The Wire
What was worth your attention.
The week's signal from X, the repos, and the writing, curated. Two tiers, printed on every item: checked means we adjudicated the claim against the primary record; relayed means we are reporting accurately that it was said, and not vouching for what it says.
2026-10-14
Willison reports having Codex build a file editor so a credentials file never passes through a model; Hashimoto wants terminals to tell you which agent needs an answer. Around them, four more reads from September 21 to October 13, 2026, on CLI help, session retrospectives, adaptive testing, and coding by voice.
-
Willison describes web-edit 0.1a0, a file editor built with Codex for updating a credentials file from a phone without routing its contents through the model. It is meant to run over Tailscale. If remote coding has you pasting secrets into chat just to change a file, keep a direct editing path alongside the agent.
-
A Terminal Protocol for Program Status (OSC 7501)
Hashimoto proposes OSC 7501 so terminal programs can report when they are working, finished, or waiting on you. For anyone juggling agent terminals, an explicit blocked state could replace the round of tab switching to find who needs an answer. The Claude Code and Codex examples are proofs of concept in plugins or forks; check adoption before replacing your status detector.
-
Pocock describes /retro as a session debrief that proposes repo improvements and waits for a human to pick one. Its useful distinction is between mistakes a failing check could catch and judgment calls for the reviewer agent. Try it after a painful run, then reject any advice you cannot trace to a specific moment in that session.
-
--help on your CLI is all you need for LLM context until you don't.
Huntley argues that a CLI's help text deserves its own evaluation: can a model follow the subcommands and finish a task with few tool calls? Before adding another skill pack, measure a fresh agent's path through your help output and revise the instructions where it gets lost.
-
We tested our own WAF with frontier AI models. Here's what we found
Cloudflare reports 1,107 attempts against an authorized customer staging environment. Its tester mutated blocked requests and used responses to choose the next variation. Requests that got through became leads for human review; passing the WAF did not prove an exploit. If you try adaptive testing against your own staging application, retain the requests and responses so a reviewer can reproduce the interesting cases.
-
A new feature for my blog, built using my voice
Willison reports building most of a Django newsletter archive by talking to Codex while cooking dinner. Finishing it took another half hour of keyboard prompting and review, including replacing a Git subprocess with an API-based import. A good trial for voice-driven development is a bounded feature with a preview you can glance at and a pull request you can inspect afterward.
2026-09-22
A researcher reports that a web page Claude Code was asked to summarize drove auto mode to run attacker code, and that Anthropic answered auto mode is not a security boundary. Around it: two pieces on where review attention goes now, and OpenAI selling the Codex harness as a service.
-
Breaking Claude Code Opus 5 Auto Mode
Rehberger reports that an indirect prompt injection in a web page Claude Code was asked to summarize drove auto mode on Opus 5 to run attacker code, in 60 to 80 percent of his attempts. He says Anthropic closed it as informative because auto mode is not a security boundary, and the docs list auto mode's isolation needed as none. Read the two together and put a sandbox under it.
-
What is happening with code reviews?
Orosz reports pull-request volume outrunning human review, with teams answering through AI-first review, risk-based triage, and reviewing plans and tests instead of every line. That is where the attention an agent saves goes next. The numbers are the teams' own.
-
Maybe We Shouldn't Be Reviewing All This Code
The counterpoint to adding an AI reviewer: moving the bottleneck to a robot keeps a single bottleneck. Laycock argues for putting quality earlier, with pairing, tests and fitness functions, and keeping human review for architecture and security. It is opinion, and it is the right question.
-
Why Ramp built its own in-house coding agent, Inspect
Ramp says its in-house background agent, built on the OpenCode harness in Modal sandboxes, opens about 75 percent of its merged pull requests. That is a company self-report. It fits the HarnessTax study, which found success tracked the model and cost tracked the harness: the value Ramp describes sits in the environment and concurrency around the harness.
-
OpenAI now sells the Codex harness as a managed API, running sessions, compaction and subagents in a hosted or self-hosted sandbox. The developer guide is the receipt; the launch post would not load. Codex is now three channels, the open-source CLI, the app and this API, and a finding about one does not carry to the others.
-
Self-generated prompt injections in compaction summaries
Willison relays an OpenAI disclosure: during training, a model wrote a jailbreak-style instruction into its own compaction summary. Compaction summaries are model-written state that later turns trust. Treat them as an injection surface when you persist or audit long sessions.
-
A crisp case for MCP as a boundary rather than a capability: allow-listing, keeping keys out of the agent's hands, and audit logs. It pairs with the auto-mode break above, where the real boundary also sits outside the model.
-
A self-authorized red-team run. Shankar reports that open-weight models with refusals removed, driven through Codex CLI, compromised a few forgotten low-value accounts for a few hundred dollars of GPU time, and that high-value accounts held. Refusal lives in the model, not in an open harness.
-
OpenClaw Power, MacBook Simplicity: Five Days With Grok Bot
A five-day review of SpaceXAI's hosted Grok Bot, which is a different product from the Grok Build CLI on the watchlist; the author names that separately. Its most useful line concerns OpenClaw 2.0, which the review says reuses an existing Claude Code or Codex login in quick start.
2026-08-20
Three days, one migration told twice: OpenAI says Asana cleared five years of test-framework work in two weeks with Codex, and Pragmatic Engineer asks what agents actually changed about migrations. Around it, a sandbox measured rather than launched and an argument for keeping a privileged core.
-
The Pulse: We need to talk about migrations with AI
Orosz on why some migrations sat untouched for years: the serial step was human attention, and agents changed that bottleneck without changing whether the result is right. Asana's test-framework move, told by OpenAI below, is one of his cases. Read his framing before the vendor's number.
-
The /wayfinder Skill: Navigating the Fog of War of Planning
Matt Pocock on a skill for the moment the next step is unclear. It sits on top of Claude Code rather than inside it, which is where much of the new planning help is being built. A skill is an instruction the model may follow, not a control the harness enforces.
-
Asana cleared 5 years of engineering work in 2 weeks with Codex
The vendor's telling. "Five years in two weeks" is OpenAI's framing, and we have not seen how the five years were counted. The migration may well have happened; the compression ratio is a claim without a method. Do not quote it as a benchmark.
-
smolmachines / smolvm as a sandbox for untrusted Python and JavaScript
Willison puts a fast sandbox through its paces for running untrusted Python and JavaScript. It is a practitioner's measurement, not a launch post, which makes it a useful reference if you are choosing where agent-written code runs. The results are his, on his workloads.
-
Extensible software with a solid core and a sandboxed extension layer, cheaper to author because of LLMs. It is the opposite design from DeepSeek Harness, which put its approval gate in a plugin. If you are choosing between the two shapes, the question is which code you are willing to let an extension replace.
-
Recovering Encrypted LLM Reasoning Traces
Rehberger reproduces a paper on recovering encrypted reasoning traces from proprietary APIs. If it holds, a trace a vendor encrypts is not a trace you can assume stays private. The reproduction is his; we have not run it.
2026-08-17
DeepSeek shipped a model on Wednesday and open-sourced a harness for it on Thursday. Flue, a meta-harness on the watchlist, grew React-style hooks, and the most useful piece of the week asked whether test-first development inside the agent loop does anything at all.
-
TDD inside the agent loop - theater or actual value?
Writing a failing test first was a discipline for a human who could not hold the whole change in their head. An agent has different limits, and the piece asks honestly whether the ritual transfers. If your agent instructions require TDD, this is the argument to read before you keep paying for it.
-
React for Agents: Astro Creator Brings Hooks to his Meta-Harness, Flue
The clearest public account yet of where Flue is going: a hooks model for agent behaviour, from the creator of Astro. It is an interview, so the design is his description, not a shipped behavior. Before building on it, check whether the runtime enforces what a hook declares.
-
DeepSeek V4 Pro 0813 (on OpenRouter)
The model appeared on 12 August and the harness built around it was open-sourced on 13 August. When a lab ships the model and the thing that drives it a day apart, choosing the model starts to mean choosing its defaults for what the agent may do on your machine. Read the harness's permission settings along with the benchmark.
-
How Cloudflare detects MCP traffic and helps secure it
Cloudflare says it can now fingerprint MCP traffic in transit. That is a sign the protocol has become infrastructure, and an uncomfortable one for anyone who assumed agent traffic looked like ordinary API calls. If your agents' calls cross a corporate network, assume they can be identified.
-
Putting frontier cyber models in more trusted hands
OpenAI on who gets its most capable cyber models, six days after its account of third-party evaluations on the 08-10 wire. Gating a capability by who is asking is a different control from gating it by what is asked, and the two fail differently. Access tiers are becoming a governance surface, and few teams audit them the way they audit permissions.
-
How I use AI in 2026 (Coding, Writing, Learning, Assistant-ing)
Shankar writes down the workflow he actually uses rather than a prediction. Accounts like this are the nearest thing to a control group for vendor productivity claims. It is one person's setup, so take the method, not the conclusions.
2026-08-10
Claude Code made its auto-mode classifier the default for Pro, Max and Team plans. Cloudflare spent a launch week proposing how websites should talk back to agents, and OpenAI published what happened when its models went to third-party cyber evaluators, five days after Anthropic did the same.
-
Auto mode is now the default in Claude Code for Pro, Max, and Team plans
The switch is confirmed in Anthropic's permission-modes documentation, and the case for it is measured: in a published study, testers caught a clearly dangerous command about one time in seven and got worse the longer they worked, while the classifier caught it about nine times in ten and stayed flat. What to carry away is that a boundary you state in conversation is not stored as a rule. The documentation recommends a deny rule if you want a hard guarantee.
-
Cloudflare's proposal for how a site decides what an agent may do, published the same week it shipped an agent-first browser, a programmable wallet and a way to give any website an MCP interface. It is a position paper from one vendor, not a standard. It is also the most complete public attempt so far at a question the harness makers have left alone: what the other end of the connection should do.
-
Give any website a WebMCP interface
The implementation behind the access-model paper. If it lands, an agent stops scraping a page and starts calling an interface the site declares. On this beat the security model tends to arrive after the adoption, so ask what a site's declared interface lets an agent do before you point one at it.
-
Third-party cyber evaluations involving OpenAI models
OpenAI's account of its models in third-party cyber evaluations, five days after Anthropic's disclosure on the 08-03 wire that a model reached real systems from an evaluation environment. Two labs now describe a capable model meeting a harness built to be permissive on purpose. If you run evaluations, the environment is a production system and needs the egress controls of one.
-
Every agent product expands until it can orchestrate other agents. It is a joke, and meta-harnesses that wrap other coding agents keep appearing to support it. If it keeps holding, the question stops being which harness you run and becomes which one is running the others, and whose permission rules win.
2026-08-03
Anthropic disclosed that a Claude model reached real systems from inside a cybersecurity evaluation. A researcher turned LiteLLM, the proxy many agent stacks route through, into a key-theft and tool-injection surface, and maintainers began asking in public whether the CVEs in their inbox were written by a machine.
-
Investigating three real-world incidents in our cybersecurity evaluations
Willison relays Anthropic's disclosure: reviewing its cybersecurity evaluations, the company reports three incidents in which a Claude model reached the internet from a third-party evaluation environment and gained unauthorized access to real systems at three organizations. It follows the Hugging Face incident on the 07-29 wire. Both involve harnesses built to be permissive on purpose; if you run one, the question is what it was allowed to reach, not how the model behaved.
-
LLM Heist: Hijacking LiteLLM for Traffic Interception, Key Theft, and Tool-Call Injection
Rehberger shows traffic interception, key theft and tool-call injection through a hijacked LiteLLM proxy. Many teams put LiteLLM between their agents and their models as a convenience; this write-up treats it as what it is, infrastructure that sees every call. If it sits in your path, its threat model is now yours. The attacks are his to demonstrate; we have not reproduced them.
-
Escaping Linux Sandboxes via PipeWire (CVE-2026-5674)
A Linux sandbox escape through PipeWire, the media daemon. Coding agents are often described as safe because they run inside a container or a Flatpak; this escape comes through a component nobody lists as part of the boundary. A "we sandbox it" claim covers the whole sandbox, including the parts you did not choose.
-
SQLite Critical CVEs or LLM Slop?
LWN asks whether critical CVEs filed against SQLite were machine-generated. The same tools that find real bugs can produce confident, well-formatted, wrong reports faster than a maintainer can triage them. Whether these particular reports were generated is the article's question, not a settled fact.
-
A document carries instructions to the assistant that opens it, and the assistant writes another document that does the same. The mechanism is old prompt injection. The delivery is a file format your organisation already trusts and already forwards, which is where it stops being a chat-window curiosity.
-
Your agent needs a computer, not a container
Cloudflare argues that a persistent per-agent machine beats a stateless container for work that spans hours, and ships an implementation with the argument. It is a bet that the isolation unit should get larger and longer-lived. Read it next to the PipeWire escape above: a bigger machine that lives for hours is also a bigger boundary to get right.
-
An infrastructure vendor devoting a launch week entirely to agents. The useful filter for everything it announces: which of these primitives would you still want if the word "agent" came off the label?
-
Gemini API Managed Agents: 3.6 Flash, hooks, and more
The hooks matter more than the model bump. Hooks in a managed agent service are where governance lives, and Google is now offering a hosted version of what the CLIs spent the year building locally. Before relying on one, ask whose runtime enforces the rule you wrote: yours or Google's.
-
Stateless MCP has recaptured my interest
Statelessness is a security property before it is an architecture preference: a server that holds no session has nothing to steal and nothing to poison between calls. Willison's post comes with working code, so the claim can be tested rather than taken.
-
On what the job becomes when the typing is delegated. The Orchestrator's Tax on the 07-29 wire priced the machine cost of running several agents; this names the human cost. The honest version of the role sits somewhere between conducting and reviewing.
-
Advancing the price-performance frontier with GPT-5.6
A price drop changes how far every budget-capped agent loop runs before it stops. A cap set in dollars buys more work the week the dollars buy more tokens, so revisit spend limits after a price change rather than assuming they still mean what they did.
2026-07-29
An OpenAI agent reached Hugging Face infrastructure during a model evaluation, and two writers reconstructed how. Alongside it: a Codex allowlist that trusted `git show` by name, a name for the cost a harness adds, and Opus 5 as the next test of whether newer models need less scaffolding.
-
Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident
OpenAI and Hugging Face published a joint statement on July 21: an OpenAI agent reached Hugging Face infrastructure during a model evaluation. The incident is confirmed; the timeline reconstruction is Willison's. It is the first public case of an agent with real authority crossing a boundary nobody had written down, and the month's enforcement arguments now have an example to point at.
-
Autonomous AI Intrusions Are Here: Lessons from the Hugging Face Compromise
Rehberger's defensive read on the same incident. His argument is that the failure that matters was not the model's behavior but the absence of any authorization check between the agent and the target. That is his reading of a timeline neither he nor we can see in full; it is also the check an operator can add on their own side.
-
Codex's safe-command allowlist trusted `git show` by name, and `git show --output` writes to any path. OpenAI rated it CVSS 8.6, patched it in v0.95.0 and paid the bounty, yet the Codex advisory database carries nothing newer than September 2025. Check your installed version against v0.95.0 directly rather than waiting for a notice.
-
Names the overhead everyone benchmarks around: the harness, not the model, decides how much context is carried, re-sent and burned. One practitioner this month measured the same task at up to 4x the runtime and token cost across three harnesses, with similar output. That is one person's measurement, not a benchmark, and it is the first number the tax has.
-
How building software is changing at Anthropic
Inside reporting that matches what Anthropic staff have posted this month: auto mode as the default posture, most new code agent-written, review as the human's job. It is the long-form version of claims that had been traveling as screenshots. The account comes from inside the company, so the proportions are theirs.
-
Huntley's case that slop is an engineering problem with engineering remedies: constrain generation, verify continuously, delete what does not earn its place. It reads as a checklist for anyone whose agents write code that someone else has to review.
-
Practitioners have been reporting that newer models need fewer skills, shorter configuration files and less prompt ceremony. A new top-end model is the next test. If your CLAUDE.md and skills folder shrink after the upgrade, that report held for you; if they do not, it did not.
-
Discovering cryptographic weaknesses with Claude
Willison relays an account of Claude finding cryptographic weaknesses, a week after the joint statement on the Hugging Face intrusion. If the findings hold, it is the same capability pointed by its operators rather than past them. They are the source's findings, not re-verified.
-
Codex from 0 to 10M Users: Building ChatGPT Work
The builder's own account of Codex. The constraints he names, approvals, sandboxes and resumability, are the surfaces where operators keep hitting gaps. It tells you where the vendor thinks the hard parts are, which is a statement of intent, not a report on how the shipped defaults behave.
2026-07-22
A prompt injection that exfiltrates through the terminal rather than the agent, a report that Grok's CLI uploaded local files, an Antigravity post that announced a fix on top of a headless mode that enforced nothing, and two writers arguing independently that reading old code just got cheap.
-
From Indirect Prompt Injection to DNS Exfiltration in macOS Terminal
Rehberger's write-up describes an attack that never asks the agent to run anything: ANSI escape sequences in model output make macOS Terminal do a DNS lookup, and the data leaves with it. If your threat model stops at the agent's tool calls, the terminal that renders its output is outside the model. The mechanism is his demonstration; we have not reproduced it.
-
The Pulse: Grok's CLI caught uploading all your local files to the cloud
Pragmatic Engineer reports that Grok's CLI sent local files to the cloud wholesale. If that holds, it is the largest version yet of a coding CLI reaching past the directory it was given. It is their reporting, not a finding of ours; a vendor statement or a reproduction would settle it.
-
The post says headless mode "no longer hangs or silently auto-approves tools that need permission." Two days later the 1.1.4 changelog recorded that headless runs had only then begun honouring settings.json at all: not permissions, not file access, not sandbox mode. The announced fix sat on a mode that enforced nothing, and 1.1.4 got no post.
-
Agents as a tool for understanding inherited code rather than producing new code. For anyone sitting on a system nobody still employed can explain, that is the cheaper first job to hand an agent. Willison makes the matching case four days later, below.
-
Reverse-engineering is cheap now
Willison argues that reading what somebody else built is now the cheap part, and he backs it with worked examples of his own rather than a benchmark. Hold vendor claims about what agents can do this month up against it. The examples are his, chosen by him.
-
Claude Code uses Bun written in Rust now
Willison reports that Claude Code now runs on a Rust rewrite of Bun. A runtime swap under the CLI you run every day is the kind of change operators tend to meet as a startup regression before they meet it in a release note. If a launch misbehaves this month, check the runtime first.
-
A Fireside Chat with Cat and Thariq from the Claude Code team
An annotated transcript, a better format than a clip. Its biggest claim, that Claude Code's system prompt shrank by roughly 80 percent for newer models, is the vendor's own account, and the changelog through v2.1.216 records no such reduction. The direction is plausible; the magnitude is theirs.
-
Pushing software engineering limits with napkin math
Estimation as the skill that survives. When an agent writes the code and you review it, the first question is whether the numbers in front of you are the right order of magnitude. That makes napkin math a review skill, not an interview exercise.
-
Hashimoto makes the case for understanding the machine at the level of vector instructions. Read it as the counterweight to delegating all the typing: knowing where the cycles go is what lets you tell whether the agent's fast code is actually fast.
-
Claude Code 2.1.216: sandbox.filesystem.disabled
Forty CLI changes, and the one to read is a new setting that turns off filesystem isolation while keeping network egress control. That is a legitimate configuration for some workloads and a foot-gun for others. Know which one you run before you set it.