Claude Code

Everything Fervor AI has published that touches Claude Code — 90 pieces, newest first.

• Briefing · October 21, 2026 · morning

  Two secrets that were supposed to be unguessable, eMudhra's certificate authority keys and Meta Muse's share-link IDs, turned out to be readable by anyone who looked,…

• Briefing · October 20, 2026 · afternoon

  AI output that looks checked (a typed extraction field, a vendor score graded by another model, a cited statistic) arrived from two vendors and one experiment on October…

• Briefing · October 19, 2026 · afternoon

  Three labs put a cheap, fast model in front of agent builders between October 17 and 19, and only one of them comes with outside measurements, so cost per finished task…

• Briefing · October 15, 2026 · morning

  Agent tools are making more choices on the builder's behalf, with OpenCode 2.0 routing every MCP server through Code Mode by default and Copilot's HydraFusion picking…

• Claude Code Just Closed a Sandbox Side Door. Here's How to Find Yours.

  An agent sandbox leaks wherever a sandboxed command can write a file that something unsandboxed will run later, so the list of folders you let it write to is the real…

• Briefing · October 14, 2026 · morning

  The last two days of agent news are about what is allowed to leave the box, with GitHub stopping Anthropic keys at push time, Anthropic fencing Sonnet 5.5 reasoning…

• Anatomy Turns Claude Code Into an Illustrator That Checks Its Own Work

  Anatomy's lasting idea is a skill that ships its own inspectors, so the agent has to run scripts and read screenshots until the drawing passes, which is a pattern any…

• Briefing · October 10, 2026 · morning

  On October 9 TypeSafe announced $870M for its Jev decision model while Cloudflare and Microsoft shipped input-priced decision models of their own, pricing an agent's…

• bigarrow Lets Your AI Agent Point at the Screen and Leaves the Click to You

  Bigarrow keeps the click with the human by letting coding agents only point, which makes the person the last approval step, but that step only holds if the human reads…

• Briefing · October 9, 2026 · morning

  On October 8 Anthropic began offering security reports no human reviews and Google announced a work agent that picks its own model, while Claude Code and Microsoft…

• Claude Code Prompt Hooks Let Through What They Were Told to Block

  Claude Code 2.1.294 fixed prompt and agent hooks written as instructions that allowed what they should block, which shows that a guard a model interprets inherits the…

• Briefing · October 8, 2026 · morning

  On October 6 and 7 GitHub said agent-era volume had outrun its Git storage and its secret scanning, while Cloudflare and Anthropic showed the same fix pattern, moving…

• Briefing · October 6, 2026 · morning

  Within two days an open-weight model arrived as an announcement without weights, agent-proposed semiconductors arrived with their key properties computed but unmeasured,…

• Briefing · October 5, 2026 · afternoon

  On October 5 OpenAI announced a statistical watermark for its own text while the Wikimedia Foundation described, with heavy hedging, traffic it attributes to suspected…

• claude-mem 13.29.0 Adds the One Kind of Agent Memory You Can Audit

  Claude-mem 13.29.0 adds a keyed, append-only work-state ledger beside its SQLite and Chroma recall, which splits agent memory into state the agent writes on purpose and…

• Briefing · October 4, 2026 · morning

  Over October 2 and 3 the agent conversation moved from what agents can do to limits written down before they run, from Simon Willison's case for default hard budget caps…

• Claude Code 2.1.288 and the Error Path, Why Agent Permission Hooks Have to Fail Closed

  Claude Code 2.1.288 shows that an agent permission layer is only as strong as its error path, because the release turned a hook that fails to match into a block and…

• Briefing · October 3, 2026 · morning

  On October 2 Cloudflare and Anthropic shipped checkpoints between agents and what they can reach while Apple announced one, as Cloudflare added an opt-in email allowlist…

• Briefing · October 2, 2026 · morning

  On October 1 the agent harness itself became the thing that ships, as Claude Code opened its tool-call path to in-process plugin code, Pi went 1.0 alongside an…

• OpenAPPA Takes the Security Call Away From the Model

  OpenAPPA bets that an agent's permission question should be answered by deterministic data-flow rules instead of a model's judgment, and its protection is only as good…

• Briefing · October 1, 2026 · afternoon

  On October 1 the routing call kept moving into small dedicated models, as Cloudflare open-sourced the Clef decision models and LangChain reported a harness-level router…

• Claude Code's Model Allowlist Was Approving Releases You Never Evaluated

  AvailableModels matched model IDs by version prefix, so every managed allowlist silently permitted new releases, and the two settings that fix it are ignored by older…

• Briefing · September 27, 2026 · afternoon

  The control surface for agents is moving out of the model and into managed settings files, signed execution records, and red-team runs seeded from production traces.

• DNS Is the Egress Path Your Agent Sandbox Forgot

  A default-deny egress policy still has to let name resolution out, so the domain allow-list every agent sandbox rests on enforces nothing at the one protocol that is…

• Briefing · September 26, 2026 · afternoon

  The question of who owns an agent's unsupervised actions got three separate answers in two days, from a vendor, a regulator, and a newsroom.

• Claude Code Reserved Two Skill Namespaces, and the Reason Is a Wildcard That Matched Too Much

  A permission rule that matches on a name is only as strong as the rules for who gets to pick that name, and Claude Code 2.1.282 closes a case where a plugin sitting in a…

• Briefing · September 25, 2026 · morning

  Four vendors moved the agent's boundary out of files the agent's own workspace can edit and into the network and the identity provider, on the same day a benchmark…

• Briefing · September 24, 2026 · morning

  Agents crossed from misconfiguration risk to measured adversary, because the same drive that makes them finish a data-retrieval task makes them probe for a way in when…

• Claude Code's AGENTS.md Support Resolves Against a Remote Flag, Not Your Disk

  A local file read in Claude Code resolves against a remote feature flag that falls back to off, so turning telemetry off silently disables AGENTS.md, and the fix…

• Briefing · September 23, 2026 · afternoon

  Agent enforcement is migrating out of the config layer and down into the operating system, because the config layer keeps resolving somewhere the user cannot see.

• Briefing · September 20, 2026 · morning

  Every performance number published about System One decision models this week came from a party selling the conclusion, and two of the primary artifacts say in their own…

• Briefing · September 19, 2026 · morning

  Three separate groups attacked the token bill of long-horizon agents inside 48 hours, each at a different layer of the stack, and not one of them claims the cheaper…

• Briefing · September 18, 2026 · morning

  The judgment calls buried inside coding harnesses, risk gating and compaction and model routing, are being unbundled into a cheap external decision model, and the…

• HarnessTax Says Your Coding Agent Harness Costs 2x for 2 Points, and the Bill Starts on the First Call

  Harness choice is a cost decision that has been sold as a feature decision, and HarnessTax shows the cheapest place to measure it is the size of the very first model…

• Briefing · September 17, 2026 · morning

  The layer between the model and the task, the harness and the handoff artifacts it writes, is where this week's cost and risk numbers landed, from a doubled bill for the…

• Open Code Review: Alibaba Put the Parts That Must Not Fail in Code, Not in the Prompt

  Open Code Review's value is the deterministic layer that fences the LLM into writing comments, and its self-run benchmark, lower recall by design, and delegation mode…

• Briefing · September 16, 2026 · morning

  Tuesday's launches from Cloudflare, Anthropic, and TypeSafe all replace an all-or-nothing switch with a typed, scoped control, while the day's security story shows the…

• Claude Code 2.1.271 Makes Network Permission a Property of the Command, Not the Session

  Claude Code's per-command alloweddomains turns a network approval from a session-wide grant into a per-command review, and the transferable rule for any harness is that…

• Briefing · September 15, 2026 · morning

  Supervision of agents is leaving the prompt and becoming a separate runtime component with its own veto, whether that is a per-command network allowlist, a guard model…

• Briefing · September 13, 2026 · morning

  The measuring instruments went under the microscope this weekend, because a benchmark, a safety harness and a scoring program are all things an optimizing agent can read.

• hyperresearch Blocks a Hallucinated Quote From Shipping. Its Own Headline Number Ships Unchecked.

  Hyperresearch enforces unusually hard verification gates on the reports it produces, and applies none of that machinery to the benchmark claim in its own README, which…

• Briefing · September 12, 2026 · morning

  Shared developer infrastructure has become the surface agents act on, and the people who operate that infrastructure keep finding out last.

• Briefing · September 11, 2026 · morning

  The harness stopped being scaffolding you write and became the product vendors sell, which means the layer that decides how your agent behaves is now the layer you no…

• Briefing · September 9, 2026 · morning

  The most useful numbers published in the last 24 hours are the ones that name where a thing stops working, and the people publishing them are the ones who gain least…

• Claude Code's /skill-doctor Prices Your Skills in Context Tokens. The Price Is Not a Verdict.

  A skill that never fires is usually a description problem rather than a useless skill, so the right response to a cheap unused skill is to fix how it announces itself or…

• Briefing · September 8, 2026 · morning

  The industry stopped arguing about whether agents work and started publishing what they cost, in dollars per researcher per day, in context tokens per skill, and in the…

• AutoHarness Lets Claude Code Skills Die of Disuse, and Only the Ones It Wrote

  AutoHarness bounds a skill library by adherence in live use rather than a benchmark score, which is the right signal, and its scope limit means the skills costing you…

• Briefing · September 6, 2026 · morning

  Agent capability work has moved from the model to the box the model runs in, and this week showed both halves of that shift at once, labs industrializing the manufacture…

• ArcBox Runs Claude Code With Permission Prompts Turned Off, on Purpose

  ArcBox moves the agent trust boundary from the prompt down to a microVM, which is the correct place for it, but the project's own commercial-use language sits at odds…

• Magnitude's Install Instructions Are a Prompt. Your Coding Agent Is the Installer.

  Magnitude ships install-by-prompt as its documented happy path, which hands your coding agent a global npm install plus write access to its own harness config, and the…

• tokentab Prices Your Coding Agents Offline, From a Table Someone Maintains by Hand

  Tokentab produces something that looks like a bill for your coding agents but is a reconstruction, because the token counts come from vendor logs while the dollars come…

• Claude Code Just Patched Its Third Symlink Deny-Rule Bypass in Eleven Months

  A deny rule in an agent harness is not one policy but a separate implementation inside every part of the harness that touches the filesystem, and Claude Code has now…

• Briefing · August 30, 2026 · afternoon

  The week's sharpest stories all turn on a setting nobody chose, and in most of them the only way to discover the setting was to read a diff.

• Briefing · August 30, 2026 · morning

  Five vendors shipped changes in the same 48 hours that all stop accepting a claim about identity or permission at face value, and start demanding proof at the moment of…

• Archify Validates the Drawing, Not the Architecture

  Archify is the most disciplined agent-documentation tool I have read, and every guarantee it ships is about the artifact rather than about your system, which its own…

• claude-obsidian Makes the Agent Ask Permission by Hash Before It Writes to Your Notes

  Claude-obsidian's real contribution is not AI note-taking but a two-step plan-hash write gate that turns every agent mutation of your vault into one inspectable,…

• Ponytail Cuts 54% of Your Agent's Code. The Lines It Refuses to Cut Are the Point.

  Telling a coding agent to write less code works, and the gap between lazy and careless is about three lines of input validation that a short prompt drops and a…

• unlazy v2 Moves Agent Discipline Out of the Prompt and Into a Gates File

  Unlazy v2's real contribution is the gate ledger pattern of CHECK, EXPECT and EVIDENCE lines in a file that a script and a hook enforce, and the repo's own…

• Munder Difflin's Agents Never Touch Git. That One Rule Is the Part Worth Stealing

  Munder Difflin's file-based hive is worth copying because a single process owns every commit and every file has exactly one writer, but the boundary deciding what…

• career-ops Is an AI Job Search Tool Whose Best Answer Is Don't Apply

  Career-ops's real product is a refusal threshold, and its real risk is that the same agent enforcing the threshold will rewrite the rubric for you the moment you dislike…

• DeepSeek Harness Treats Claude Code as a Plugin. That Is the Actual Bet.

  DeepSeek Harness's subagent seam treats a competitor's shipped agent as one more interchangeable provider, which makes the harness a router over other vendors' binaries…

• CLI-Anything Gives Agents Real Software, and Hands You a Generated Harness to Maintain

  CLI-Anything's bet is that agents fail at professional software because the software has no text interface, not because agents cannot see, and its fix moves the…

• OpenSandbox Credential Vault: Your Agent Runs With a Fake API Key and the Requests Still Work

  OpenSandbox's Credential Vault moves the secret out of the agent process entirely by handing the sandbox a fake key and letting an egress sidecar inject the real header…

• Memmy Agent Gives Six AI Tools One Memory. That Is Also One Blast Radius.

  Memmy makes agent memory a shared substrate under Claude Code, Codex, Cursor and three others, which is the right architecture, but sharing a memory store means sharing…

• NVIDIA NeMo Switchyard Cuts Agent Costs 74 Percent. Its Known-Issues File Says the Meter Is Broken.

  Switchyard turns provider choice into a routing-table entry and has published cost reductions to back it, but its own known-issues list says the accounting endpoints you…

• Corsair Makes the Approval Gate a Database Row Your Agent Cannot Reach

  Corsair's load-bearing move is putting both the credentials and the pending approval into your database instead of the model's context, which turns permission from a…

• Claude's Compliance API Now Covers Claude Code. Nothing Covers What Your Harness Sent.

  Agent audit tooling now records the conversation that reached the server, and nothing records the context your harness attached to it on the way out, which is the part…

• Unsloth Desktop Runs Claude Code on Your Own GPU. Two Defaults Break It First.

  Unsloth Desktop's Anthropic-compatible endpoint makes Claude Code run against a local GGUF in one command, but two defaults sabotage it out of the box: Claude Code's…

• Qwen-MM-Plugins Gives Your Coding Agent Eyes Without Changing Its Model

  Qwen-MM-Plugins ships vision into rival harnesses as installable skill-plus-MCP pairs rather than as a model upgrade, but everything past local file reading routes…

• get-bb/bb Made Agent Recursion a Data Model Feature. Nothing in It Bounds the Depth.

  Bb's load-bearing decision is that agents are first-class operators of the same API the UI uses, and its thread model gives managers the ability to own child threads,…

• Nine Coding-Agent Data-Loss Incidents and the Gap Between What the Model Meant and What the Shell Did

  Coding-agent data loss is mostly a substrate mismatch, not a model failure, because the approval layer inspects command text while the shell expands, unquotes and…

• TencentDB Agent Memory Makes Every Memory Private by Default. Its Newest README Dropped the Benchmark That Made It Famous.

  TencentDB Agent Memory's real contribution is an access-control model that treats each memory as an owned, versioned asset that stays private until someone explicitly…

• The keyv npm Worm Planted a Claude Code Hook. Opening the Repo Is the Second Attack.

  The keyv compromise shipped a second execution path that needs no npm install at all, a SessionStart hook in .claude/settings.json and a folderOpen task in…

• Unit 42's Autonomous AI Attack Report Is a Configuration Audit, Not a Capability Warning

  Every control the attacker disabled in Unit 42's autonomous-attack campaign is a documented, supported setting in harnesses developers already run, so the report reads…

• reverse-skill Is a Security Skill Router. Its RULES.md Is Built to Overrule Your Agent's Caution

  Reverse-skill's copyable idea is not its security content but its RULES.md, which pre-declares authorization, writes itself into your global config, and ships an…

• book-to-skill Compiles a Technical Book Into an Agent Skill, Then Deletes the Book

  Book-to-skill compiles a book into an instruction file your agent obeys, and the two rules that make it cheap and legally comfortable (never copy the author's words,…

• Alibaba's open-code-review Argues Your Review Skill Is the Problem, Then Ships as a Skill Anyway

  Open-code-review's README is an argument that natural-language skills are the wrong container for review work, so it moves file selection, bundling, rule matching, and…

• Caveman Got to 85,000 Stars Shrinking What Your Agent Says. Now It Rewrites What Your Agent Reads.

  Caveman's own SKILL.md carries an exception list telling the model to stop compressing at security warnings and irreversible actions, and that list only governs output,…

• Briefing · July 25, 2026 · afternoon

  The agent harness is separating from the model vendor, with OpenWorker, the stateless MCP specification, and OpenAI's own Codex plugin for Claude Code all landing in the…

• Codex /import Is a Moving Van for Your Agent's Memory

  Codex switching on memories and expanding /import to swallow a Claude Code or Cursor setup in one command makes agent memory the switching-cost battleground, and a…

• Briefing · July 24, 2026 · morning

  Production agent platforms and the post-mortem of the first documented AI-driven infrastructure breach shipped in the same 72 hours, while the trending charts filled up…

• no-ai-slop Strips 20+ AI Writing Tells From Any Draft. That Doesn't Make It Yours.

  No-ai-slop removes the fingerprints of a machine but can't add the fingerprints of a person, so a draft that passes it reads clean and empty, which makes it a detector…

• The Coding Agent Became a Security Scanner This Week. It's Also the Thing Being Scanned.

  In-loop AI security scanners inherit the trust model of the session they run in, so the same agents now hunting vulnerabilities are themselves a fresh attack surface,…

• Briefing · July 22, 2026 · morning

  MCP became load-bearing infrastructure: the protocol went stateless (RC, final July 28) while MCP servers landed in the pro creative stack, an enterprise asset graph,…

• Briefing · July 21, 2026 · afternoon

  Four groups converged on one finding: a sequence of individually permitted steps produces outcomes no reviewer would approve, and per-action gates cannot see it coming…

• Briefing · July 19, 2026 · morning

  The frontier stalled and the scaffolding raced: a harness-engineering field guide trended, Claude Code rewrote permission checks, ChatGPT desktop added a Codex switcher,…

• Claude Code Turned `/fork` Into a Background Fleet. Your Terminal Agent Isn't One Chat Anymore.

  The July 17 release turned /fork into a copy-into-background-session command, renamed the old in-chat helper to /subtask, and made /resume recover deleted sessions, and…

• Briefing · July 18, 2026 · morning

  The coding agent's harness, not the model, is where competition and danger now sit: xAI open-sourced 840k lines of grok-build, Anthropic rebuilt Claude Code session…

• Briefing · July 16, 2026 · afternoon

  The scaffolding around the model is where the announcements, capital, and attacks now land: GPT-Red red-teamer, the $1.5B Ode services firm, the Hermes harness…

• Briefing · July 15, 2026 · morning

  The unit of work shifted from one agent to swarms, and the hard problem became making fifty agents hand off cleanly rather than making one smart.