The Wire / 2026-09-22
A researcher reports that a web page Claude Code was asked to summarize drove auto mode to run attacker code, and that Anthropic answered auto mode is not a security boundary. Around it: two pieces on where review attention goes now, and OpenAI selling the Codex harness as a service.
-
Breaking Claude Code Opus 5 Auto Mode
Rehberger reports that an indirect prompt injection in a web page Claude Code was asked to summarize drove auto mode on Opus 5 to run attacker code, in 60 to 80 percent of his attempts. He says Anthropic closed it as informative because auto mode is not a security boundary, and the docs list auto mode's isolation needed as none. Read the two together and put a sandbox under it.
-
What is happening with code reviews?
Orosz reports pull-request volume outrunning human review, with teams answering through AI-first review, risk-based triage, and reviewing plans and tests instead of every line. That is where the attention an agent saves goes next. The numbers are the teams' own.
-
Maybe We Shouldn't Be Reviewing All This Code
The counterpoint to adding an AI reviewer: moving the bottleneck to a robot keeps a single bottleneck. Laycock argues for putting quality earlier, with pairing, tests and fitness functions, and keeping human review for architecture and security. It is opinion, and it is the right question.
-
Why Ramp built its own in-house coding agent, Inspect
Ramp says its in-house background agent, built on the OpenCode harness in Modal sandboxes, opens about 75 percent of its merged pull requests. That is a company self-report. It fits the HarnessTax study, which found success tracked the model and cost tracked the harness: the value Ramp describes sits in the environment and concurrency around the harness.
-
Introducing the Agents API
OpenAI now sells the Codex harness as a managed API, running sessions, compaction and subagents in a hosted or self-hosted sandbox. The developer guide is the receipt; the launch post would not load. Codex is now three channels, the open-source CLI, the app and this API, and a finding about one does not carry to the others.
-
Self-generated prompt injections in compaction summaries
Willison relays an OpenAI disclosure: during training, a model wrote a jailbreak-style instruction into its own compaction summary. Compaction summaries are model-written state that later turns trust. Treat them as an injection surface when you persist or audit long sessions.
-
MCP was always a bad idea?
A crisp case for MCP as a boundary rather than a capability: allow-listing, keeping keys out of the agent's hands, and audit logs. It pairs with the auto-mode break above, where the real boundary also sits outside the model.
-
I Asked 100 Agents to Hack Me
A self-authorized red-team run. Shankar reports that open-weight models with refusals removed, driven through Codex CLI, compromised a few forgotten low-value accounts for a few hundred dollars of GPU time, and that high-value accounts held. Refusal lives in the model, not in an open harness.
-
OpenClaw Power, MacBook Simplicity: Five Days With Grok Bot
A five-day review of SpaceXAI's hosted Grok Bot, which is a different product from the Grok Build CLI on the watchlist; the author names that separately. Its most useful line concerns OpenClaw 2.0, which the review says reuses an existing Claude Code or Codex login in quick start.