Independent AI intelligence Two editions daily · ET
FervorAI
Menu

AI Trending Briefing · August 14, 2026 · morning edition

The human approval prompt is being retired across the agent stack this week, and the thing replacing it is an automated policy layer whose own vendor-published miss rate is eleven percent.

Claude Code auto modeGPT-5.6 Sol UltrafastMercury SpendCodex plugin for Claude CodeStrixclaude-codeagent-securityagent-paymentscodexagent-harnessagent-infrastructure

Trending AI Briefing: Friday, August 14, 2026 (morning ET)

The permission prompt was always a strange piece of engineering. It asked a person to evaluate a shell command in half a second, forty times an hour, and it worked about as well as you would expect. Today Anthropic retires it as the default in Claude Code and hands the job to a classifier. Mercury did the same thing to expense approval three days ago by issuing agents their own cards. OpenAI removed the last practical excuse for reading along by putting its most capable model on silicon that emits 750 tokens per second. Three companies, one week, one deletion: the moment where a human said yes.

What's hottest in AI news right now

Auto mode becomes the default permission mode in Claude Code today, August 14, on Pro, Max, and Team plans. A separate classifier model now inspects each tool call and blocks anything irreversible, destructive, aimed at infrastructure it does not recognize, or apparently driven by content Claude read rather than by what you asked for. The numbers Anthropic published to justify the switch are the interesting part. In a 1,053-person blind study run through a research vendor, one permission prompt was swapped mid-session for a clearly dangerous command. Testers caught it 143 times, or 13.6 percent. Auto mode caught 937 of the same commands, or 89 percent. Human catch rates fell to roughly 5 percent after fifty or more prior prompts, while the classifier held flat. Anthropic also notes users already approve 97 percent of requests, which is the real argument: the prompt stopped being a control long before it was removed. Auto mode stays opt-in on Enterprise, the Claude API, Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry, with defaults planned there within the month. Organization-managed defaults do not move. (Anthropic, permission modes docs, TechCrunch, The Register)

OpenAI previewed Ultrafast mode on August 13, an API service tier that runs GPT-5.6 Sol at up to 14 times Standard processing speed, generating up to 750 output tokens per second. The compute comes from Cerebras, extending a partnership that now carries OpenAI's most capable model rather than a distilled one. The framing is worth reading closely: real-time speed previously meant dropping to a smaller model, and the pitch here is "more useful work per second" with no intelligence tradeoff. Named early users include Jane Street, Podium, Basis, and Rogo. OpenAI's own internal case is incident response, reading logs and validating a fix while the outage is still unfolding. Limited preview, expanding as capacity grows. (OpenAI)

Mercury launched Mercury Spend on August 11 with Agent Cards, virtual credit cards a human creates and an AI agent then uses autonomously, completing purchases end to end with nobody signing off on individual transactions. The controls moved into the card: intelligent budgets create spending pools for travel, software, or procurement, and expense policies enforce themselves at authorization time rather than at review time. Same architectural move as auto mode, denominated in dollars. The approval step did not get better, it got compiled into policy. (Mercury, Business Wire, Fast Company)

OpenAI's Codex plugin for Claude Code is sitting near the top of GitHub trending, at 31.9k stars and 2.2k forks, Apache-2.0. It installs as a plugin marketplace and adds /codex:review, /codex:adversarial-review, /codex:rescue, /codex:transfer, /codex:status, and /codex:cancel, letting one vendor's agent hand work to a competitor's for a second opinion or a cheaper pass. The adversarial review is the sharp one: it pressure-tests design decisions and tradeoffs rather than checking syntax. An optional review gate uses a Stop hook to block Claude from finishing until Codex comes back clean, which the README itself warns can drain usage limits fast. No dated announcement post accompanies this, so the repository is the primary source. (GitHub)

Claude Code shipped v2.1.231 on August 13, mostly a fix for MCP OAuth sign-in failing with a redirect URI mismatch on servers using a pre-registered OAuth client, Slack among them. The August 12 release, v2.1.229, is the more structural one: server-supplied hooks for self-hosted runner sessions, matching managed-environment behavior, plus SSE keepalive pings so long thinking pauses stop tripping idle timeouts on Vertex and Bedrock. Server-supplied hooks are the quiet version of today's headline. Policy is moving off the developer's laptop and onto infrastructure the organization controls. (Claude Code changelog)

New tools and features worth actually trying

Auto mode, with deny rules written first. Before your session flips today, put explicit deny rules in settings for the paths and commands you never want touched, then let the classifier handle the rest. It is genuinely better than you at catching planted destructive commands, and the study says so with real numbers. Honest tradeoff: 89 percent detection means roughly one in nine clearly dangerous commands got through in Anthropic's own controlled test. If a mistake would be unrecoverable, deny rules are the only deterministic thing in this stack.

The Codex plugin's adversarial review. Install with /plugin marketplace add openai/codex-plugin-cc, then run /codex:adversarial-review --base main before shipping anything with auth, rollback, or race conditions in it. A genuinely different model arguing with your design is the cheapest second opinion available. Honest tradeoff: it needs a ChatGPT subscription or an OpenAI key, burns Codex usage limits, and multi-file reviews are slow enough to warrant --background. Leave the review gate off unless you plan to watch the session.

Strix for pre-merge security scanning. curl -sSL https://strix.ai/install | bash, point it at a repo or a live URL, and it runs multi-agent pentests that validate findings with working proof-of-concept exploits instead of static-analysis guesses. It drops into GitHub Actions and auto-scopes quick reviews to changed files on pull requests. Honest tradeoff: it needs Docker plus a metered LLM key, defaults to high reasoning effort, and is legally usable only against systems you have written permission to test.

Herdr if you are running more than two agents. A single ~10MB Rust binary that gives every coding agent its own real terminal, rolls each one up to blocked, working, done, or idle, and keeps everything alive when you detach. It reads state for Claude Code, Codex, opencode, droid, amp, Copilot CLI, and about ten others with no hooks required. Honest tradeoff: AGPL-3.0 unless you buy a commercial license, Windows is still beta, and it is a dashboard rather than an orchestrator. It shows you which agent is stuck. It will not decide what to do about it.

Trending AI repos on GitHub today

Every repo below came off GitHub's daily trending page this morning, cross-checked against Trendshift. Star counts are from direct repository fetches where given; where no count appears, none was verified.

  • usestrix/strix: AI penetration testing agents that exploit and validate rather than flag. 51.2k stars, 5.5k forks, Apache-2.0, loudest security repo on the board.
  • openai/codex-plugin-cc: OpenAI's plugin for delegating work from Claude Code to Codex. 31.9k stars, 2.2k forks. A frontier lab shipping first-party support for a rival's harness is not a normal week.
  • agentskills/agentskills: the SKILL.md specification that Strix, herdr, and most trending skill repos now target. 21,938 stars, 1,390 forks.
  • obra/superpowers: agentic skills framework and development methodology, back on the daily board.
  • ogulcancelik/herdr: terminal-native multiplexer for a fleet of coding agents, with per-agent state detection. 10k stars, 592 forks, dual-licensed AGPL and commercial.
  • ChromeDevTools/chrome-devtools-mcp: Chrome DevTools exposed to coding agents over MCP, from the browser vendor itself.
  • safishamsi/graphify: turns code, SQL schemas, scripts, and docs into one queryable knowledge graph, as a skill for Claude Code, Codex, Cursor, and Gemini CLI.
  • facebook/astryx: Meta's open design system, built agent-ready rather than only human-ready.
  • JuliusBrussee/caveman: a Claude Code skill claiming to cut 65 percent of tokens by making the agent talk like a caveman. Treat the number as the author's, not a measured one.

Trendshift's topic board has AI agent at roughly 51.7k stars, clear of AI coding assistant at 17.3k and AI skills at 16.7k, with MCP and Local LLM both near 5.6k. (Trendshift, GitHub trending)

What actually matters from today's signal

Watch where policy lives now. It is leaving the human and it is not landing in one place. In Claude Code it lands in a classifier plus your deny rules. At Mercury it lands in the card authorization. In v2.1.229 it lands in server-supplied hooks on a self-hosted runner your org administers. These are three different trust models wearing the same clothes, and only one of them is deterministic. The four areas worth attention this week: deny-rule and allowlist design, server-side hook enforcement, agent-to-agent review as a gate rather than a courtesy, and cross-vendor delegation now that OpenAI ships a Claude Code plugin.

The counter-signal is arithmetic. Anthropic's classifier caught 89 percent of planted dangerous commands, a genuine and defensible improvement over 13.6 percent. It is also an 11 percent miss rate, measured by the vendor, in a controlled study, against attacks the study itself designed. Meanwhile the throughput ceiling just moved to 750 tokens per second. Research on mobile agent frameworks published to arXiv in July found five open-source systems failing at least six of seven attacks driven by screen text no human ever sees, which is exactly what a model-based guardrail handles worst: adversarial input shaped to look like the thing it is supposed to approve. (arXiv 2607.00333)

So write the deny rules today, before the mode flips under you. Then read your agent's session log from last week, the whole thing, once. The failure that gets somebody fired this year is not the agent that does something obviously catastrophic. Classifiers are good at obviously catastrophic. It is the agent that does nine hundred reasonable-looking things and one wrong one, fast, with a corporate card, and nobody opens the log until the invoice arrives.

Source access notes: Vendor blogs were blocked by the fetch provenance rule until their URLs surfaced through search; the Anthropic and OpenAI newsrooms then fetched successfully. GitHub's trending HTML exceeded the response limit and was read from the saved tool-result file. Trendshift and individual repository pages resolved directly. Hacker News, Product Hunt, and arXiv listings were reached through search summaries rather than direct fetch this run.