Signals
AI coding agent release tracker and source-backed signals.
Each signal is a source-backed finding that should change what a serious operator does next: upgrade, re-audit, try, watch, or ignore. This archive tracks Codex, Claude Code, Gemini CLI, Pi Coding Agent, Flue, MCP, plugins, permissions, sandboxes, runtimes, and release checks. Each entry links to the run that produced it.
225 accepted signals across 20 watched sources, organized for operators comparing agent releases, security fixes, governance changes, and runtime behavior.
Filter by source
Filter by composition
October 2026
-
A third-party Pi MCP adapter drops its interpreter for Pi's native codemode
- Adapter users on current Pi 1.4.0: port script settings and hook matchers before installing adapter 6.0.0, then compare the native composition path with the interpreter or bridge you maintain. A second interpreter is now a concrete maintenance cost that can be removed.
- Test allowed and forbidden calls through proxy, deferred and scripted paths, plus an Executor pause with and without a person present. Recorded tool identities and refusal results would settle the deployed permission boundary; a visible --tools list does not settle it.
- Review project script contents as well as their configuration entries, and reverse the adapter's native-MCP takeover when removing it. Count migration and review time against accepted work before claiming a net attention saving; the author's context benchmark is configuration-specific.
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
-
Origin lets an agent or installed app satisfy code-owner review
- Origin repository owners: choose Classic and human-owned path entries where a person must approve, and remove app_ alternatives for those paths. Classic requires owner approval but does not itself require a human owner. App installation and path ownership determine who can satisfy that gate.
- Trial Agentic on a scratch repository, recording head, paths, agent decision, human reversals and owner approvals avoided. Published substitution thresholds and a discoverable decision log, corroborated by those tests, would settle which human decisions it can replace.
- Test an app's own and another author's pull requests before treating app review as independent approval. The captured contract does not establish self-review counting. Less owner waiting is possible; teams inherit acceptance-policy and reversal work, with no measured saving.
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
-
Claude enables headless forks and reuses completed workflow steps
- CI and SDK integrators: trial latest 2.1.310 with one workflow resumed after a completed child before keeping custom prompt-copy and restart scaffolding. Compare accepted results and recovery interventions; successful journal reuse would justify removing that duplicate work.
- Test max turns, Stop, ended input and denied child tools, including mods and split panes. Record which steps actually rerun and reconcile any interrupted external write before retrying it; a journal entry does not establish exactly-once effects.
- Set the unattended permission mode explicitly and measure cost and review time. CLAUDE_CODE_FORK_SUBAGENT=0 disables forks; claude mcp serve does not offer them. Native delegation can save context assembly while creating more child output to accept.
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
-
Pi Durable checkpoints a wait and releases the invocation
- Durable host builders: back up storage before 1.4 opens it, plan the one-way cutover, split post-wait work into a new phase and supply each document's checkpointWhen predicate. This can replace an invocation kept alive solely to wait.
- Persist the wake outside the dying process. Kill a harmless job around checkpoint commit and alarm registration, then verify it resumes once intended and reconciles any uncertain external effect. Those receipts, not a resumed transcript alone, would establish the host's recovery.
- Measure idle resource use, wake latency and recovery interventions against the old host. Attention moves from supervising live waits to scheduling and storage custody; no current host inherits durable wakes merely by sharing Pi's package family.
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
-
Hermes keeps classic CLI work running after terminal detach
- CLI wrapper and bot operators: use stable 0.22.5, follow the persisted session identity and completion status, and stop treating terminal exit as cancellation. A continuing gateway can replace a wrapper kept alive only to supervise the chat process.
- Configure agent.run_budget_seconds rather than --run-budget on this path; -z does not itself bypass approvals. Use the documented alternative surfaces for unsupported worktree and image invocations. Record the serving gateway, home and profile alongside the client version.
- Detach from a harmless job, reconnect, cancel it deliberately and remove a saved permanent allow. Separately disable a plugin, then test HTTP requests and new websocket handshakes under each served profile. These checks do not establish termination of an already-open socket. Completion and refusal traces would settle the deployed lifetime and consent behavior. Saved terminal supervision may become gateway administration; no net orchestration saving was measured.
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
-
Gemini leaves directory references for the agent to explore
- Users with a working authentication route on 0.65.0: try pointing a fixed task at a repository directory before maintaining an eager directory-packing wrapper. The supported path lets the agent choose what to read instead of assembling every file in advance.
- Name required constraints and files explicitly. Compare files actually read, accepted output, latency, inference spend and human corrections with the old path; those results would settle whether selection saves attention on this repository. No token or task-quality gain was measured.
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
-
OpenHands packages mention-to-code work and a factory setup recipe
- Repository automation owners: try one bounded repository on Canvas 1.33.0 with its extensions 0.35.0 and matched services. Review the factory's proposed profiles, credentials and jobs before replacing manual request-to-branch coordination or custom onboarding.
- Inspect the deployed monitor, token owner, allowlists and work mode. The poller checks other authors' repository permissions, with explicit bypasses; the fallback template puts authorization and work restrictions in the prompt. Use reply mode for discussion, and avoid anyone plus implement when arbitrary commenters must not start code changes.
- Exercise an authorized request, an unauthorized mention and a request outside the work policy; inspect the branch and token used. Those results and review minutes per accepted PR would establish the deployed benefit. Updating Canvas does not prove saved monitors migrated.
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
-
Codex's released updater loads network policy before making requests
- Restricted interactive fleets: move to stable 0.164.0 and record the CLI and serving-daemon versions separately. The prior release wait is complete; automatic updates can now be evaluated against the fleet's saved restrictions.
- Before enabling the updater, test a denied destination and invalid configuration using the actual saved policy. Keep updates held until those tests pass. Recorded network refusals and a pinned-install update trace would settle enforcement and update timing in that installation.
- Budget restart and environment administration as well as patching. This replaces waiting for upstream delivery with a bounded deployment check; no daemon was launched, updated or interrupted in this research.
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
-
Claude's managed guard preserves policy asks over user mods
- Managed mod and CI owners: use latest 2.1.310 for the complete current repair set, verify the built-in guard is seated, and keep allowManagedModsOnly=true where user code must not join policy. Released delivery ends the old wait; it does not sandbox admitted mods.
- Set the permission mode in each unattended job. Without one, fresh installs, third-party providers and telemetry-disabled headless sessions now use default. A job unable to ask can stop where it formerly used auto, creating a deliberate policy decision before dispatch.
- Test a rule-backed ask against a user-mod allow, an environment-pin change and decider: "person" with neither a dialog nor host callback available. If a human must decide, verify that any host callback actually routes to one. Refusal traces in each deployed mode would settle enforcement; regenerate mod types before using this decider because the public type mirror lags it.
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
-
OpenClaw's Bash predicate repair has not reached a published channel
- POSIX Gateway owners relying on exec allowlists: restrict adversarial shell work and host exposure until a published version contains this repair. Enforce any interim predicate restriction outside the affected classifier, with whole-process containment and narrowly scoped credentials where untrusted work must continue.
- Watch for a containing stable tag, then run harmless substitution and case-variant refusal tests through the real approval chain. Tag ancestry plus recorded refusals would settle delivery and deployed enforcement; the maintainer's production-chain probe was not reproduced here.
- The separately released final-hook-argument binding does not repair this shell classifier. Review effort cannot protect a request that the classifier never sends for approval; containment and release tracking now consume the attention that a narrow allowlist was meant to save.
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
-
Copilot's enabled sandbox now permits local-network access by default
- Terminal and ACP fleet owners: install stable 1.0.103 and set sandbox.allowLocalNetwork deliberately. Test a needed development listener and an unintended private service on each host; a functioning local development loop can now replace a workaround while exposing services an operator previously assumed were unreachable.
- Compare new and resumed ACP sessions with saved settings and launch flags, recording the actual server binary. For required containment, verify enabled=true, failIfUnavailable=true and allowBypass=false in managed policy. The 1.0.103 release and package establish delivery even though its final public notes commit is ahead of the source tag.
- Keep host-filter and Windows cases in the test matrix. Platform-specific connection and refusal traces would settle the deployed boundary; the narrow macOS exception does not prove every localhost path works. Use those results to decide whether saved configuration removes per-session repair work.
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
-
OpenClaw Workshop replaces proposals with immediate versioned edits
- Skill-library owners moving to 10.7: use the required patched Node runtime and replace the old proposal recipe. Set skills.workshop.autonomous.mode=off when a person must initiate learning; manual learning remains available. Off is not a new pre-application approval queue.
- If retaining auto, inspect changes already effective, exercise Undo and keep independent backups beyond ten versions. Learned Workshop skills bypass the ordinary per-agent skill allowlist, and background review uses an additional foreground-route model run.
- Port proposal integrations to current Workshop methods and recover needed drafts and old backups manually. A bad-edit/restore test plus correction minutes and review spend would establish whether the removed proposal queue saves attention rather than postpones it.
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
-
Paperclip brings Operator grants and durable accounting to stable
- Instance administrators: drain old writers and preserve SQLite lock files before upgrading to v2026.1023.0. Inspect human roles and persisted scopes before restart and sign-in; use a narrower role or a verified restrictive stored scope where configuration rights are unwanted, since missing grant rows can be reinserted. Existing scoped rows survive conflict handling.
- Finance and platform owners: retain unsettled receipts, choose the unpriced-usage policy explicitly and reconcile an interrupted/retried run against provider evidence. Persisted-grant comparisons and billed settlement traces would close acceptance; released code alone closes only delivery. Durable records can replace manual cost reconstruction.
- Inventory workers separately: stable's remote Codex range is >=0.149.0 and <0.161.0, so standalone Codex 0.164.0 is outside it. Keep the native call_api parity repair and later review/Stop fixes in their preview lane. A stable platform upgrade does not qualify those workers or fixes.
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
-
OpenCode 2.1 keeps old sessions readable while changing public APIs
- SDK, event-stream and plugin owners: inventory executable ownership and the running client/server pair, then adapt the 2.1 fields before upgrading the server to 2.1.4. Hold V1 deliberately with its own package rather than trusting GitHub's Latest label to select V2.
- Exercise a saved session, tool call/result, compaction and provider/model switch against the exact pair. Native compaction replay depends on provider and model; fallback to original history can change context cost. Successful import alone cannot settle integration compatibility.
- Use recorded API/event results and total migration and review time to decide whether the reusable host replaces custom glue. Independent harnesses supply real operating primitives too; their compatibility bill belongs in the attention calculation, and no matched saving was measured.
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
-
Interactive Codex shares a server that can move beyond its CLI pin
- Interactive fleets and evaluation owners: run 0.162.1 and record both codex --version and codex app-server daemon version. Use --no-daemon for a fixed per-launch baseline, or set {"updater":{"autoUpdateEnabled":false}} in CODEX_HOME/app-server-daemon/settings.json and restart the daemon.
- Restart after changing inherited credentials or PATH. Restart keeps the selected server package; it does not undo an earlier update. Shared service operation replaces repeated startup with environment and update administration. Disabling updates returns patch scheduling to the owner.
- Keep the updater off where managed network policy must hold on 0.162.1. A stable containing d570b3632b100e36f931797cdbdb8906d0fcafa8, now preview-only, plus blocked-network and failed-config probes would settle enforcement; a recorded pinned-install update trace would settle actual update behavior.
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
-
Pi's CLI connects MCP servers and composes their tools in JavaScript
- CLI integrators: try a configured MCP server and one multi-tool script on 1.2.0 before maintaining an equivalent bridge. Compare accepted outcomes, setup and review time before removing it; no net time saving or current-version quality comparison was measured.
- Read global and trusted-project mcp.json before launch. Stdio servers inherit Pi's environment and run beside the harness, so contain the whole process or scrub its environment. --no-mcp disables built-in MCP; autoEnableCodemode: false only prevents its automatic codemode activation.
- Keep authorization in hooks and govern script model credentials. Tool declarations and codemode-only presentation do not prove a callable-set restriction. Denial tests covering root calls, nested calls and model spend would settle a particular deployment's boundary; watch for tagged repairs to issue 10426 before relying on only-mode enforcement.
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
-
Eve approvals stop lending the approver's credentials to the requester
- Deployments admitting other approval responders or anonymous requesters with user-scoped connections: upgrade to 0.79.0; the credential repair first ships in 0.78.0. Inspect approval.settled events where responderPrincipalId differs from the requester, then audit effects under the approver's credentials, including later turn calls on 0.70.0 through 0.71.2.
- Rework flows that intentionally borrowed an IT or release approver's access. They stop working under consent-only execution; the proposed explicit credential-delegation API was unmerged at the 2026-10-13 cutoff. The human keeps responsibility for consent while tool policy owns execution authority.
- A requester lacking access must still be denied after an authorized second person approves. Record that test with both identities and the dispatched credential owner; it would establish the deployed boundary. The pre-0.70.0 affected range is unverified, and this fix does not close the separately signaled queued-text path.
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
-
A queued reply can approve a later Eve prompt; the repair was on main at cutoff
- Chat-approval owners: keep consequential effects off this affected typed-reply path until a containing release passes the exact sequence. A held turn and requester-owned credentials do not establish that the person saw the request they appeared to approve.
- Watch for a tag containing 0dea0ded869be7db30ae90ed8072d29e6e57df61. Queue approve before the prompt, verify no settlement or tool execution, then send a new answer after the prompt and verify the intended effect. Record delivery, hold and settlement order; main alone is not delivery.
- Retaining an application gate costs review attention now. Remove it only after the installed release passes the timing test; the patch does not establish closure of every default-steer timing case.
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
-
OMP extensions can revise a plan and answer its review
- Teams forwarding plan decisions between panes: try a reviewed extension using resolvePlanReview and openPlanReview on 18.10.4. Remote or policy-based review can now reach the actual decision instead of asking a person to copy the answer into the terminal.
- When plan choice must remain human, use --no-extensions or an exact trusted-extension allowlist. Project configuration and extensions still load without a trust prompt; Pi API-name compatibility does not import Pi's trust gate. Restricting extensions gives up this review automation.
- Exercise simultaneous terminal/extension answers, plan revisions and downstream denied tool calls before adoption. Those recorded results, alongside accepted work and review time, would settle usefulness and enforcement for the installed extension; the source API proves neither better judgment nor a reduction in total review.
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
-
OpenClaw's beta binds approval to a hook's final arguments
- Operators on either stable line: inventory before_tool_call hooks and remove or pin plugins you do not control. An approval for the original arguments does not cover a later replacement. Spend review on the hook's actual transformation rather than trusting the displayed approval.
- Plugin authors can try beta.3 and return requireApproval with final parameters. Test that an unapproved rewrite is blocked and an approved replacement executes exactly those parameters; plugins relying on silent replacement must change.
- A stable containing 34d07e7b0dc1b5f0ed54de67a9647d9e6b8c23de or a verified equivalent backport, plus the replacement-argument test, would settle adoption. Neither a future version number nor an issue closure proves inclusion; no exploit was executed here.
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
-
Claude mods join the permission chain before the classifier
- Managed fleets: use latest 2.1.296 and set managed pluginConfigs["cc-plugin-sec-default@builtin"].options.allowManagedModsOnly to true. Stable lacks later guard repairs. Before adding disableSideloadFlags, check CI invocations: it also rejects --agents and --mcp-config.
- Unmanaged users: inspect claude plugin validate for tool.check, then review or remove untrusted mods, or use --safe-mode or --settings '{"disableAllHooks":true}'; built-in mods remain. CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=0 is ineffective from 2.1.287. Keep whole-process containment because mods are unsandboxed.
- Plugin admission now requires reviewing code that can answer permission questions. A released binary containing the main guard's ask and environment holds, plus mode-specific denial tests, would settle that narrower repair; it would not turn the guard into hostile-code isolation.
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
-
Restricted Claude graders now filter built-ins registered after launch
- CI and evaluation owners using restricted graders: pin latest 2.1.296; 2.1.295 is the first release with the late-tool fix. Keep sandbox or container restrictions and --permission-prompts none where an ask must stop unattended work. A package on the stable channel is insufficient.
- Enumerate available tools after late registration and try a harmless excluded built-in, a deprecated alias and cross-session messaging. Record denial and absence of side effects before treating the tool set as effective. This acceptance work replaces a false restricted-mode assumption, not the grader's assessment of output quality.
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
-
OpenHands agents fill automation forms that can be saved and tested
- Operators preparing recurring jobs: trial a persisted, testable draft on Canvas 1.27.1 instead of manually copying fields from chat. Review trigger, schedule, profile and test output before creating the automation, and confirm the creator is the intended execution identity.
- Count setup and correction time alongside accepted runs before retiring a form-filling wrapper. Test saved-draft reload and a harmless scheduled run with the actual backend versions; those results would settle whether the handoff works on your stack. A UI tag alone does not prove Cloud delivery.
- Preserve credential separation when enabling administration: do not solve form access by handing untrusted local agents the stack key. Use the separately signaled local-secret checks before giving these jobs sensitive credentials. The gain is less duplicate entry; the person still decides which repeated work deserves their authority.
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
-
OpenHands' local terminal inherits a key that reaches excluded secrets
- npm, desktop and Docker-image users running terminal-enabled local conversations: keep production/deploy secrets out of this shared store when agents read untrusted repositories. Inspect the terminal environment and whether its effective key can retrieve a saved-but-excluded test secret.
- Where secret selection must hold, trial OH_CONVERSATION_RUNTIME=docker with OH_CONVERSATION_IMAGE pinned to ghcr.io/openhands/agent-server:1.54.0-python and exclude the automation key from the profile. This construction does not copy the outer alias wholesale; withholding it removes this inherited-key route to automation creation.
- Require a released alias removal, sanitization repair or automation-only key and denied-secret tests on both runtimes before trusting the boundary. Container construction alone is insufficient. The review moves from the profile label to actual terminal credentials and protected-route behavior.
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
-
Omnigent 0.18.0 closes a host escape through bubblewrap helper files
- Linux execution-host owners: install stable 0.18.0 on affected hosts and restart helpers, not only the central server. The 2026-10-13 nightly predates the patch. Until patched, use the advisory's disposable VM or container without sensitive host credentials or mounts.
- Inventory ACP, Goose, Kimi, Pi and Qwen helper processes and their running package versions. Check that launcher-directory write grants are rejected after restart; a patched server does not replace running host helpers.
- A fixed host package, restarted process identity and a test rejecting launcher-directory write exposure would establish deployed remediation. The advisory and source do not measure exploitation or qualify every sandbox backend. The patch requires host maintenance now instead of relying on model approval to contain already executing code.
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
-
Hermes 0.21.7 routes unattended Gateway commands through configured policy
- Unattended Gateway owners: upgrade to v0.21.7 and inspect approvals.unattended_mode before launch, especially a saved approve value. Previously model-approved jobs can now be blocked. Add only intended command_allowlist patterns rather than broadly disabling approval.
- Review flagged commands executed by earlier webhook sessions. Test a harmless denied command on each used no-notifier path and record whether it executes; test notifier-backed requests separately. Earlier user denies and hard floors remain, and container/YOLO/allowlist branches differ.
- Those mode-specific results would settle the installed policy's effect. The stronger retained stop can create exceptions needing attention, while no-notifier requests no longer depend on a human reply they cannot accept.
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
-
Temporal Code Mode waits without storing interpreter snapshots in workflow history
- Temporal teams building multi-step scripts: trial temporal-agent-harness[ui,code-mode]==0.6.0 on every serving workflow worker with pydantic-monty 1.0.0. This can replace batch-snapshot transport and custom wait bookkeeping; inspect the workflow host's execution authority.
- Keep old Code Mode histories on compatible workers until a versioned cutover passes representative 0.5.0-history replay on 0.6.0. Record worker and interpreter versions and outcomes. Replay risk is inferred, not a demonstrated universal failure; blind reset is not an established remedy.
- Authenticate and restrict origins on the approval service, whose 0.6.0 server still binds all interfaces without login and includes wildcard CORS. Make external effects idempotent. Test replay, denied routes and resumed effects before replacing application recovery code; fewer waits in process do not establish exactly-once effects or net attention savings.
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
-
Copilot CLI makes local sandboxing available to every user
- Individual and managed CLI users: install 1.0.97, move user settings to settings.json and try /sandbox enable or copilot --sandbox -p for a controlled job. Inspect /sandbox status and /sandbox policy, then perform one authenticated Git operation and one denied destination test.
- Fleets requiring containment must set sandbox.enabled and sandbox.failIfUnavailable true and sandbox.allowBypass false, verifying supported hosts and managed delivery. Server-managed enabled alone can be declined on unsupported hosts; built-in file tools use best-effort software checks.
- Scope each masked secret's injectHosts and inspect credential files separately. Test localhost workloads on macOS; Windows host rules rely on programs honoring the proxy. Full bypass restores ordinary credentials. Recorded platform-specific denial and credential-use results would settle the deployed boundary. This replaces some repeated credential inspection with maintained host lists and deliberate exceptions, without measured savings.
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
September 2026
-
Auto mode's judge moved to the server; the docs still list its isolation as none
- Gateway operators: pass the safeguards request field and safeguard_results response field through, or set CLAUDE_CODE_AUTO_MODE_SERVER=0; otherwise the first checked action in each session holds. Record which classifier decided from /status.
- Run auto mode that reads untrusted content inside the Bash sandbox or a container with egress control. The docs call that defense in depth; the published attack says it is the boundary.
- Evidence that would settle residual: vendor documentation stating what the server-side classifier reviews and how its decisions are logged, and a vendor statement on whether auto mode is a security boundary.
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
-
Stable sat on one build for eighteen days, then jumped 23 versions
- Pin minimumVersion to the fixes you need rather than trusting a lag. Stable 2.1.267 has the 2.1.257 authority batch; it lacks 2.1.273's fix for MDM MCP deny lists being ignored beside server-managed settings.
- If allowedMcpServers filtered managed-mcp.json, move exclusions to deniedMcpServers before the next stable hop.
- Evidence that would settle residual: a published stable-promotion log with dates.
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
-
A pinned plugin commit was a request, not a check, in four agents
- On Copilot CLI and Gemini CLI, treat a pinned plugin or extension as unverified: source it from a host that rejects 40-hex branch names or a repo you control, and check the installed tree's HEAD after install.
- The attacker must control the plugin repository. Background auto-update is what makes it zero-click; turn it off where you cannot verify sources.
- Evidence that would settle residual: a Copilot CLI release note or advisory naming the fix.
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
-
The harness's own git ran repository code before the trust prompt
- Upgrade Hermes to v2026.9.7 or later. Open untrusted repositories only inside a container or VM; the trust prompt appears after the harness's own git has run.
- Before opening a repo you did not create, check .git/config for command-valued keys such as core.fsmonitor and core.hooksPath.
- Evidence that would settle residual: a Claude Code changelog line or advisory for the second path, and Grok Build's status (unpatched at 1.0.13 per Manifold).
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
-
The approvals server binds every interface and asks for no login
- Run serve with --host 127.0.0.1 or behind an authenticating proxy. Anyone who can reach the port can list sessions, approve calls and switch a session to skip all approvals.
- Do not answer always to a bash prompt in the coding example; it approves the tool, not the command shown.
- Evidence that would settle residual: a release that binds loopback by default or adds authentication; #137 on main removes the operator-command channel but is in no tag.
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
-
Asking for Docker got you the host until v1.20.0
- If you set the Docker runtime on OpenHands before v1.20.0, assume those conversations ran on the host and audit what they touched. Upgrade to v1.20.0.
- Evidence that would settle residual: a runtime probe on v1.20.0 showing the conversation process inside the container.
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
-
The approved-exec fix finally shipped, and the long-term line moved to a build without it
- Run 2026.8.1 or later on the latest channel if you rely on the exec approval prompt. Do not read extended-stable as the safer choice; it is the unfixed one.
- Allow Always saved path-only grants before 2026.8.1 (GHSA-74gc); review persisted grants after upgrading.
- Evidence that would settle residual: an extended-stable build containing ab5611f0.
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
-
Codex changed its default model in a hotfix and removed mcp-server in a minor
- Pin model explicitly if cost, latency or eval baselines matter; a patch upgrade changed it. Grep configs for gpt-5.5 before its 2026-10-14 retirement from ChatGPT sign-in.
- Integrations built on codex mcp-server break at 0.154.0; the app server is the path.
- Do not plan as if a model reviews every call: Guardian V2 is off, and Guardian itself no longer runs in two modes.
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
-
Gemini CLI's autoEdit path rule never loaded, and its macOS sandbox reached Docker
- Upgrade to 0.60.0. Treat autoEdit sessions on 0.57.0 or earlier as having written wherever the model chose, and macOS-sandboxed sessions with a container runtime running as host-capable.
- 0.60.0 breaks MCP OAuth servers that omit iss and web_fetch to local dev servers, by design.
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
-
The harness changed the bill, not the grade
- For API-metered work, measure your own tasks in a minimal harness before assuming the vendor harness earns its overhead. The study is 30 tasks per benchmark; long-horizon and subscription use are outside it.
- Hooks or transcript parsers keyed on TodoWrite or TaskOutput lose their signal on current Claude models; delete CLAUDE.md shims that only point at AGENTS.md once past 2.1.277.
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
-
When Omnigent's policy server is down, the wrapped harness decides
- Upgrade shared Omnigent servers to v0.14.0. Anyone who can upload an agent bundle could get a host shell before it.
- Know which layer refuses: during a policy-server outage your Omnigent deny rules do not apply to native tool calls; the harness's permission mode does. Set that mode as if Omnigent were absent.
- Evidence that would settle residual: a tag containing the editor shell-proxy fix (#7619), which reached v0.15.0 on 2026-09-22, after this window.
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
-
Queued messages from different users ran under the last sender's authorization
- If you set turnPolicy queue on a multi-user channel, run eve@0.52.5 or later; before it, one user's message could run with another's authority.
- Rotate any BYOK provider key served by an eve deployment older than 0.52.5.
- Evidence that would settle residual: the first version that exposed the BYOK key, which the release notes do not state.
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
-
In OMP, the repository you open can write the policy that governs it
- Do not open an untrusted repository in OMP. Inspect .omp/config.yml, .omp/extensions and package.json omp.extensions or pi.extensions in any clone first.
- Upgrade to v18.2.1 or later for the approval and collab fixes. Do not reuse a Pi extension's trust check as a guard under OMP. This is a fact about OMP; Pi has had a trust prompt since June.
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
August 2026
-
Guardian V2 is in Codex 0.148.0 and the feature flag is still off
- Upgrade the default install to 0.149.0 if you stayed on 0.147.0. Treat it as a large upgrade, not a point release.
- Do not plan as if a model now gates every tool call. Turning Guardian V2 on is a feature flag. If you enable it, prefer 0.149.0: scoring errors fail open in 0.148.0. Search configs for untrusted before 0.149.0. Evidence that would settle residual: a config dump from a stock 0.149.0 install showing features.guardianv2 enabled, or vendor docs stating the default.
- If you embed the SDK, the vendor's own 2026-08-20 post says the app owns approvals. That is the opposite of an invisible in-harness reviewer. Reconcile which seat you actually run.
-
v2.10 ships the ACP bridge and interactive browser; the v2.9 SSRF tests survived
- Upgrade to v2.10 if you want ACP or the live viewport. Then turn ACP off if you do not want an editor-hosted endpoint with host write and host exec, and do not treat chats as separate browsers: cookies are shared.
- The v2.9 tests are still there. Diff plugins/_document_query/helpers/fetch.py after the next plugin extract. Do not read a missing plugins/_document_query/tests/ directory as missing coverage; the tests live at repo-root tests/.
-
The approved-exec fix is still in no release
- A tagged install still can run different bytes than the ones you approved. Say that to anyone relying on the prompt.
- Evidence that would settle: any tag where ab5611f0 is an ancestor.
-
rc.8 still has no privileged core, and the Web UI still has no login
- Still a developer preview. Do not expose the port.
- Read architecture.md at 141eb6fe before installing a plugin. Inspect a bundle's permission mode; do not attribute it to Claude Code or Codex alone. Pin bundle packages at 0.1.0-rc.8; npm latest on those packages is still 0.0.1-rc.1.
-
The filesystem-write broker is now an npm version; 17.3.6 still is not
- If you run OMP 17.3.7+, inspect extensions for registerFileWriteFallback. The OS denial is no longer the last word.
- Name the install path. There is no npm 17.3.6. Window-close Homebrew, npm, Bun, and omp.sh/install all land 17.4.0, which breaks global countTokens. Pin 17.3.7 if you only wanted the write hook. 17.4.1/17.4.2 are the next day.
-
turnPolicy queue did not bind from 0.34.0 through 0.39.2
- If you set queue after 0.33.0, 0.39.3 is the first tag that actually queues. Re-test Slack and custom channels. Pin eve@0.42.0; do not take unpinned npm.
- A documented control that does not bind is the same class as a classifier in the tag and off: the setting is present, the default path ignores it. Evidence that would settle residual: a runtime dump from 0.39.3 showing compiled channel.turnPolicy equal to the configured queue value.
-
Everything is a plugin, including the components that enforce the limits
- If you write a dsh plugin, understand that your plugin is not governed by the approval gate in the way a tool is governed by a permission system. It sits in the same layer the gate does.
- Ask of any plugin-everything architecture: which component is not replaceable? If the answer is none, then the enforcement story is a convention rather than a boundary.
- This is developer preview and the whole project ships to a prerelease. Nothing here is an upgrade instruction; it is a design question to settle before this reaches a stable channel.
Run: 2026-08-17-weekly-digest-2026-08-10_2026-08-17-frontier-v0
-
Nothing authenticates the Web UI, and the code fence says so in its own comment
- Do not expose that port. Loopback-only is the entire access control, so any tunnel, container port mapping, or reverse proxy in front of it is the whole security boundary.
- Treat a third-party plugin as code you are running in-process with no declared permissions, because that is what it is. Read it before you install it.
Run: 2026-08-17-weekly-digest-2026-08-10_2026-08-17-frontier-v0
-
An SSRF fix was lost inside a plugin refactor and shipped broken through eleven stable releases
- Upgrade to v2.9 if you run document query against untrusted or user-supplied URLs.
- A CVE fix is not a permanent property of a codebase. If you track advisories to decide you are safe, you are tracking the announcement rather than the code, and this is the case that shows the difference.
- This is the plugin-boundary argument from its least theoretical side. The refactor that lost the fix was the refactor that made things plugins.
Run: 2026-08-17-weekly-digest-2026-08-10_2026-08-17-frontier-v0
-
Fifteen out of fifteen destructive Windows commands passed approval silently
- If you ran this agent on Windows before the fix, your approval gate was not a gate for this class of command. Re-audit what ran rather than assuming the prompts you saw were complete.
- Approval logic written against one platform's shell grammar does not transfer. If a harness supports multiple platforms, ask which platform its matching rules were written for.
Run: 2026-08-17-weekly-digest-2026-08-10_2026-08-17-frontier-v0
-
Approved exec could run different bytes than the ones you approved
- The fix is on the default branch and in no release. State that plainly to anyone relying on the approval prompt in a stable install.
- When the same defect class appears in two unrelated codebases inside a fortnight, treat it as a property of the pattern rather than of the vendor. If you build approval UI, the invariant to test is that the string displayed and the string executed are the same object, not two renderings of one intention.
Run: 2026-08-17-weekly-digest-2026-08-10_2026-08-17-frontier-v0
-
A filesystem-write broker landed in two tags that no install path but Nix can reach
- If you embed this agent and register a write-fallback handler, that handler's allowlist is now your filesystem policy and needs reviewing as one.
- Name the install path when you report a version of this project. Four paths exist and they did not agree on the day of this harvest.
Run: 2026-08-17-weekly-digest-2026-08-10_2026-08-17-frontier-v0
-
Two default install paths stopped carrying the work, in different ways and for different reasons
- Check which channel your fleet is actually on before assuming a fortnight's security fixes reached it. Choosing the conservative channel is a decision to receive fixes later, and that tradeoff is worth making on purpose.
- If you benchmark or write about a project from its default branch, say which channel your claims describe. For ten days the most-discussed work in one of these projects was on a channel you had to name explicitly to install.
Run: 2026-08-17-weekly-digest-2026-08-10_2026-08-17-frontier-v0
-
The lab's own harness ships a supported path to run rival models and drive rival harnesses
- A harness that runs any model and drives other harnesses is a hedge against the thing its own vendor sells. Read it as evidence about where that vendor thinks the lock-in is, and note that the answer is not the model.
- For an operator, this is the cheapest available test of whether a harness is really model-agnostic: run it against a competitor's model on the supported path and see what breaks.
Run: 2026-08-17-weekly-digest-2026-08-10_2026-08-17-frontier-v0
-
Shell commands could hide part of themselves from the approval prompt, in the fortnight the prompt stopped being the default
- Upgrade past 2.1.224, then re-read your own sandbox deny rules for trailing slashes. That defect invalidated configuration an operator wrote and believed in, and nothing surfaced the failure.
- Approval logs from before this window are evidence of what was asked, not of what ran. If you retain transcripts for audit, the recorded approval and the executed command can differ, and no artifact you hold identifies which sessions were affected.
- Enumerate custom agent definitions: a separate fix closed an agent definition whose bypass mode ignored an organisation policy that had disabled it.
Run: 2026-08-10-weekly-digest-2026-08-03_2026-08-10-frontier-v0
-
A malformed allowlist entry auto-approved every command, and admin controls did not apply for the first five minutes of a session
- A deny or allow list is only a control if a malformed entry fails closed. Test yours with a deliberately broken rule and confirm the result is a refusal rather than a permit.
- Any short-lived session that ran under five minutes was, for its whole life, a session where the protocol admin controls did not apply. CI jobs and scripted runs are exactly that shape.
Run: 2026-08-10-weekly-digest-2026-08-03_2026-08-10-frontier-v0
-
Codex ships a flag that puts a model, not a human, in the approval seat, and says so in its name
- Decide deliberately whether a model reviewing a model is the control you want, and write it down. This is the choice of the fortnight, and taking it by default is different from taking it on purpose.
- Do not describe the flag as having the final say. Later subcommand overrides still apply, so the effective policy is a composition rather than a single setting.
Run: 2026-08-10-weekly-digest-2026-08-03_2026-08-10-frontier-v0
-
Any directory can replace the operator's context file, and it loads before project trust is resolved
- Treat cloning an untrusted repository as an action that can change your agent's instructions before you have decided to trust it.
- The credential commands are ungated from the tool the agent itself drives, so an agent that can run a shell can print your provider token. There are now three such commands where the last window recorded two, which is movement in the wrong direction.
Run: 2026-08-10-weekly-digest-2026-08-03_2026-08-10-frontier-v0
-
Standard-trust agents got default-open write access to any company-visible issue they can read
- Audit what your standard-trust agents can see, because in this release that set is also what they can change.
- This is the platform-shaped version of the window's argument: the authority question is not only what an agent may do to a machine, but what it may do to the shared record an organisation is coordinating on.
Run: 2026-08-10-weekly-digest-2026-08-03_2026-08-10-frontier-v0
-
The workspace-boundary fix is on neither stable channel, and the one that moved this window still ships without it
- Re-audit rather than upgrade-and-relax. Both stable channels are checkable in one command: neither published tarball contains the new path-resolution functions.
- Do not treat the sandbox path assertion as the barrier between an agent and the rest of the host on a stable channel. Keep agent workspaces on filesystems you would be willing to expose.
- Watch for the first non-prerelease tag on the 2026.8 line. That is the earliest point the fix can reach a stable channel.
Run: 2026-08-10-weekly-digest-2026-08-03_2026-08-10-frontier-v0
-
Two projects moved authority back toward the human in the same week, and one of them made a class of write always stop
- This is the half of the window that a defect-only reading misses, and it points at a design rule worth copying: pick the file class that changes agent behaviour and make writing to it unconditionally interactive, rather than enumerating the ways it can be reached.
- If you run servers you did not write, the untrusted marking is a real setting to turn on rather than a posture statement.
Run: 2026-08-10-weekly-digest-2026-08-03_2026-08-10-frontier-v0
-
OpenHands' Latest release is three minor versions below a release from three weeks earlier, on the same line
- Anything that orders versions rather than dates -- a package constraint, a Renovate or Dependabot rule, a pinned container tag, an internal currency check -- reads 1.11.0 as greater than 1.8.0 and will treat the newer release as a downgrade. Pin OpenHands by tag or digest and resolve currency by publish date until the series passes 1.11.0.
Run: 2026-08-03-weekly-digest-2026-07-27_2026-08-03-frontier-v0
-
Omnigent's spend cap is enforced before the call, and is a downgrade gate rather than a ceiling
- An operator who sets max_cost_usd expecting spend to stop at that number has not configured that. Spend continues past the cap on any model outside expensive_models. Set the cap and the expensive_models list together, and treat the number as the point where the session gets cheaper rather than the point where it ends.
Run: 2026-08-03-weekly-digest-2026-07-27_2026-08-03-frontier-v0
-
The only write confinement for Omnigent's unsandboxed workers did not bind on Windows
- The fix is on main and in no tag: v0.7.0 was published 2026-07-27, six days before the fix merged, and is still the newest release. An operator running the tagged release with unsandboxed implementer workers on a Windows runner does not have absolute-path confinement. Run main, or do not run those worker specs on Windows until the next tag.
Run: 2026-08-03-weekly-digest-2026-07-27_2026-08-03-frontier-v0
-
Gemini CLI's a2a-server read its trust decision out of the directory whose trust was in question
- Upgrade past v0.53.0 before pointing a2a-server at any repository you did not write. On earlier builds the workspace trust prompt was not a boundary for that backend, because the answer was read from inside the workspace.
Run: 2026-08-03-weekly-digest-2026-07-27_2026-08-03-frontier-v0
-
OpenClaw's workspace boundary fix reached beta and stopped there
- On stable OpenClaw the workspace boundary is still not a containment barrier, two windows after the bypass was first recorded. Either run the beta deliberately, or do not treat the workspace path as a security boundary for agents handling untrusted content.
Run: 2026-08-03-weekly-digest-2026-07-27_2026-08-03-frontier-v0
-
Antigravity widened what one approval covers, in a product with no source to check it against
- Approving one command in Antigravity now approves later commands matching the same pattern for the remainder of the conversation. Treat each approval as scoped to the conversation rather than the command, and start a new conversation to reset the grant.
Run: 2026-08-03-weekly-digest-2026-07-27_2026-08-03-frontier-v0
-
Hermes tagged the approval guardrails, and put back a runaway limit it had removed
- The release that flipped approvals to a classifier default now ships the controls written to bound it. Upgrade to v2026.8.3 and set approvals.smart_policy explicitly rather than inheriting it, and confirm the delegate_task cap is active if you run background subagents.
Run: 2026-08-03-weekly-digest-2026-07-27_2026-08-03-frontier-v0
July 2026
-
Hermes moved the approval decision from a human to a model, and shipped it without the guardrails built for it
- Anyone upgrading to the current tag hands a decision to a classifier and does not receive the controls intended to bound it. Pin to v2026.7.7 if you need the human default, or upgrade deliberately and set approvals.mode explicitly rather than inheriting it.
Run: 2026-07-27-weekly-digest-2026-07-02_2026-07-27-frontier-v0
-
Antigravity headless runs honored no configured policy at all until 1.1.4
- 1.1.4 is the hard floor for any unattended or CI use of the agy binary. If you ran headless before it, your permissions, sandbox, and artifact review were not applied, so re-audit what those runs were allowed to touch rather than assuming the configuration held.
Run: 2026-07-27-weekly-digest-2026-07-02_2026-07-27-frontier-v0
-
Claude Code permission rules did not refuse what they described, and the fix missed the channel most people run
- Move to the latest channel or pin minimumVersion to 2.1.214, then re-test any rule you rely on by writing a deny and confirming the action is actually refused. An operator who wrote Edit(src/**) believed they had scoped write access to one directory and did not have it.
Run: 2026-07-27-weekly-digest-2026-07-02_2026-07-27-frontier-v0
-
The governance-first platform had four human gates that did not bind
- Platform-hosted governance is not a substitute for testing the gate. If you chose a managed runtime specifically for its approval and budget controls, verify each one behaves as documented on the version you run, including what a denial actually does.
Run: 2026-07-27-weekly-digest-2026-07-02_2026-07-27-frontier-v0
-
OpenHands thawed its open-source tags for four days, then refroze with the release sitting in draft
- Self-hosters should move to 1.11.0 rather than following the documented 1.8 image, which carries every advisory 1.9.0 closed, and should decide whether to track main for the vite fix or accept the exposure until a tag arrives.
Run: 2026-07-27-weekly-digest-2026-07-02_2026-07-27-frontier-v0
-
OpenClaw's sandbox check returned success while the escape worked
- Do not treat the workspace boundary as a containment barrier on any current release, and resolve which build you are actually running from the package registry rather than the release page.
Run: 2026-07-27-weekly-digest-2026-07-02_2026-07-27-frontier-v0
-
Claude Code background agents now commit, push, and open draft PRs instead of stopping to ask
- Claude Code v2.1.198 makes subagents background by default and says background agents launched from `claude agents` now commit, push, and open a draft PR after worktree code work instead of stopping to ask.
- Before upgrading shared repos, decide whether background agents may write commits and branches, wire Notification hooks, and rely on branch protection rather than a human sitting at the terminal.
Run: 2026-07-02-weekly-digest-2026-07-01_2026-07-02-frontier-v0
-
Hermes v2026.7.1 tags the security wave that was main-only last issue
- Hermes v2026.7.1 ships the prior main-only wave: MCP-config persistence hardening, cron `base_url` credential-exfiltration blocking, prefix-secret sentinels for file reads, Slack `xapp-` token redaction, browser cloud-metadata guardrails, resume/session scoping, and a dependency floor.
- Upgrade from v2026.6.19 if you were waiting for a tag. The channel question changed from 'run main or wait' to a normal release upgrade.
Run: 2026-07-02-weekly-digest-2026-07-01_2026-07-02-frontier-v0
-
Codex 0.142.5 stops writing full Responses WebSocket payloads to trace logs
- Codex rust-v0.142.5 says full Responses WebSocket request payloads no longer go to trace logs.
- Upgrade where traces are retained, centralized, or shared. Then restrict or purge older traces because the old behavior may have logged prompts, repo content, or secret-bearing tool inputs.
Run: 2026-07-02-weekly-digest-2026-07-01_2026-07-02-frontier-v0
-
Gemini CLI fixes a memory-import symlink escape in nightly only
- Nightly v0.51.0-nightly.20260702.gff00dacd9 fixes a symbolic-link directory escape in the memory import processor.
- Stable users do not have a shipped fix yet. Avoid untrusted `GEMINI.md` memory imports or track the nightly until a preview/stable tag absorbs it.
Run: 2026-07-02-weekly-digest-2026-07-01_2026-07-02-frontier-v0
-
OpenHands shipped its dependency-CVE fixes on the cloud channel; the OSS 1.8.0 line is frozen and a new CVE already sits untagged on main
- Last window's unreleased dependency-CVE batch reached tags this window -- but only on the CLOUD channel: cloud-1.39.0 (2026-06-24, ~16-item CVE/dependency batch) and cloud-1.40.0 (2026-06-26, a 4-item CVE/GHSA batch). The OSS line got NO new tag; the newest non-cloud release is still 1.8.0 (2026-06-10).
- It is worse than merged-vs-shipped: it is now cloud-vs-self-host. A managed OpenHands Cloud tenant is patched; a self-hoster on the 1.8.0 tag is not, with no fixed OSS tag to move to. And a fresh authlib CVE (CVE-2026-44681 -- an unauthenticated open redirect in Authlib's OIDC grant, CWE-601, phishing-grade at CVSS 6.1; commit e6fe505) already sits on main after cloud-1.40.0 -- untagged again.
- Determine your channel and act on it: on Cloud, you are covered; on the OSS 1.8.0 tag, you are unpatched for this batch and must either run a build from main (inheriting all its churn) or wait for an OSS tag that has not come for three windows.
Run: 2026-07-01-weekly-digest-2026-06-24_2026-07-01-frontier-v0
-
Google retired consumer Gemini CLI (June 18) and force-migrated users to closed-source Antigravity -- which hardened one approval gate and auto-opened another the same week
- Per Google's own announcement, consumer Gemini CLI stopped serving requests on 2026-06-18 (AI Pro/Ultra, free individual Code Assist, new GitHub-org installs). Enterprise Code Assist retained access and the OSS gemini-cli repo stays Apache-2.0. The successor, Antigravity CLI (the `agy` binary), is closed-source Go. If you ran Gemini CLI as an individual, your path is now a binary you cannot read.
- Antigravity's governance is real and moved both ways in one release train: 1.0.13 (06-27) made 'Always Approve' rule matching strict (non-regex) by default -- a tightening -- while 1.0.14 (06-30) added an 'always proceeds' mode that auto-approves a subagent's artifacts -- a loosening. Audit your migration: the closed binary's subagents can now approve their own work.
- Decide deliberately per tier: enterprise stays on Gemini CLI unchanged; individuals migrate to Antigravity (closed) or move to an open harness; anyone who needs to audit enforcement should treat a closed governance claim as unverifiable until probed.
Run: 2026-07-01-weekly-digest-2026-06-24_2026-07-01-frontier-v0
-
Hermes landed a full security wave on main -- path-escape, command-approval-bypass, secret redaction -- and tagged none of it (still v2026.6.19)
- Three real hardening fixes hit main in-window: a path-traversal fix (model-supplied tool-call IDs could escape the tool-result storage directory), a command-approval-bypass close (GNU long-flag prefix abbreviations of `chown --recursive` and `git push --force` slipped past the guard), and secret redaction in user-facing approval prompts. None reached a tag; the newest release is still v2026.6.19 (2026-06-19).
- If you run the v2026.6.19 tag you have none of these. The approval-bypass in particular means a guard you believed was blocking `chown --recursive` / `git push --force` could be defeated by an abbreviated long flag on the tagged binary. Track main or wait for a tag, but know the gap.
Run: 2026-07-01-weekly-digest-2026-06-24_2026-07-01-frontier-v0
-
Claude Code 2.1.196 closes an MCP self-approval hole and binds Remote Control to the Anthropic host
- 2.1.196 is a security release: `claude mcp list`/`get` no longer spawn `.mcp.json` servers that a repo self-approves -- closing a path where merely inspecting MCP config in an untrusted repo could launch a repo-declared server. And Remote Control is now disabled when `ANTHROPIC_BASE_URL` points at a non-Anthropic host (org-configurable), so a redirected base URL cannot silently drive remote control.
- Upgrade to 2.1.196+ and re-audit MCP trust in any workflow that opens untrusted repositories; if you proxy `ANTHROPIC_BASE_URL`, confirm the new Remote Control binding matches your intent.
Run: 2026-07-01-weekly-digest-2026-06-24_2026-07-01-frontier-v0
-
Codex 0.142.2 gates uninspectable PowerShell behind approval and switches MCP tool discovery to tool-search by default
- 0.142.2 (stable, 06-25) tightened PowerShell safety: commands with AST regions the classifier cannot inspect now require approval rather than auto-running. Windows operators running Codex unattended may see new approval prompts (or refusals in non-interactive mode) where PowerShell previously executed -- re-audit unattended Windows pipelines before upgrading.
- Same release makes MCP tools use tool-search by default (rather than dumping the full tool list). Re-verify MCP-backed workflows still resolve the tools you expect against your model/provider.
Run: 2026-07-01-weekly-digest-2026-06-24_2026-07-01-frontier-v0
-
Gemini CLI's OSS repo shipped the skill path-traversal fix to stable (v0.49.0) and renamed coreTools -- fixes now landing in a CLI whose consumers were cut off
- Carry-forward resolved: the skill-install path-traversal fix, stranded in preview for two windows, reached STABLE in v0.49.0 (2026-06-25). Same release renamed the `coreTools` setting to `tools.core` -- a breaking config change to migrate. Newer `@file` defensive path resolution + null-byte sanitization landed on main (commit b5fc06e), not yet stable.
- The pointed part: these fixes ship to an OSS CLI whose consumer service Google shut down on June 18. If you are on the OSS repo (enterprise or BYO-key), upgrade to v0.49.0 and migrate the config; if you were a consumer, this fix is not for you -- you are on Antigravity now.
Run: 2026-07-01-weekly-digest-2026-06-24_2026-07-01-frontier-v0
-
Paperclip v2026.626.0 tags its master-only control plane: daily run/cost budget caps, a split skills:create permission, cross-company auth hardening
- Carry-forward resolved: v2026.626.0 (2026-06-27) tagged 128 commits of previously master-only control-plane work. The operator-relevant pieces: hard daily run-count and cost ceilings enforced before an adapter runs (preflight budget caps), skill mutations now gated behind a dedicated `skills:create` permission split from `agents:create`, and cross-company access authorization hardened with single-issue read enforcement.
- If you run Paperclip, these are now in a stable tag you can adopt: wire the budget caps to bound runaway spend, and split skill-creation authority from agent-creation in your permission model.
Run: 2026-07-01-weekly-digest-2026-06-24_2026-07-01-frontier-v0
-
Sonnet 5 propagated across harnesses in one week: Claude Code makes it the default (1M context); Pi adds support
- Claude Code v2.1.197 (2026-06-30) makes Claude Sonnet 5 the default model, with native 1M-token context. Pi v0.80.3 (2026-06-30) added Sonnet 5 support (Anthropic-compatible + Bedrock) the same week. A new frontier model became a default and a cross-harness option within days.
- Know your default changed: if you pin models for cost/behavior reasons, confirm whether you are now on Sonnet 5 with a 1M window (and the cost/latency that implies), or set the model explicitly.
Run: 2026-07-01-weekly-digest-2026-06-24_2026-07-01-frontier-v0
June 2026
-
heypi's headline feature is approvals, but nothing requires approval by default
- The docs are explicit: `approval does not make every tool call require approval. Tool confirmation does that.` Out of the box the only automatic gate is the bash `approval.command()` classifier (blocks destructive, asks on risky, allows low-risk); every other tool runs without a human gate until you wire `approval`/`confirm` per tool. An operator who adopts heypi *for* its approvals must author them; the default is not a human-in-the-loop posture.
- The companion 'audit trail' is typed trace events surfaced in the admin panel -- which is itself disabled by default and binds loopback. To actually get the reviewable record the marketing promises, you must enable and operate the admin panel (or read `heypi events`).
- Before deploying, decide which tools must gate on a named approver and wire them; do not assume the framework's headline posture is its default.
Run: 2026-06-24-weekly-digest-2026-06-23_2026-06-24-frontier-v0
-
heypi 0.2.0-beta.0 breaks root-level approver config and makes webhooks HTTPS-by-default -- and it is a beta
- 0.2.0-beta.0 (2026-06-23) moves approver/admin identity from a root-level `approval.approvers`/`approval.admins` block to adapter-local `permissions`, and root-level config now FAILS at startup. Webhooks are HTTPS-by-default (plain HTTP needs `unsafeReplyHttp: true`), and the durable instruction file renamed `prompt`/`soul` to `instructions`. An operator upgrading from 0.1.x must migrate config or the app will not start.
- It is a `-beta.0` pre-release, and heypi publishes no GitHub Releases at all -- the newest fixes already sit on `main` past the tag. Decide deliberately: pin 0.1.3 for stability, or adopt the beta and track `main`, but do not run a beta as if it were a stable line.
Run: 2026-06-24-weekly-digest-2026-06-23_2026-06-24-frontier-v0
-
heypi keeps secrets out of chat and the model context, but they rest plaintext-readable in the runtime workspace
- The `secret_request` flow encrypts secrets client-side (WebCrypto) so they are `not stored as chat history and is not sent to the model` -- a genuine win over pasting credentials into a channel. But the docs are equally explicit that secrets land as scoped runtime files (`.secrets/<name>`) and `Anyone who can read the scoped runtime workspace can read saved secrets`.
- Do not treat heypi's secret handoff as a vault. Restrict who and what can read the runtime workspace (and choose a sandboxed runtime accordingly), and remember `pending secret requests are lost on process restart`.
Run: 2026-06-24-weekly-digest-2026-06-23_2026-06-24-frontier-v0
-
For shared or team-facing heypi bots, the sandbox runtime is an explicit choice -- host runtimes ship with only a warning
- The default `just-bash` runtime is an in-process interpreter with a virtual filesystem and network off by default; Docker and Gondolin (a warm QEMU VM per scope) are opt-in isolation. The host runtimes (`host-bash`, `guarded-bash`) run against the real machine and emit only a startup warning: `For shared or team-facing bots, prefer just-bash, Docker, or Gondolin.`
- Choose the runtime before exposing a bot to a channel: a warning is not a boundary. For anything multiplayer, select an isolating runtime explicitly rather than relying on the default or accepting a host runtime past its warning.
Run: 2026-06-24-weekly-digest-2026-06-23_2026-06-24-frontier-v0
-
OpenHands shipped a five-item dependency-CVE batch to main on 2026-06-23 -- in no tagged release
- A batch of dependency security fixes landed on `main` on 2026-06-23 -- CVE-2026-44727 (jupyter-server 2.20.0), CVE-2026-49458 (dompurify 3.4.6), GHSA-6v7p-g79w-8964 (msgpack 1.2.1), CVE-2026-45409 (idna 3.15), GHSA-gj48-438w-jh9v (bleach 6.4.0) -- but no tag was cut; the only release remains 1.8.0 from 2026-06-10.
- Determine which channel you run. An operator on 1.8.0 has none of these fixes; an operator on a build from main has them. This is the same merged-vs-shipped gap that defined last window, now continuing into this one -- 'fixed' is true on main and false in the binary most operators run.
Run: 2026-06-24-weekly-digest-2026-06-23_2026-06-24-frontier-v0
-
The five-level subagent depth cap did not bind for foreground spawns until 2.1.181
- 2.1.181 fixed foreground subagents spawning unbounded nested chains; they now respect the same 5-level depth limit as background subagents. An operator who relied on last window's depth cap (2.1.178) for foreground delegation was, in the interim, not protected by it.
- Upgrade past 2.1.181 and re-test that a foreground delegation tree actually stops at five levels rather than assuming the announced cap binds.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
Agent(type) deny and Agent(x,y) allowed-types rules were not enforced for named subagent spawns until 2.1.186
- 2.1.186 fixed `Agent(type)` deny rules and `Agent(x,y)` allowed-types restrictions not being enforced for named subagent spawns. An operator who wrote those rules when the argument-aware grammar was announced was unprotected by them until this fix.
- Upgrade past 2.1.186, then write an `Agent(type)` deny for a subagent you expect blocked and confirm a named spawn is actually refused, not silently allowed.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
Auto mode now blocks specific destructive git/IaC commands and reclassifies scheduled-task and webhook triggers
- 2.1.183 enumerated destructive commands the auto-mode classifier now blocks — `git reset --hard`, `git checkout -- .`, `git clean -fd`, `git stash drop` (when you did not ask to discard work), `git commit --amend` for commits the agent did not make this session, and `terraform`/`pulumi`/`cdk destroy` unless you asked for the specific stack.
- 2.1.183 also fixed scheduled-task and webhook trigger deliveries being treated as keyboard input; they now classify as task notifications and can no longer approve a pending action or set the session title under auto mode.
- Operators running auto mode should upgrade past 2.1.183; the blocks are conditional (gated on what you asked for), not unconditional refusals.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
Codex command and network approvals are now scoped per execution environment and fail closed on ambiguity
- CLI 0.142.0 (#28738, #28899) scopes command and network approvals by execution environment: an approval granted in one environment no longer leaks to another, Codex denies when active-call attribution is ambiguous, and it fails closed if an environment-specific proxy endpoint cannot be prepared.
- Upgrade to 0.142.0 and re-test approval reuse: grant a command approval in a local workspace and confirm a remote executor environment prompts again rather than inheriting it.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
Codex rollout token budgets abort turns on exhaustion — a hard spend cap at the accounting boundary
- CLI 0.142.0 makes configurable rollout token budgets track usage across agent threads and abort turns when exhausted — a hard spend cap, not a warning. It is soft in timing: it lands at the next usage-accounting boundary with no cross-thread interrupt fan-out, so an in-flight expensive call can still complete.
- Set a rollout token budget and watch it abort a long multi-turn run at the accounting boundary; do not assume an instantaneous mid-response kill. Behavior under real multi-agent load is undocumented.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
Codex adds a multi-agent delegation-authority mode
- CLI 0.142.0 adds a multi-agent delegation-authority mode, giving operators a configurable posture for how authority flows to delegated agents. It is the control surface to set before trusting a delegation tree under the new shared token ledger.
- Operators orchestrating delegated Codex agents should choose the delegation-authority mode deliberately rather than inheriting a default.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
Hermes adds a root-owned, user-immutable /etc/hermes managed scope
- PR #49098 (in v0.17.0 / v2026.6.19) adds a managed `/etc/hermes` scope: a root-owned, user-immutable layer of config and secrets that wins per-key over a user's own files. It is Hermes's first centralized, OS-backed policy pin, for a tool whose posture had been governs-through-allowlists, not identity services.
- Operators wanting an OS-enforced policy floor can now pin config and secrets a user cannot override; audit which keys the managed scope wins so credential flow stays legible.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
Last window's multi-tenant authority cluster finally tagged in v2026.618.0
- v2026.618.0 (June 18) is the tag that finally contains last window's master-only authority cluster: cloud-tenant instance-admin deprivileging (#7525), per-company JWT signing keys (#5864), plugin tenant isolation (#5865), the negated-phrasing review-approval fix (#5839), and HTTP-log credential redaction (#8013). Shared-pool and cloud-tenant operators must upgrade.
- Provision a separate non-cloud-tenant admin identity first: the deprivileging purges stale instance-admin rows by design.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
Preflight budget caps that cancel queued work before an adapter starts (master, unreleased)
- PR #8347 (merged to master 2026-06-20, NOT in a tagged release) adds heartbeat preflight gates for daily-run and daily-cost caps (`maxDailyRuns`, `maxDailyCostCents`): a capped agent stops before new execution, with the cap re-checked immediately before execution. This moves budget from surfacing to enforced state.
- Paperclip operators tracking master can stage a per-agent daily cost cap in a test company and confirm work is refused at claim time, not mid-run; operators running the tagged binary do not yet have it.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
A recovery watchdog whose actors structurally cannot mutate approvals (master, unreleased)
- PR #8339 (merged to master 2026-06-19, NOT tagged) adds a task watchdog control plane whose recovery and status-only actors must remain limited to status reporting and cannot create approvals, link approvals, or submit approval comments — enforced via a scoped mutation guard.
- Operators relying on automated recovery should know the next tag structurally prevents a recovery actor from escalating into an approval; the running binary does not yet carry this guard.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
API-key auth decoupled from Keycloak — IdP session revocation is no longer a kill switch for machine keys
- PR #14867 (merged to main 2026-06-17, NOT in any tag) decouples API-key (Bearer) auth from Keycloak offline sessions: API-key authentication performs zero Keycloak round-trips, so a revoked or expired IdP session no longer invalidates a machine key. Headless clients stop hitting opaque 401s — but the revocation contract changed.
- Operators who relied on Keycloak session revocation to kill machine keys must now revoke at the key store instead. This is on main, in no release.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
Last window's per-org concurrency limits reverted outright in-window
- PR #14877 (merged to main 2026-06-17) reverts the DB-backed per-org/per-user concurrent sandbox/conversation limits from #14168, adding migration 124 to drop the columns introduced by migration 120. The 429-based quota some operators were waiting for is not coming in the next 1.x; the surviving concurrency-control path now counts from the runtime `/list` API rather than a DB flag.
- Operators who anticipated 429-based concurrency enforcement must not plan around it — it was withdrawn, not enforced.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
OpenClaw shipped automatic Codex plugin approvals to stable — the one gate that loosened this window
- PR #92625 (stable v2026.6.9, June 21) adds automatic Codex plugin approvals — a gate opened in a fortnight when nearly everyone else was closing them. It cuts against the consent-over-default grain even from a vendor with real accessibility discipline.
- Operators on v2026.6.9 should audit the new automatic Codex plugin approvals against their trust posture; convenience relaxed a consent gate that was previously explicit.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
Hermes MCP-persistence mitigation wave landed on main, not in the v0.17.0 tag
- Days after tagging v0.17.0, a fresh security wave landed on main (June 21-22, NOT in that tag): a guard that rejects MCP entries writing shell payloads into OS persistence surfaces (authorized_keys, cron, sudoers), an IOC blocklist enforced at save and spawn time, an API-key entropy floor raised from 8 to 16, and a startup posture audit warning when a gateway runs as root or exposes an unauthenticated API server.
- Per the maintainer's own commit narrative, this wave responds to an apparent in-the-wild hermes-0day persistence campaign — a single-source claim (a cited Reddit thread and a self-named instance), NOT independently confirmed exploitation. Read the mechanism and fix as real; read 'actively exploited' as the maintainer's account. Either way, if you expose a Hermes dashboard or API server, run main or wait for the next tag.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
An entire OpenHands enterprise and security build-out, two windows unreleased (postcss CVE + git-token redaction)
- The only mainline release is still 1.8.0 (June 10). Two security fixes that matter to anyone on a build from main are in no tag: the moderate postcss XSS, CVE-2026-41305 (#14770), and a fix that stops a `PluginSpec.source` containing an embedded git token from being written to the database in plaintext (#14795). New writes are redacted.
- Operators on 1.8.0 have none of this and are not patched. Operators on a build from main should rotate any git token that was embedded in a repo source URL, because pre-fix writes were stored plaintext.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
Gemini CLI skill path-traversal fix stranded in preview for a second window
- The skill install/link/uninstall path-traversal fix (commit bca5667fc / PR #27767) is, for the second straight week, in no stable release. It exists only in v0.48.0-preview.0; stable v0.47.0 does not contain it. A malicious `.skill` package can still write outside the skills directory on stable.
- Treat third-party skill installs as untrusted on stable v0.47.0 until the path-traversal fix leaves preview.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
Sandbox-spec authority moves off a hardcoded list onto a runtime-api control plane
- PR #14849 (merge 56034afe10, merged to main 2026-06-16, NOT tagged) adds a DynamicRemoteSandboxSpecService that fetches available sandbox specs from the runtime-api `GET /api/warm-runtime-configs` endpoint rather than a hardcoded preset list — the foundation for custom and per-tenant execution images, with a companion guardrail refusing a custom image whose agent-server SDK version does not match.
- Operators planning custom or per-tenant execution images should track this; the sandbox is becoming a server-driven, configurable surface. It is on main, in no release.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
A per-user OAuth token now follows the user into the sandbox from any conversation start path
- PRs #14697 and #14650 (merged to main 2026-06-16, NOT tagged) generalize a per-user secret enricher that injects a user's linked Jira Data Center OAuth token into the sandbox from any conversation start path — web, Slack, and API — not just the originating Jira integration. A credential now follows the user into the runtime, with the blast radius that implies.
- Operators must reason explicitly about which start paths carry which secrets into a sandbox; the credential plane widened. It is on main, in no release.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
Pi compaction events now carry reason and willRetry so a harness can tell the trigger apart
- v0.79.10 (PR #5962) adds `reason` and `willRetry` to the extension `session_before_compact` and `session_compact` events, so an extension can distinguish a manual `/compact` from a threshold auto-compaction from an overflow-retry flow. The runtime's context management becomes legible from the outside.
- Harness authors building on Pi extensions can now branch behavior on why compaction fired and whether it will retry, rather than inferring it.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
Flue workflow runs go private by default and flue logs is removed (staged in Unreleased)
- Staged in the CHANGELOG `## Unreleased` section on main (NOT in the in-window v1.0.0-beta.1/beta.2 tags): workflow runs become private over HTTP unless the workflow separately exports a `runs: WorkflowRunsHandler`, admission receipts shrink to `{ runId }`, `streamUrl`/`offset` are dropped, and the `flue logs` command is removed in favor of typed SDK access (`client.runs.get()`/`events()`/`stream()`).
- This is direction, not a shipped default: the in-window beta.1 tag still documents `flue logs` as functional with the old `{ streamUrl, offset }` envelope. Operators should plan migrations off `flue logs` and the old run envelope, but not assume the new default is live until it tags.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
Hermes shipped background fan-out delegation with no wall-clock bound on a busy worker
- v0.17.0 ships background fire-and-forget fan-out delegation (#49734) in the same line of work that removed the default subagent wall-clock timeout (#45149). A heartbeat/inactivity backstop remains for a wedged worker, but the wall-clock bound on a productively-busy runaway worker is gone and not replaced; the only bound on the fan-out is one async-pool slot for the whole batch.
- Operators running long-horizon multi-agent Hermes work should re-introduce a spend or time bound themselves: a busy runaway background worker now has no wall-clock or cost ceiling.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
Gemini CLI's Antigravity migration funnel reached stable
- Stable v0.47.0 carries the Antigravity migration funnel: a built-in `antigravity-support` skill that hands users a `curl ... | bash` install of a separate `agy` binary (#27765), plus a removed five-show cap on the 'Antigravity is coming to town' banner so it now shows every session for free- and unpaid-tier users (#27676). The clearest sign yet of a managed succession — shipped to stable in the same release that left the skill path-traversal security fix in preview.
- Operators should expect the migration prompt every session on free/unpaid tiers and treat the in-product `curl | bash` install of `agy` as a supply-chain decision, not a default to accept silently.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
OpenClaw's WCAG 2.1 AA accessibility pass reached stable
- PR #89822's WCAG 2.1 AA pass reached stable v2026.6.8 (June 16), having been beta-only last window: dark-mode contrast lifted to the 4.5-to-1 floor (verified >=4.8:1), real keyboard `:focus-visible` rings, and a 12-pixel font floor across 136 elements. The cleanest 'reached the operator' event of the fortnight.
- Operators should verify their dashboard against the stable WCAG AA build — check dark-mode contrast and tab through for a visible focus ring; a previously beta-only accessibility capability is now on the default channel.
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
-
Skills were poisoning every memory store and a skill delete could wipe the working tree (unreleased)
- June 16 commits (main) stop a /skill invocation poisoning every connected memory provider with its raw body, and add tree-escape validation so an agent-triggered skill delete cannot rmtree outside the skills root (a fix ported from an incident that wiped another tool user's working directory). The self-improving-agent risk class made concrete.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Subagents can spawn subagents five deep, and auto mode now classifies spawns before launch
- 2.1.172 lets a subagent spawn its own subagents up to 5 levels deep (new capability and a new governance surface); 2.1.178 then made the auto-mode classifier evaluate a spawn before launch, closing a gap where a deeply nested agent could request an action the operator's policy would block at the top.
- Operators running under auto mode should upgrade past 2.1.178 before trusting a delegation tree, and use argument-aware permission rules to cap what spawned agents can do.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Permission rules can finally match a tool's arguments (Agent(model:opus))
- 2.1.178 added Tool(param:value) syntax so a rule can match input parameters, e.g. Agent(model:opus) blocks Opus subagents; permissions move from all-or-nothing per tool to per-argument.
- Operators governing delegated trees should reach for this to cap model tiers and arguments inside subagents.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Concurrency becomes a governed, billable resource (Personal 3, commercial 10; unreleased)
- PR #14168 (main, unreleased) caps concurrent conversations/sandboxes (Personal=3, commercial=10) with per-org and per-user override columns and HTTP 429 enforcement. A real resource-control and economics surface; tightens the free tier.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Fire-and-forget background subagents that re-inject results as a new turn (unreleased)
- delegate_task(background=true) (main) dispatches an async subagent and re-injects its result as a new turn, with /stop and /agents as the control surface and a max_async_children cap. The same week removed the default 600s subagent timeout, so runaway detection now rests on heartbeat staleness alone. Changes the unit of work and the receipt boundary.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Three path-traversal holes in agent skill install/link/uninstall (fixed on main only)
- Commit bca5667fc / PR #27767 (main, ahead of every stable, preview, and nightly tag as of 2026-06-16) fixes three path-traversal vulnerabilities so a malicious skill package cannot write outside .gemini/skills or delete sibling directories. The clearest confirmation that agent skill packages are an untrusted-input boundary; treat third-party skill installs as untrusted until the carrying release ships.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Codex CLI adds usage views, permanent session deletion, and managed encrypted Bedrock auth
- CLI 0.140.0 adds /usage cost visibility, permanent codex delete (a data-retention/right-to-delete lever), /import, and managed Amazon Bedrock API-key auth with encrypted local storage; 0.139.0 made sandbox proxy-only networking enforcement more consistent. Use codex delete to purge sensitive sessions; re-validate proxy-only egress.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Admins can lock an org to a curated model set and hide custom-key fields (unreleased)
- PR #14773 (main, unreleased) adds allow_user_llm_configuration: off hides custom model/base-URL/API-key inputs and locks the org to a curated, proxy-served model set. The platform owns the model-access policy, not the user.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Hermes closes its own guardrail theater: cp into ~/.ssh, a status leak, fail-open adapters (unreleased)
- June 13 commits (main, post-v0.16.0) gate cp/mv/install into ~/.ssh and credential/shell-rc files (an unpaired write deny the commit calls 'theater'), stop /api/status leaking host paths and the gateway PID on exposed binds, and make own-policy chat adapters fail closed without an allowlist as their own SECURITY.md required. The v0.16.0 release binary does NOT have these; run main or wait for the next tag.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Plaintext git tokens in the DB, a plaintext MCP key, and two frontend CVEs
- OpenHands stopped persisting PluginSpec.source git tokens in plaintext in the DB (#14795, main) and stopped round-tripping remote MCP API keys in plaintext (#14613, main); react-router CVE-2026-42342 shipped in release 1.8.0 (uncredited), postcss CVE-2026-41305 is on main. Rotate any token embedded in a repo source URL or MCP config before the fix; rebuild the frontend.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
A WCAG 2.1 AA pass (beta) and a deliberate consent-over-convenience choice on search
- OpenClaw shipped a measured WCAG 2.1 AA pass on its browser dashboard (contrast above 4.5:1, a focus ring, a 12px font floor across 136 elements) in a BETA tag (v2026.6.7-beta.1), plain-language mobile provider states, and pinned-commit ClawHub skill installs. It also made key-free web search an explicit opt-in (stable v2026.6.8), trading zero-config convenience for explicit consent on where queries egress.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Org model allowlists are finally binding, even against the default model
- enforceAvailableModels (2.1.175) makes the availableModels allowlist constrain the Default model and blocks user/project widening; a cluster of fixes closed env-var, /fast, subagent, advisor, and dispatch escape hatches. This is the lever an enterprise needs to decide whether Fable 5 is reachable per-org.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Shared-pool tenants were instance admins of the whole instance (fixed, unreleased)
- PR #7525 (merged to master 2026-06-12, NOT in a tagged release) removes a grant that made every cloud tenant on a shared pool an instance admin with reach into every other tenant's data, and purges stale admin rows. Shared-pool operators must track the next tag and provision a non-cloud-tenant admin identity first (the purge is destructive).
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Per-company JWT signing keys and a 1-hour TTL replace a single master key (unreleased)
- PR #5864 (master, unreleased) derives a per-company signing key and cuts the agent-token TTL from 48h to 1h, so one tenant's leaked key can no longer forge tokens for other tenants. Multi-tenant blast-radius control; track the next tag.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
A 'NOT APPROVED' comment could auto-complete an issue (fixed, unreleased)
- PR #5839 (master, unreleased) tightens an approval regex that matched negated phrasings (so 'NOT APPROVED' auto-completed an issue) and wraps comment + status + decision in one transaction. Makes 'a rejection can never auto-complete' and 'observable state cannot diverge from intended state' true invariants of the approval gate.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Exec approvals fail closed on timeout, and HTTP override surfaces are admin-gated
- v2026.6.6 made exec approvals fail closed on timeout (a pending dangerous command now denies rather than proceeds) across a dozen-surface boundary sweep that also closed a deleted-agent ACP bypass; v2026.6.8 gated HTTP session/model override surfaces behind admin privileges. The correct reversibility default for a surface aimed at non-experts.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Computer use expands to Europe and Enterprise, with the first per-app controls and a CDP browser surface
- App 26.609 added Developer mode giving the agent controlled Chrome DevTools Protocol access (network interception, arbitrary in-page JS, the debugger), the first per-app access controls for computer use on Windows, and Enterprise computer use; on 2026-06-16 computer use reached the EEA/UK/Switzerland and Chronicle previewed building memory from screen context.
- Keep Developer-mode CDP off by default; use the Windows per-app controls to allowlist apps; default Chronicle off on confidential machines.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
OpenHands Enterprise: the first user to log in owns the organization (unreleased)
- PR #14752 (main, intended for an untagged 1.39.0) makes the first user to sign in after enabling the default org its owner, keyed to an is_default DB flag (migration 119). The multi-tenant foundation the window's enterprise work stacks on. Operators must control who signs in first.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
hide_personal_workspaces is explicitly UI-only, not an access boundary
- PR #14741 (main, unreleased) hides personal workspaces in org-only installs but the docs state it is UI-only: the orgs API still returns personal orgs and there is no server-side enforcement. Operators must NOT treat it as an access-control boundary; the real boundary is the membership model.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Untrusted-repo OTEL cert injection and pre-warmed-worker trust bleed closed
- 2.1.169 fixes untrusted project settings setting OTEL client-certificate paths without a trust prompt (credential-path injection from a hostile repo); 2.1.172/2.1.174 fix pre-warmed background workers reading another directory's .mcp.json approvals/trust and inheriting another session's ANTHROPIC_* provider env. Upgrade past 2.1.174 and re-audit background-agent and untrusted-repo workflows.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Gemini routes flash workloads to gemini-3.5-flash on stable, behind an experiment flag
- Stable v0.46.0 began moving flash workloads to gemini-3.5-flash, gated by an experiment flag and auth-type access logic (so the same binary can route different users to different models). Anyone with cost or eval assumptions pinned to the old flash should re-baseline.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Google steers Gemini CLI users toward a separate Antigravity CLI
- A transition banner exempted from the 5-show cap shipped to STABLE (v0.45.2) so 'Antigravity is coming to town' shows every session; a PREVIEW build (v0.47.0-preview.0) added in-product migration commands and a skill pointing to Antigravity CLI, a separate Google product. Reads as the start of a managed succession for Gemini CLI; track whether feature investment shifts to Antigravity and whether trust/policy semantics carry over.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Codex ships one-click import of Claude Code and Cowork setup
- App 26.608 added Migrate-to-Codex flows importing supported setup from Claude Code and Claude Cowork, including during onboarding: a defection on-ramp off Anthropic's coding agents and a concrete cross-tool config-portability surface.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Anthropic's Fable 5 launches and is adopted across rival harnesses within days
- Claude Code 2.1.170 shipped access to Claude Fable 5, a 'Mythos-class' model; OpenClaw and Pi added Fable 5 support within days (Pi with xhigh effort). A frontier model now reaches the long tail of agent harnesses in a week; the governance lever is the model-allowlist work (separate signal).
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Goal mode, worktrees, and inline review come to the iPhone
- ChatGPT iOS 1.2026.153 added /goal, branch selection, worktree creation, and inline review comments. Persistent long-horizon objectives, env-isolated work, and code review now run from the smallest surface, widening who can drive serious agent work and from where.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Pi gates local settings, instructions, and packages behind a saved trust decision
- v0.79.0 added project trust for local settings, resources, instructions, and packages with saved decisions and --approve/--no-approve CLI controls. Pi now treats local project files as untrusted-by-default; open an untrusted repo and confirm it refuses to load local resources until approved.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Flue reaches a 1.0-line beta and makes durable, recoverable agent execution the default
- Flue shipped durable, recoverable agent execution with pluggable SQLite or Postgres persistence (0.10.0) and reached its first 1.0-line beta (1.0.0-beta.1), a migration-heavy stabilization (valibot tool schemas, opaque run_<ulid> IDs, run-introspection exports). It also swapped standard WebSocket and SSE for a proprietary Durable Streams transport (0.10.2), narrowing external observability. Category evidence that the model+harness split is maturing into stateful infrastructure; the experimental-API caution starts to lift.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Relayed SendMessage from peer sessions no longer carries user authority
- 2.1.166: messages relayed via SendMessage from other Claude sessions no longer carry user authority; receivers refuse relayed permission requests and auto mode blocks them. Closes a confused-deputy path in multi-session orchestration.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Hermes adds a desktop app, a browser admin panel, and remote-gateway connect
- v0.16.0 'The Surface Release' adds a native Electron desktop app, a browser web-admin dashboard, and remote-gateway connect over OAuth or username/password, collapsing install-to-first-message to seconds and adding a new authority boundary (the dashboard auth gate) that operators exposing it must govern.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Deny-by-default authority preset for agents reviewing untrusted content
- PR #7530 (in v2026.609.0) adds a low_trust_review authority preset, source-trust tagging, route containment, and quarantine so an agent reviewing a hostile PR/comment/attachment gets narrower authority and its output cannot flow into higher-trust context. Enforced authority for the untrusted-input boundary, not a dashboard label.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Paperclip drops 'zero-human companies' for 'manage AI agents for work'
- PR #7580 retires the 'zero-human companies' tagline for 'the app people use to manage AI agents for work', a repositioning its in-window engineering backs up (human board visibility, audited recovery, approval gates). Calibration signal: the autonomous-company metaphor is being repriced toward human-in-the-loop operating software.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Remote controllers are now listable and revocable, and approvals carry environment identity
- CLI 0.137.0 lets remote-control clients pair and have controller grants listed/revoked via app-server v2 RPCs, and binds permission requests/approvals to an environment identity. A concrete authority-inventory and revocation surface for who can drive a session remotely.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
The public Tailscale tunnel now trusts only the active Remote Control origin
- v1.20 (commit ca4efe6e6) normalizes active Remote Control URLs before CSRF allowlisting and restricts WebSocket origin validation to only the currently active Remote Control origin (the public tunnel exposing the whole visible computer), rejecting unrelated external origins.
Run: 2026-06-16-weekly-digest-2026-06-04_2026-06-16-frontier-v0
-
Permission and deny rules now enforced as written across WebFetch, Windows paths, and Glob/Grep
- Three distinct gaps where a configured permission/deny rule silently failed to apply are closed in the 2.1.160-2.1.162 line: custom WebFetch rules now override built-in preapproved domains, Windows rules with backslashes or case-variant paths now match, and Read deny rules now hide files from Glob and Grep results.
- Operators who wrote allow/deny policy and assumed it was enforced were running with a false sense of coverage; the fix is gated purely on upgrading past these versions, so the operator action is 'upgrade, then re-audit whether any policy was silently bypassed in the prior window.'
- The Read-deny-vs-Glob/Grep gap is the sharpest: a file an operator denied for Read was still discoverable (and its path/contents surfaceable) via search tools, defeating the access-control intent.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Agent view exposes why a session is blocked and fan-out progress for scripted supervision
- claude agents --json now includes a waitingFor field naming what a blocked session is waiting on (e.g. a permission prompt), and claude agents rows now show done/total progress before detail when work is fanned out.
- Operators scripting or monitoring agent fleets can now programmatically distinguish 'stuck on a permission prompt' from other waits and read parallel-task completion, which is the difference between a watchdog that can unblock a session and one that can only detect silence.
- The operator action is to wire waitingFor and the progress counter into supervision tooling so stuck-agent triage stops requiring a human to open each session.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
CLI 0.136.0 adds API-key registration for approved remote exec-server hosts
- An operator running remote execution can register approved hosts via API key instead of entering credentials per session, changing the remote-exec authentication model.
- This shifts trust to a pre-registered host allowlist keyed by API key — operators must decide which hosts are 'approved' and how those keys are scoped and rotated before enabling remote exec.
- Verification path: upgrade to 0.136.0, register a test host, confirm only approved hosts authenticate and that key scope/rotation behaves as expected before exposing remote execution.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Amazon Bedrock integration runs Codex models under AWS-managed authentication and billing
- An operator with AWS infrastructure can now run OpenAI models through Amazon Bedrock, moving authentication and billing under AWS IAM and cost allocation instead of an external OpenAI API path.
- This reframes where the trust and identity boundary sits — Codex model calls become AWS-native, which changes compliance and credential-management decisions for AWS-policy organizations.
- Verification path: provision Codex models via Bedrock, confirm IAM scoping and that no model traffic leaves the AWS-managed path before treating it as compliance-satisfying.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
ChatGPT iOS 1.2026.146 adds optional Face ID / passcode lock for Codex
- An operator running Codex on iOS can now require Face ID or a passcode to open Codex, adding a device-level authority gate that did not exist before.
- It is optional, so the operator decision is whether to enable it as policy for mobile-deployed Codex access.
- Verification path: update to 1.2026.146, enable the lock, confirm Codex requires biometric/passcode on foreground before trusting mobile as an access surface.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Sites plugin (preview) adds in-app website and web-app creation and deployment
- An operator can now create, deploy, and manage websites, dashboards, and web apps directly within Codex, removing the external-tool step for web deployment.
- ChatGPT Business workspaces include Sites by default, so the operator decision is whether to allow/govern an in-product deploy surface that may already be enabled.
- Verification path: confirm whether Sites is enabled in your Business workspace and whether agent-initiated deployments fit your hosting/governance policy before relying on it.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
v0.45.0 stable bundles terminal hardening, session-context cleanup, and an MCP blacklist-bypass fix
- Operators on preview or older stable builds get a single upgrade decision: move to v0.45.0 to pick up Termux relaunch/resize fixes, session-context filtering on history resume, sequential tool execution for update_topic, Vim keybinding fixes, and an MCP blacklist-bypass prevention fix.
- The MCP blacklist-bypass prevention is the security-bearing item: it closes a path where a blacklisted MCP tool/server could still be reached, so operators relying on MCP allow/deny controls should upgrade before trusting the blacklist.
- Verification path: release tag v0.45.0 notes (published 2026-06-03T01:05:14Z) enumerate the bundled fixes.
- Single composite upgrade decision - bundled small fixes all gated on 'upgrade to v0.45.0' stay one signal.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Policy file survives cross-device mounts and corruption via EBUSY fallback and TOML recovery
- Operators running in containers with cross-device mounts no longer hit silent policy-update failures - atomic rename now falls back to copy-then-unlink on EBUSY/EXDEV.
- A corrupted policy TOML is auto-backed-up to .bak and rebuilt from scratch rather than blocking on a syntax error, removing a manual-intervention failure mode.
- Verification path: packages/core/src/policy/config.ts adds the fallback and recovery; persistence.test.ts covers both paths.
- Single operator class (operator persisting policy/permission config), single consequence (policy persistence no longer fails silently).
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
CI labeler switched to pull_request_target, granting write context to fork PR runs
- Contributors and maintainers should note the PR-size labeler now runs under pull_request_target, which executes in the base-repo context with write-capable token access on fork PRs.
- This is the classic pwn-request surface: pull_request_target with any checkout or execution of fork-controlled content can leak the elevated token; operators forking or auditing the repo's CI should confirm the workflow does not check out and run untrusted PR code.
- Verification path: .github/workflows/pr-size-labeler.yml line 4 trigger change from pull_request to pull_request_target.
- Single decision for the repo-security auditor: review this workflow's token scope and whether it touches fork-controlled inputs.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Gemini 3.5 Flash GA routes to flagged users via backend experiment flag, no client update
- Operators auditing which model their CLI calls cannot rely on client version alone - model selection is now gated server-side by experiment flag GEMINI_3_5_FLASH_GA_LAUNCHED (ID 45780819) via hasGemini35FlashGAAccess().
- Auto-routing logic silently switches to Flash GA when the flag is enabled for a user cohort, so the same binary can route to different models across users.
- Verification path: Config.hasGemini35FlashGAAccess() and the registered experiment flag determine routing; the model in use is no longer fully determined by local config.
- Single decision: operators must treat backend flag state as part of the model-routing audit surface.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Docker dashboard insecure binding now requires explicit HERMES_DASHBOARD_INSECURE=1 opt-in
- The dashboard no longer infers insecure mode from bind host, so operators whose Docker setups relied on that inference must add HERMES_DASHBOARD_INSECURE=1 explicitly or the dashboard will not bind insecurely.
- Existing Docker and hosted deployments must update env configuration before upgrading to v0.15.1 to avoid a broken or unexpectedly-secured dashboard.
- Verification path: upgrade to v0.15.1, set HERMES_DASHBOARD_INSECURE=1 only where intended, and confirm the dashboard binds as expected without falling back to host-derived inference.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Promptware defense added against Brainworm-class prompt-injection attacks
- Operators running the agent against untrusted content (web, repos, MCP tool output) gain a built-in defense layer they should validate against their own injection test cases rather than assume blanket coverage.
- 19 security-tagged issues were closed in the same release, so the upgrade is the gate for these protections; staying on prior versions leaves the injection surface unmitigated.
- Verification path: upgrade to v0.15.0 and run known Brainworm-class injection patterns to confirm the defense triggers before exposing the agent to untrusted input.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Bitwarden Secrets Manager integration replaces per-provider API keys
- Operators managing credentials must decide whether to migrate from per-provider API keys to centralized Bitwarden Secrets Manager, changing where secrets live and how they rotate.
- Centralized secret management enables rotation and revocation that scattered per-provider keys did not; an operator wiring CI/automation must re-point credential sourcing.
- Verification path: configure Bitwarden Secrets Manager on v0.15.0, confirm the agent resolves credentials from it, and test a rotation to verify the agent picks up the new secret.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Kanban becomes a multi-agent orchestration platform with auto-decomposition, swarm topology, and worktree-per-task
- Operators who ran Kanban as a task board must now decide whether to adopt orchestrator auto-decomposition and swarm topology, which turn a queue into a self-spawning multi-agent fleet with new operating state to supervise.
- Per-task model overrides and worktree-per-task change the cost and isolation profile of every queued task; an operator must re-plan budget and concurrency.
- Verification path: deploy v0.15.0, queue a decomposable task, and confirm the orchestrator spawns the expected sub-agents in isolated worktrees before trusting it with real work.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
OAuth browser-launch URI validation closes command-injection path
- An operator authenticating against a third-party or attacker-influenced OAuth server was exposed to shell command injection via the verification URI; upgrading past ba6e529 removes that exposure.
- Verification path: confirm the build includes ba6e529 (non-HTTP(S) URIs rejected, browser launched via spawn() not shell exec()).
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Git package install path-traversal rejection
- An operator installing a git-sourced package from an untrusted URL was exposed to files being written outside the package install root via traversal sequences; upgrading past a98e087 blocks this at parse and resolution time.
- Verification path: confirm a98e087 is present; a crafted git URL with '../' is rejected with 'Refusing to use path outside package install root'.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Skill Workshop adds a pending-proposal approval workflow with CLI/Gateway review and a skill_workshop agent tool
- Skill Workshop introduces a new pending-proposal lifecycle that an operator must approve or reject via CLI or Gateway before a skill takes effect, inserting a human-in-the-loop gate into skill provisioning.
- The skill_workshop agent tool lets agents themselves file proposals, expanding the automation surface; operators must decide who may review and who may self-approve.
- Decision is for the control-plane admin/skill-author: configure the review path and authority for skill proposals.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Enhanced plugin isolation tightens the plugin sandbox boundary in the 2026.6.1 line
- Enhanced plugin isolation changes the sandbox boundary around plugins, including the externalized Tokenjuice and GitHub Copilot plugins now run as separate plugins.
- Operators running third-party or externalized plugins should re-test plugin behavior against the tightened isolation, since capabilities previously available in-process may now be constrained.
- Single runtime-admin decision: verify plugins still function under the new isolation after upgrade.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Unclaimed self-hosted deployments get a one-time browser claim to bootstrap the first admin
- Operators standing up a private self-hosted deployment now have a defined bootstrap path to create the first admin before any invite exists, replacing ad-hoc seeding.
- Whoever completes the one-time browser claim becomes the first admin, so an operator must claim a freshly deployed instance promptly to avoid a race for control.
- This changes the deployment runbook: the claim step is now the gate that establishes ownership of the control plane.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Company skills become first-class resources with an install/reset/audit/export/assign CLI
- Skills move from implicit configuration to governed resources: an operator can now audit which skills are installed and assigned, and export the catalog for review or provenance tracking.
- The CLI verbs (install, reset, audit, export, assign) give platform operators a programmatic path to manage agent capabilities across a company instead of clicking through a board.
- Assignment is a distinct authority action — an operator decides which agents get which skills — so capability grants become reviewable operating state rather than ambient defaults.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Computer-use screenshots now persist to durable chat-scoped storage by default
- Reverses the prior ephemeral-by-default posture for computer-use screenshots, so operators who relied on screenshots being transient must now account for retained artifacts
- Changes deployment storage characteristics: long-running computer-use sessions accumulate screenshots in chat context, requiring storage planning and retention/cleanup review
- Directly hits the workcell calibration concern of persistence and cleanup for real computer access
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Office, Desktop, and Editor plugins become toggleable behind a protected plugin-state API
- Operators can disable Office, Desktop, or Editor plugins (Desktop computer-use especially) on deployments that should not hold those capabilities, via the v1.19 plugin-toggle endpoint.
- The endpoint is described as 'protected' but the release note documents no auth model or role-based capability management, so treat it as a disable lever, not yet an audited capability register.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Remote Link renamed to Remote Control with selectable tunnel providers and handshake version advertisement
- Operators managing distributed deployments must update remote-connectivity terminology (Remote Link -> Remote Control) and can now choose among Cloudflare, Microsoft Dev Tunnels, Serveo, and Tailscale
- Version advertisement in connector handshakes lets CLI clients detect server compatibility, changing how operators coordinate client/server upgrades across a fleet
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Upgrade frontend deps (axios 1.16.0, dompurify 3.4.0) to close CVE-2026-44492 and CVE-2026-41238
- Two browser-facing frontend dependencies were patched in the window: axios to 1.16.0 (CVE-2026-44492, commit 73d1d9a) and dompurify to 3.4.0 (CVE-2026-41238, commit b025cd2). Two commits, one operator action: rebuild and redeploy the frontend bundle.
- Self-hosters pinning older lockfiles must bump both manually; a stale frontend build leaves both CVEs live.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Upgrade dulwich to 1.2.5 to close CVE-2026-42305 in git operations
- Operator must re-resolve poetry.lock (enterprise and root) and rebuild backend images to ship patched dulwich; git operations run inside the agent runtime path.
- Distinct from the frontend CVEs: this is a backend Python git library, different surface and different verification (lockfile pin, not frontend bundle).
- Verification path: confirm dulwich>=1.2.5 in deployed poetry.lock / installed environment.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
ACP provider credentials now route through cipher-protected agent_context.secrets, not acp_env
- Operators running ACP agents must understand provider API keys/base URLs now flow through the cipher-protected secrets channel; the deprecated acp_env channel no longer carries credentials.
- Changes the persistence and exposure surface for agent provider credentials, with SDK gap-fill logic specifically preventing re-folding into the insecure acp_env channel.
- Verification path: confirm ACP provider creds appear via agent_context.secrets and are absent from acp_env in agent context.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
DELETE /api/organizations now cascade-deletes the sole-org requester (personal org)
- Operators must understand that deleting a personal org now also deletes the requesting user account, enabling re-onboarding on next login — a destructive identity-state change behind one endpoint.
- Changes operating-state semantics of an existing destructive API: requires backup discipline before org deletion; multi-org members are protected by preflight orphan detection.
- Verification path: test DELETE /api/organizations against a sole-org account vs a multi-org member and confirm orphan-rejection behavior.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
v0.9.0 breaking app-config migration: routing/provider imports, provider-ID format, SDK mount paths, and beta session-state reset
- Upgrading to v0.9.0 forces a developer to rewrite application imports: routing moves from `@flue/runtime/app` to `@flue/runtime/routing`, provider APIs and `observe` come from `@flue/runtime`, and Workers AI types from `@flue/runtime/cloudflare` — code will not compile until updated.
- Provider model values now require `provider-id/model-id` format and `registerProvider()`/`configureProvider()` must share one ID; SDK mount paths now derive from `baseUrl` pathname — both are silent runtime-behavior changes that mis-route calls if not updated.
- Persisted beta session state is now rejected; the operator must clear or migrate the session store before upgrading or sessions fail to restore — a distinct destructive pre-upgrade step gated on the same v0.9.0 cutover.
- All of these share one verb (update-before-upgrade) for one persona (the Flue app developer) and one verification path (build + smoke-test against v0.9.0), so they route as a single platform migration signal.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
v0.9.1 strips WebSocket URL credentials and rejects blank requestIds
- Operators deploying Flue on Cloudflare WebSockets get two upstream hardening fixes by upgrading to v0.9.1: query strings and fragments are stripped before attachment persistence, so URL-carried handshake credentials are no longer retained, and agent/workflow frames reject blank or whitespace-only `requestId` values.
- Both are the same consequence for one persona (the Cloudflare WebSocket operator) gated on the same upgrade, so they stay one signal; the operator action is to upgrade and confirm credentials are no longer in persisted attachments.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
v0.9.2 adds an activate_skill tool letting agents load skills autonomously
- Operators configuring skills now get a new agent-facing `activate_skill` tool: agents load full skill instructions on demand before matching work, shifting skill loading from operator-orchestrated to agent-initiated — a proactivity/authority change the operator should be aware of when scoping which skills are available.
- Workspace skills are reread on activation, so edits during an active session take effect (lazy loading preserved); verification is concrete (configure a skill, confirm the agent self-activates it and picks up an edit mid-session).
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Writes to execution-granting config and shell startup files now prompt even in acceptEdits mode
- Two new guardrails land together: acceptEdits mode now prompts before writing build-tool config that grants code execution (.npmrc, .yarnrc*, bunfig.toml, .bazelrc, .pre-commit-config.yaml, .devcontainer/, etc.), and the agent now prompts before writing shell startup files (.zshenv, .zlogin, .bash_login) and ~/.config/git/.
- Operators who ran acceptEdits or auto-leaning modes previously had a silent write path into files that execute code on the next shell, install, or commit; the new prompt converts that into a confirmation checkpoint.
- The operator action is to recognize that these prompts will now fire and not blanket-allow them — the prompt is the supply-chain/persistence defense, so auto-approving it re-opens the vector.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
May 2026
-
Auto Mode now available on Bedrock, Vertex, and Foundry for Opus 4.7 / 4.8
- Auto Mode's permission-handling posture, previously tied to first-party Anthropic auth, now extends to the cloud provider APIs (AWS Bedrock, Google Vertex, Foundry) for Opus 4.7 and 4.8, opt-in via CLAUDE_CODE_ENABLE_AUTO_MODE=1.
- The operator decision is governance-shaped: teams running Claude Code through a cloud-provider procurement path can now deploy the reduced-prompt autonomy posture they could not before, which changes what consent ceremony exists on those deployments.
- Because Auto Mode shifts permission decisioning away from per-action prompts, an operator enabling it on a Bedrock/Vertex deployment must confirm their managed-settings deny rules carry the governance weight the prompts used to.
Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0
-
Auto mode becomes the default permission posture
- Operators with managed Claude Code deployments must re-audit what Auto mode classifies as safe by default — the consent gate is gone.
- Admins relying on the opt-in consent dialog as a visible posture check have lost that surface; equivalent visibility now comes from managed-settings policy, not from a runtime prompt.
- Skill authors should evaluate `disallowed-tools` for skills that should run with a reduced tool surface.
- Hook authors should consider whether `MessageDisplay` is a governance gain or a censorship hazard for their deployment.
Run: 2026-05-27-weekly-digest-2026-05-13_2026-05-27-frontier-v0
-
Three de-facto security advisories without a separate advisory surface
- Windows operators on 2.1.148 or earlier with PowerShell allowlists, git worktree workflows, or enterprise login pinning should upgrade to 2.1.149+ before deploying new agents.
- Operators monitoring for security-advisory-shape events (RSS, CVE feeds) need to recognize that Anthropic ships these as ordinary changelog entries; the changelog is the de-facto advisory surface.
- Source-contract owners should decide whether to amend `sources/claude-code.yml` to add an explicit security advisory surface or to document the changelog as carrying that role.
Run: 2026-05-27-weekly-digest-2026-05-13_2026-05-27-frontier-v0
-
Goal mode graduates default-on; remote computer use after lock ships
- Operators using Codex must decide whether goal mode is permitted as a baseline or constrained via permission profiles — the inheritance + managed-requirements features are the right tool for this.
- Evaluators of remote computer use after Mac lock should treat the locked-host surface as a new authority decision, not a default; short-lived authorization and relock-on-input are sensible defaults, but the policy for which tasks may operate against a locked host is still an operator choice.
- Plugin-marketplace evaluators (ChatGPT Business; Enterprise coming soon) should treat plugin distribution-by-marketplace as a new supply-chain surface to govern.
Run: 2026-05-27-weekly-digest-2026-05-13_2026-05-27-frontier-v0
-
Permission profiles get inheritance and an org-managed enforcement file
- Enterprise operators should restructure permission policy: stop maintaining flat profile lists; build a base profile plus per-team derivations using inheritance.
- Decide where `requirements.toml` lives (repo-rooted, org-rooted, signed) before depending on enforcement — the distribution and trust model are not yet documented.
- Migrate off legacy profile configs; 0.134.0 rejects them with migration guidance.
- Normalize permission selection on `--profile` as the canonical handle; flag-soup approaches are now legacy.
Run: 2026-05-27-weekly-digest-2026-05-13_2026-05-27-frontier-v0
-
Local and remote session invocation protocols land stable
- Operators building delegated workflows on Gemini CLI should re-test against v0.44.0 stable; the remote invocation protocol is no longer preview.
- Multi-scope deployments must audit agent name overlaps before upgrading — the new `first-wins prioritize project` resolution changes which definition wins.
- Until Google documents where remote invocations actually run, treat the remote path as infrastructure-to-be-defined; do not depend on it for production.
Run: 2026-05-27-weekly-digest-2026-05-13_2026-05-27-frontier-v0
-
Auto modes collapse and PolicyEngine reaches into ACP sessions
- Operators on previous Auto variants must re-audit which behaviors the consolidated Auto mode treats as safe — the merger may have loosened or tightened constraints; release notes do not enumerate.
- `AUTO_EDIT` operators should explicitly decide whether shell-redirect auto-approval is acceptable for their environment.
- Operators evaluating Gemini ACP integration should treat PolicyEngine-in-ACP as the new enforcement boundary; the 'deadlock fix' framing understates the structural shift.
Run: 2026-05-27-weekly-digest-2026-05-13_2026-05-27-frontier-v0
-
OpenHands becomes the GUI shell for other harnesses, with org-level LLM profiles
composes with Claude Code , Codex , Gemini CLI
- Evaluators of OpenHands as a multi-agent shell: enable `ENABLE_ACP` against your preferred ACP back-end (Claude Code, Codex, Gemini CLI) and test the policy surface — the greyed-out settings while ACP is active are intentional.
- Multi-tenant SaaS operators must confirm they are on 2026-05-22+ to get the MCP/ACP env scoping fix. Audit MCP credentials that may have been shared across org members pre-fix.
- Enterprise admins should treat the org-level LLM profile model as the canonical place to set 'this org uses these models' policy.
- Operators on the release channel need to know none of this is in a tagged 1.x release yet — main-branch only.
Run: 2026-05-27-weekly-digest-2026-05-13_2026-05-27-frontier-v0
-
Host desktop control with required visual verification
- Operators evaluating Agent Zero for host control must decide whether `computer_use_remote` is allowed at all on the host — the default trust mode is opt-in but the runtime checks are enforceable.
- Workcell operators should know that screenshot capture is now ephemeral and context-scoped by default; auditing what the agent saw requires explicit durable capture.
- Operators using the existing `linux-desktop` skill: verify your skill routes to the path you expect; host and container desktops are now cleanly separated.
Run: 2026-05-27-weekly-digest-2026-05-13_2026-05-27-frontier-v0
-
Content-boundary hardening suite across inbound surfaces
- Operators evaluating OpenClaw against 'is it safe to put agents on real channels' can use this suite as evidence of a threat model, not just a feature list.
- Gateway operators should verify whether `gateway.auth.rateLimit` was unset in their config — the on-by-default ratelimit changes observable behavior for non-browser/HTTP auth flows.
- Plugin authors should treat `allowFrom` sender allowlists as the canonical inbound boundary; post-dispatch filtering is the older model.
Run: 2026-05-27-weekly-digest-2026-05-13_2026-05-27-frontier-v0
-
Hermes ships PyPI, lazy adapter install, native Windows beta
composes with Aider , Cline , Codex , Continue
- Builders who bounced off the prior clone-and-shell installer should re-evaluate Hermes — `pip install hermes-agent` plus lazy adapter install plus Windows beta plus Zed ACP Registry listing materially lower the floor.
Run: 2026-05-27-weekly-digest-2026-05-13_2026-05-27-frontier-v0
-
`hermes proxy`: local OpenAI-compatible endpoint backed by operator OAuth
composes with Aider , Cline , Codex , Continue
- Operators running `hermes proxy` on the documented loopback default (`--host 127.0.0.1`) inherit a low-risk posture; the proxy accepts client `Authorization` headers and strips them before attaching the Hermes OAuth upstream. Operators changing the bind to a non-loopback address must place their own auth in front of the port — the proxy itself does not authenticate local callers.
Run: 2026-05-27-weekly-digest-2026-05-13_2026-05-27-frontier-v0
-
Honcho identity mapping and credential-pool isolation
composes with Aider , Cline , Codex , Continue
- Multi-user gateway operators should upgrade past the Honcho commits (week of 2026-05-21) and the credential-pool isolation commit (2026-05-27) before running shared-thread deployments — these are quiet correctness fixes for cross-user contamination.
Run: 2026-05-27-weekly-digest-2026-05-13_2026-05-27-frontier-v0
-
Kanban corruption-hardening wave (post-v0.14.0)
composes with Aider , Cline , Codex , Continue
- Kanban-dependent multi-agent operators should treat the post-v0.14.0 line as the integrity-floor baseline; the corruption-hardening wave volume is the signal.
Run: 2026-05-27-weekly-digest-2026-05-13_2026-05-27-frontier-v0
-
Scoped agent permissions, layered routine secrets, document locks
- Multi-agent operators: re-evaluate Paperclip's authz model. The principal-access backfill means pre-existing data is being normalized to the new model — confirm any operator action needed for older versions.
- Secret-handling operators: read PR #6212 before configuring routine env in a deployment where secrets matter — the `agent < project < routine` precedence is a structural operator concept.
- Approval-discipline operators: migrate to lock-backed approval; document locks give approval a persistent surface.
- ACPX-Claude operators: confirm `~/.claude/settings.json` is configured as the source of truth for Claude permissions — the Paperclip control plane defers to it.
Run: 2026-05-27-weekly-digest-2026-05-13_2026-05-27-frontier-v0
-
Per-sender tool policies via channel-scoped sender keys
- Operators running OpenClaw with public-facing channels can now restrict dangerous tools by requester identity rather than only by agent. Review your tool surfaces and decide whether the broader trust model (per-channel × per-sender) belongs in your deployment.
- Authority restriction now extends across global, agent, group, core, bundled, and plugin tool surfaces — operators should re-audit which surfaces hold authority decisions in their deployment and whether the requester-level layer makes some prior per-agent restrictions redundant.
- Three claim-level updates land in the same release: memory-wiki ingest now requires admin scope, Obsidian search requires write scope, and `openclaw models auth login --provider openai` defaults to ChatGPT/Codex login (API-key setup is now behind `--method api-key`). Setup scripts assuming read-only or API-key-first paths need to be updated.
Run: 2026-05-13-partial-cycle-openclaw-refresh-2026-05-13-frontier-v0
-
Package scope migration to earendil-works; harness SDK stream config
- Operators with global Pi installs should run `pi update --self` once @earendil-works/pi-coding-agent is published to migrate from the old @mariozechner scope.
- Operators with Pi pinned in CI, Dockerfiles, or package.json by the old @mariozechner/pi-coding-agent name should update their references to @earendil-works/pi-coding-agent.
Run: 2026-05-12-partial-cycle-pi-coding-agent-2026-05-07_2026-05-12-frontier-v0
-
Secrets provider vaults (AWS Secrets Manager), host env isolation fix, cursor_cloud adapter
- Operators running SSH-managed execution environments should upgrade immediately: the host env isolation fix (PR #5142) closes a path where host environment variables (API keys, tokens, paths) were being forwarded to remote execution targets.
- Operators managing credentials at scale should evaluate the AWS Secrets Manager import path in Secrets settings UI — this enables rotation-aware credential management with an access-event audit trail.
- Operators using Cursor as an adapter can now configure the new `cursor_cloud` adapter for cloud-hosted Cursor routing with session reuse, streaming, and cancellation.
Run: 2026-05-12-partial-cycle-paperclip-2026-05-07_2026-05-12-frontier-v0
-
Sub-agent delegation (opt-in) and critic evaluation GUI
- Operators running multi-task sessions can now enable sub-agent delegation via `enable_sub_agents`. Built-in sub-agents (bash-runner, code-explorer, general-purpose, web-researcher) handle scoped tasks with restricted tool surfaces. Default is off -- enable deliberately.
- Operators should configure `CRITIC_API_KEY` to route critic evaluation spend separately from the primary model key if centralized cost control matters.
- The critic display is deployment-controlled via `OH_ENABLE_CRITIC_BY_DEFAULT` (disabled by default). Deployments that want it enabled should set that flag; per-deployment toggle is `verification.critic_enabled`.
Run: 2026-05-12-partial-cycle-openhands-2026-05-07_2026-05-12-frontier-v0
-
Per-agent message restrictions, gated code install, and onboarding wayfinding
- Operators deploying public-facing or sandboxed agents should evaluate `tools.message.crossContext` and `tools.message.actions.allow` overrides to restrict agent message sends to the current conversation without changing the global bot policy.
- Operators running long-horizon OpenClaw sessions should know that session memory is now bounded: the memory dreaming promotion cap compacts oldest auto-promoted sections while preserving user-authored notes. Unbounded auto-memory growth is no longer the default behavior.
- Operators deploying OpenClaw for new users should test the improved CLI onboarding wayfinding: setup, onboarding, configure, and channel commands now explain the next useful command at each step.
Run: 2026-05-12-partial-cycle-openclaw-2026-05-07_2026-05-12-frontier-v0
-
Hermes drops mistralai from [all] extras after PyPI quarantine of 2.4.6
- Operators who installed hermes-agent[all] on or around 2026-05-12 should verify whether mistralai==2.4.6 is present in their environment and remove it if so.
- Operators needing Mistral Voxtral TTS must switch to explicit hermes-agent[mistral] install; it no longer ships in [all] while quarantine is active.
Run: 2026-05-12-partial-cycle-hermes-refresh-2026-05-12-frontier-v0
-
Durable Kanban with hallucination gate, redaction-on-by-default, channel allowlists
- Operators upgrading existing Hermes deployments must verify that secret redaction is now ON by default. Log pipelines that relied on unredacted output will see sanitized logs after upgrade.
- Discord operators with role-gated access (`DISCORD_ALLOWED_ROLES`) should re-verify their role-scoping configuration: the guild-scoped fix (CVSS 8.1) may change behavior in cross-guild bot deployments.
- Operators building multi-agent workflows on Hermes should evaluate the Kanban board's reliability primitives (heartbeat reclaim, zombie detection, hallucination gate, per-task retries) before building a custom coordination layer.
- Operators using cron should evaluate `no_agent` mode for script-only automation that does not require LLM invocation.
Run: 2026-05-12-partial-cycle-hermes-agent-2026-05-07_2026-05-12-frontier-v0
-
Session resume now surfaces errors and finds legacy sessions
- Operators using --resume with legacy session formats should re-test: prior to this fix, resume failures silently started new sessions. Verify the behavior after upgrade.
Run: 2026-05-12-partial-cycle-gemini-refresh-2026-05-12-frontier-v0
-
Flue: programmable harness with run observability, virtual sandbox, and shell env security fix
- Operators using shell env for credentials in pre-v0.4.1 Flue sessions should verify their session store does not contain unredacted values — the v0.4.1 shell env redaction fix is a security patch.
- Operators using `sandbox: 'local'` should re-test: it is now genuinely local (direct host access, no just-bash), changing the isolation boundary for agents running in CI.
- Operators building on Flue should evaluate `flue logs` and run history (v0.5.0) as the primary evidence trail for autonomous agent invocations.
Run: 2026-05-12-partial-cycle-flue-2026-05-07_2026-05-12-frontier-v0
-
PreToolUse hooks can now rewrite tool inputs before execution
- Hook authors who returned updatedInput in PreToolUse hooks expecting rewrites to apply should re-test: prior to this fix, the original input was used; after this fix, the rewritten input is used. Verify existing hooks behave as intended after upgrade.
- Operators can now build input-sanitizing PreToolUse hooks that modify tool arguments before dispatch -- path normalization, argument masking, destination redirection.
Run: 2026-05-12-partial-cycle-codex-refresh-2026-05-12-frontier-v0
-
Agent view, goal completion, and governance hardening
- `claude agents` is the new canonical surface for multi-session supervision; operators running parallel Claude Code sessions should evaluate it now as their primary management interface.
- /goal changes how long-running autonomous work is structured; operators should test goal-based termination against their most common multi-turn workflows.
- `continueOnBlock` enables advisory governance hooks; existing PostToolUse blocks should be redesigned to pass rejection reasons so Claude can adapt rather than just stop.
- `x-claude-code-agent-id` / `x-claude-code-parent-agent-id` headers and OTel span attributes enable call-tree attribution; logging pipelines receiving Anthropic API calls should start capturing these to distinguish parent sessions from subagents.
- API key auth now disables Remote Control, /schedule, and claude.ai MCP connectors; operators using API key should audit reliance on these surfaces before upgrading.
Run: 2026-05-12-partial-cycle-claude-code-2026-05-07_2026-05-12-frontier-v0
-
ODF-first document defaults, persistent desktop lifecycle, multi-tab browser fanout
- Operators running Agent Zero should verify that downstream workflows handle ODT/ODS/ODP output from v1.13+. OOXML output now requires explicit configuration.
- Operators running long-horizon desktop sessions should plan for persistent desktop state: the Xpra Desktop no longer resets on canvas navigation. Accumulated desktop state (open apps, browser sessions) persists until explicitly shut down.
Run: 2026-05-12-partial-cycle-agent-zero-2026-05-07_2026-05-12-frontier-v0
-
Permissions glance surface and role-aware plugin sharing
- Run receipts should record permission posture + approval mode as standard fields.
- Plugin share role-awareness affects whether configs can be shared across roles.
- Authority visibility in the TUI is a worked example of governance ergonomics worth borrowing.
Run: 2026-05-11-partial-cycle-codex-2026-05-08_2026-05-11-frontier-v0
-
Subagents become pluggable; sessions become portable
- Capability-profile assumption "subagents inherit approval mode" is now under-specified.
- Run-contract design should record which subagent protocol variant a run used.
- Adapter work should distinguish local from remote subagent execution.
- Session export/import gives operators a stable serialization point.
Run: 2026-05-11-partial-cycle-2026-05-08_2026-05-11-frontier-v0
-
Agent labor needs operating state, not just parallelism.
-
Real computers are becoming the agent work surface.
-
Agent harnesses are becoming full development platforms.
-
Accessibility is becoming a frontier capability.
-
Persistent agent state is becoming a product surface
- Developers need to know which goals, memory patches, recaps, sessions, and skill maintenance loops shaped a serious run.
Run: 2026-05-07-commit-harvest-2026-04-23_2026-05-07-frontier-v1
-
The agent interface is becoming a visible computer
- A serious agent harness increasingly needs browser, desktop, file, runtime, sandbox, and artifact surfaces that can be inspected.
Run: 2026-05-07-commit-harvest-2026-04-23_2026-05-07-frontier-v1
-
Permissions, secrets, and sandboxes are moving into the foreground
- The harness must make trust state visible: what can be read, what can be changed, which credentials are exposed, and where execution happens.
Run: 2026-05-07-commit-harvest-2026-04-23_2026-05-07-frontier-v1
-
Accessibility is a frontier capability, not marketing polish
- Everyday adoption depends on setup recovery, visible progress, voice/chat surfaces, readable UI, OAuth clarity, and fewer dead ends.
Run: 2026-05-07-commit-harvest-2026-04-23_2026-05-07-frontier-v1
-
Agent systems are growing control planes
- Once agents coordinate across tasks, runtimes, gateways, and integrations, operators need liveness, cost, role, session, and recovery controls.
Run: 2026-05-07-commit-harvest-2026-04-23_2026-05-07-frontier-v1
-
Integrations are volatile; the operating loop has to be durable
- Provider lists, plugin systems, transports, and model profiles will keep changing.
Run: 2026-05-07-commit-harvest-2026-04-23_2026-05-07-frontier-v1
-
Worker-native goals unlock longer horizons.
- Operators now need to ask which durable objective the worker is pursuing, whether it is still aligned with the operator's charter, and how it maps to the current run scope.
-
Worker-native state is becoming a memory layer.
- Recaps, memory patches, skill curators, and task state are moving into worker tools. Operators should use them, but should preserve an operator-owned record of what state governed each run.
-
Authority semantics are explicit but fragmented.
- Permission profiles, workspace trust, env loading, hooks, MCP behavior, extension schemas, and provider transports differ by worker and release.
-
Verification is becoming a worker capability.
- Provider-native review, multi-agent execution, subagent evals, curator reports, and QA-like cloud fleets can catch useful issues, but their verdicts are not automatically the operator's truth.
-
Plugin, extension, and skill ecosystems are becoming the integration surface.
- The practical power of worker CLIs increasingly depends on plugins, hooks, extensions, skills, and transport modules, not just the base model.
-
Worker integrations are not durable doctrine.
- Pi removed built-in Gemini CLI and Antigravity support while adding many providers; Gemini preview/nightly channels differ materially; Codex alpha releases and app-server surfaces move quickly.
-
Provider-native long-horizon state is now table stakes.