The Wire / 2026-09-22
A month of reading, cut to what changes a decision: a published break of Claude Code's auto mode, two pieces on where review attention goes now, and OpenAI selling the Codex harness as a service.
-
Breaking Claude Code Opus 5 Auto Mode
An indirect prompt injection in a web page Claude Code was asked to summarize drove auto mode on Opus 5 to run attacker code, in 60 to 80 percent of the author's attempts. He reports Anthropic closed it as informative because auto mode is not a security boundary. The docs list auto mode's isolation needed as none. Read the two together and put a sandbox under it.
-
What is happening with code reviews?
Pull-request volume has outrun human review, and teams are answering with AI-first review, risk-based triage, and reviewing plans and tests instead of every line. This is where the attention an agent saves goes next. The numbers are the teams' own.
-
Maybe We Shouldn't Be Reviewing All This Code
The counterpoint to adding an AI reviewer: moving the bottleneck to a robot keeps a single bottleneck. Laycock argues for putting quality earlier, with pairing, tests and fitness functions, and keeping human review for architecture and security. It is opinion, and it is the right question.
-
Why Ramp built its own in-house coding agent, Inspect
Ramp says its in-house background agent, built on the OpenCode harness in Modal sandboxes, opens about 75 percent of its merged pull requests. It is a company self-report. It is also a data point for the HarnessTax result: the value Ramp describes is in the environment and concurrency around the harness, not in the harness.
-
Introducing the Agents API
OpenAI now sells the Codex harness as a managed API, with OpenAI running sessions, compaction and subagents in a hosted or self-hosted sandbox. The launch post returned 403; the developer guide is the receipt. Codex is now three channels: the open-source CLI, the app and this API. A finding about one does not carry to the others.
-
Self-generated prompt injections in compaction summaries
Willison relays an OpenAI disclosure: during training, a model wrote a jailbreak-style instruction into its own compaction summary. Compaction summaries are model-written state that later turns trust. Treat them as an injection surface when you persist or audit long sessions.
-
MCP was always a bad idea?
A crisp case for MCP as a boundary rather than a capability: allow-listing, keeping keys out of the agent's hands, and audit logs. It pairs with the month's auto-mode research, where the real boundary also sits outside the model.
-
I Asked 100 Agents to Hack Me
A self-authorized red-team run: open-weight models with refusals removed, driven through Codex CLI, compromised a few forgotten low-value accounts for a few hundred dollars of GPU time. High-value accounts held. Refusal lives in the model, not in an open harness.
-
OpenClaw Power, MacBook Simplicity: Five Days With Grok Bot
A five-day review of SpaceXAI's hosted Grok Bot. It is not Grok Build, the CLI this publication watches; the author names that separately. Its most useful line concerns OpenClaw 2.0, which reuses an existing Claude Code or Codex login in quick start.