to different models). Anyone with cost or eval assumptions pinned to the old flash should re-baseline.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Flue reaches a 1.0-line beta and makes durable, recoverable agent execution the default
- Flue shipped durable, recoverable agent execution with pluggable SQLite or Postgres persistence (0.10.0) and reached its first 1.0-line beta (1.0.0-beta.1), a migration-heavy stabilization (valibot tool schemas, opaque run_<ulid> IDs, run-introspection exports). It also swapped standard WebSocket and SSE for a proprietary Durable Streams transport (0.10.2), narrowing external observability. Category evidence that the model+harness split is maturing into stateful infrastructure; the experimental-API caution starts to lift.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
The public Tailscale tunnel now trusts only the active Remote Control origin
- v1.20 (commit ca4efe6e6) normalizes active Remote Control URLs before CSRF allowlisting and restricts WebSocket origin validation to only the currently active Remote Control origin (the public tunnel exposing the whole visible computer), rejecting unrelated external origins.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
CLI 0.136.0 adds API-key registration for approved remote exec-server hosts
- An operator running remote execution can register approved hosts via API key instead of entering credentials per session, changing the remote-exec authentication model.
- This shifts trust to a pre-registered host allowlist keyed by API key — operators must decide which hosts are 'approved' and how those keys are scoped and rotated before enabling remote exec.
- Verification path: upgrade to 0.136.0, register a test host, confirm only approved hosts authenticate and that key scope/rotation behaves as expected before exposing remote execution.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Promptware defense added against Brainworm-class prompt-injection attacks
- Operators running the agent against untrusted content (web, repos, MCP tool output) gain a built-in defense layer they should validate against their own injection test cases rather than assume blanket coverage.
- 19 security-tagged issues were closed in the same release, so the upgrade is the gate for these protections; staying on prior versions leaves the injection surface unmitigated.
- Verification path: upgrade to v0.15.0 and run known Brainworm-class injection patterns to confirm the defense triggers before exposing the agent to untrusted input.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
OAuth browser-launch URI validation closes command-injection path
- An operator authenticating against a third-party or attacker-influenced OAuth server was exposed to shell command injection via the verification URI; upgrading past ba6e529 removes that exposure.
- Verification path: confirm the build includes ba6e529 (non-HTTP(S) URIs rejected, browser launched via spawn() not shell exec()).
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Git package install path-traversal rejection
- An operator installing a git-sourced package from an untrusted URL was exposed to files being written outside the package install root via traversal sequences; upgrading past a98e087 blocks this at parse and resolution time.
- Verification path: confirm a98e087 is present; a crafted git URL with '../' is rejected with 'Refusing to use path outside package install root'.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Enhanced plugin isolation tightens the plugin sandbox boundary in the 2026.6.1 line
- Enhanced plugin isolation changes the sandbox boundary around plugins, including the externalized Tokenjuice and GitHub Copilot plugins now run as separate plugins.
- Operators running third-party or externalized plugins should re-test plugin behavior against the tightened isolation, since capabilities previously available in-process may now be constrained.
- Single runtime-admin decision: verify plugins still function under the new isolation after upgrade.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Computer-use screenshots now persist to durable chat-scoped storage by default
- Reverses the prior ephemeral-by-default posture for computer-use screenshots, so operators who relied on screenshots being transient must now account for retained artifacts
- Changes deployment storage characteristics: long-running computer-use sessions accumulate screenshots in chat context, requiring storage planning and retention/cleanup review
- Directly hits the workcell calibration concern of persistence and cleanup for real computer access
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Upgrade dulwich to 1.2.5 to close CVE-2026-42305 in git operations
- Operator must re-resolve poetry.lock (enterprise and root) and rebuild backend images to ship patched dulwich; git operations run inside the agent runtime path.
- Distinct from the frontend CVEs: this is a backend Python git library, different surface and different verification (lockfile pin, not frontend bundle).
- Verification path: confirm dulwich>=1.2.5 in deployed poetry.lock / installed environment.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
v0.9.1 strips WebSocket URL credentials and rejects blank requestIds
- Operators deploying Flue on Cloudflare WebSockets get two upstream hardening fixes by upgrading to v0.9.1: query strings and fragments are stripped before attachment persistence, so URL-carried handshake credentials are no longer retained, and agent/workflow frames reject blank or whitespace-only `requestId` values.
- Both are the same consequence for one persona (the Cloudflare WebSocket operator) gated on the same upgrade, so they stay one signal; the operator action is to upgrade and confirm credentials are no longer in persisted attachments.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Writes to execution-granting config and shell startup files now prompt even in acceptEdits mode
- Two new guardrails land together: acceptEdits mode now prompts before writing build-tool config that grants code execution (.npmrc, .yarnrc*, bunfig.toml, .bazelrc, .pre-commit-config.yaml, .devcontainer/, etc.), and the agent now prompts before writing shell startup files (.zshenv, .zlogin, .bash_login) and ~/.config/git/.
- Operators who ran acceptEdits or auto-leaning modes previously had a silent write path into files that execute code on the next shell, install, or commit; the new prompt converts that into a confirmation checkpoint.
- The operator action is to recognize that these prompts will now fire and not blanket-allow them — the prompt is the supply-chain/persistence defense, so auto-approving it re-opens the vector.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
May 2026
-
Three de-facto security advisories without a separate advisory surface
- Windows operators on 2.1.148 or earlier with PowerShell allowlists, git worktree workflows, or enterprise login pinning should upgrade to 2.1.149+ before deploying new agents.
- Operators monitoring for security-advisory-shape events (RSS, CVE feeds) need to recognize that Anthropic ships these as ordinary changelog entries; the changelog is the de-facto advisory surface.
- Source-contract owners should decide whether to amend `sources/claude-code.yml` to add an explicit security advisory surface or to document the changelog as carrying that role.
Run: 2026-05-27-weekly-digest-2026-05-13_2026-05-27-frontier-v0
-
Local and remote session invocation protocols land stable
- Operators building delegated workflows on Gemini CLI should re-test against v0.44.0 stable; the remote invocation protocol is no longer preview.
- Multi-scope deployments must audit agent name overlaps before upgrading — the new `first-wins prioritize project` resolution changes which definition wins.
- Until Google documents where remote invocations actually run, treat the remote path as infrastructure-to-be-defined; do not depend on it for production.
Run: 2026-05-27-weekly-digest-2026-05-13_2026-05-27-frontier-v0
-
Host desktop control with required visual verification
- Operators evaluating Agent Zero for host control must decide whether `computer_use_remote` is allowed at all on the host — the default trust mode is opt-in but the runtime checks are enforceable.
- Workcell operators should know that screenshot capture is now ephemeral and context-scoped by default; auditing what the agent saw requires explicit durable capture.
- Operators using the existing `linux-desktop` skill: verify your skill routes to the path you expect; host and container desktops are now cleanly separated.
Run: 2026-05-27-weekly-digest-2026-05-13_2026-05-27-frontier-v0
-
Content-boundary hardening suite across inbound surfaces
- Operators evaluating OpenClaw against 'is it safe to put agents on real channels' can use this suite as evidence of a threat model, not just a feature list.
- Gateway operators should verify whether `gateway.auth.rateLimit` was unset in their config — the on-by-default ratelimit changes observable behavior for non-browser/HTTP auth flows.
- Plugin authors should treat `allowFrom` sender allowlists as the canonical inbound boundary; post-dispatch filtering is the older model.
Run: 2026-05-27-weekly-digest-2026-05-13_2026-05-27-frontier-v0
-
Kanban corruption-hardening wave (post-v0.14.0)
composes with Aider , Cline , Codex , Continue
- Kanban-dependent multi-agent operators should treat the post-v0.14.0 line as the integrity-floor baseline; the corruption-hardening wave volume is the signal.
Run: 2026-05-27-weekly-digest-2026-05-13_2026-05-27-frontier-v0
-
ODF-first document defaults, persistent desktop lifecycle, multi-tab browser fanout
- Operators running Agent Zero should verify that downstream workflows handle ODT/ODS/ODP output from v1.13+. OOXML output now requires explicit configuration.
- Operators running long-horizon desktop sessions should plan for persistent desktop state: the Xpra Desktop no longer resets on canvas navigation. Accumulated desktop state (open apps, browser sessions) persists until explicitly shut down.
Run: 2026-05-12-partial-cycle-agent-zero-2026-05-07_2026-05-12-frontier-v0
-
Real computers are becoming the agent work surface.
-
The agent interface is becoming a visible computer
- A serious agent harness increasingly needs browser, desktop, file, runtime, sandbox, and artifact surfaces that can be inspected.
Run: 2026-05-07-commit-harvest-2026-04-23_2026-05-07-frontier-v1