Dive into Claude Code
The Design Space of Today's and Future AI Agent Systems
English | 中文
A comprehensive source-level architectural analysis of Claude Code (v2.1.88, ~1,900 TypeScript files, ~512K lines of code), combined with a curated collection of community analyses, a design-space guide for agent builders, and cross-system comparisons.
[!TIP] TL;DR -- Only 1.6% of Claude Code's codebase is AI decision logic. The other 98.4% is deterministic infrastructure -- permission gates, context management, tool routing, and recovery logic. The agent loop is a simple while-loop; the real engineering complexity lives in the systems around it. This repo dissects that architecture and distills it into actionable design guidance for anyone building AI agent systems.
Table of Contents
From Our Paper
- 🌟 Key Highlights
- 📖 Reading Guide
- 🏗️ Architecture at a Glance
- 🧭 Values and Design Principles
- 🔄 The Agentic Query Loop
- 🛡️ Safety and Permissions
- 🧩 Extensibility
- 🧠 Context and Memory
- 👥 Subagent Delegation
- 💾 Session Persistence
Beyond the Paper
- 🛰️ New Signals in the Agent Design Space
- 🛠️ Build Your Own AI Agent: A Design Guide
- ⚖️ Cross-System Comparison: Claude Code vs OpenClaw vs Hermes-Agent
- 🔎 Find Resources by Design Question
- 🌐 Community Projects & Research
- 🚀 Other Notable AI Agent Projects
- 🤝 Contributing
- 🔖 Citation
Key Highlights
- 98.4% Infrastructure, 1.6% AI -- The agent loop is a simple while-loop; the real complexity is permission gates, context management, and recovery logic.
- 5 Values → 13 Principles → Implementation -- Every design choice traces back to human authority, safety, reliability, capability, and adaptability.
- Bounded Analysis with an Approval Fallback -- In the legacy shell-parser path, more than 50 subcommands triggers an
askdecision. - 2 CVEs Revealed a Pre-Trust Window -- In earlier releases, MCP servers and settings environment variables took effect before the user accepted the trust dialog.
- The Cross-Cutting Harness Resists Reimplementation -- The loop is easy to copy; hooks, classifier, compaction, and isolation are not.
Reading Guide
| If you are a... | Start here | Then read |
|---|---|---|
| Agent Builder | Build Your Own Agent | Architecture Deep Dive |
| Security Researcher | Safety and Permissions | Architecture: Safety Layers |
| Product Manager | Key Highlights | Values and Principles |
| Researcher | Full Paper (arXiv) | Community Resources |
1,884 files · ~512K lines · v2.1.88 · 7 safety layers · 5 compaction stages · 54 tools · 27 hook events · 4 extension mechanisms · 7 permission modes
The architecture sections describe Claude Code v2.1.88. The design guide and resource catalog extend that analysis with work reviewed through October 6, 2026, and Claude Code and Codex release notes checked through October 14, 2026. The main PDF link opens arXiv v3, October 10, 2026, which redraws the layered architecture (Figure 3) and the context figure (Figure 6) and clarifies resume and pre-trust behavior. arXiv v2 and the April 2026 repository PDF remain available as archives.
Architecture at a Glance
Claude Code answers four design questions that every production coding agent must face:
| Question | Claude Code's Answer |
|---|---|
| Where does reasoning live? | Model reasons; harness enforces. ~1.6% AI, 98.4% infrastructure. |
| How many execution engines? | One queryLoop for all interfaces (CLI, SDK, IDE). |
| Default safety posture? | Deny-first: deny > ask > allow. Strictest rule wins. |
| Binding resource constraint? | ~200K (older models) / 1M (Claude 4.6 series) context window. Context-management stages activate under their own conditions. |
The system decomposes into 7 components (User → Interfaces → Agent Loop → Permission System → Tools → State & Persistence → Execution Environment) across 5 architectural layers.
[!NOTE] For the full architectural deep dive -- 7 safety layers, 9-step turn pipeline, 5-layer compaction, and more -- see docs/architecture.md.
Values and Design Principles
The architecture traces from 5 human values through 13 design principles to implementation:
| Value | Core Idea |
|---|---|
| Human Decision Authority | Humans retain control via principal hierarchy. When a 93% prompt-approval rate revealed approval fatigue, response was restructured boundaries, not more warnings. |
| Safety, Security, Privacy | System protects even when human vigilance lapses. 7 safety mechanisms. |
| Reliable Execution | Does what was meant. Gather-act-verify loop. Graceful recovery. |
| Capability Amplification | "A Unix utility, not a product." 98.4% is deterministic infrastructure enabling the model. |
| Contextual Adaptability | CLAUDE.md hierarchy, graduated extensibility, trust trajectories that evolve over time. |
The 13 Design Principles
| Principle | Design Question |
|---|---|
| Deny-first with human escalation | Should unrecognized actions be allowed, blocked, or escalated? |
| Graduated trust spectrum | Fixed permission level, or spectrum users traverse over time? |
| Defense in depth | Single safety boundary, or multiple overlapping ones? |
| Externalized programmable policy | Hardcoded policy, or externalized configs with lifecycle hooks? |
| Context as scarce resource | Single-pass truncation or graduated pipeline? |
| Append-only durable state | Mutable state, snapshots, or append-only logs? |
| Minimal scaffolding, maximal harness | Invest in scaffolding or operational infrastructure? |
| Values over rules | Rigid procedures or contextual judgment with deterministic guardrails? |
| Composable multi-mechanism extensibility | One API or layered mechanisms at different costs? |
| Reversibility-weighted risk assessment | Same oversight for all, or lighter for reversible actions? |
| Transparent file-based config and memory | Opaque DB, embeddings, or user-visible files? |
| Isolated subagent boundaries | Shared context/permissions, or isolation? |
| Graceful recovery and resilience | Fail hard, or recover silently? |
The paper also applies a sixth evaluative lens -- long-term capability preservation -- citing evidence that developers in AI-assisted conditions score 17% lower on comprehension tests.
The Agentic Query Loop
The core is a ReAct-pattern while-loop: assemble context → call model → dispatch tools → check permissions → execute → repeat. Implemented as an AsyncGenerator yielding streaming events.
Before a model call, context management considers five stages in order: Budget Reduction → Snip → Microcompact → Context Collapse → Auto-Compact. Feature gates, settings, and thresholds determine which stages change the context.
9-step pipeline per turn: Settings resolution → State init → Context assembly → Conditional context management → Model call → Tool dispatch → Permission gate → Tool execution → Stop condition
Two execution paths:
StreamingToolExecutor-- begins executing tools as they stream in (latency optimization)- Fallback
runTools-- classifies tools as concurrent-safe or exclusive
Recovery: Max output token escalation (3 retries), reactive compaction (once per turn), prompt-too-long handling, streaming fallback, fallback model
5 stop conditions: No tool use, max turns, context overflow, hook intervention, explicit abort
Safety and Permissions
7 permission modes form a graduated trust spectrum: plan → default → acceptEdits → auto (ML classifier) → dontAsk → bypassPermissions (+ internal bubble).
Deny-first: A broad deny overrides a narrow allow in rule evaluation. 7 safety layers cover tool filtering, permission decisions, hooks, and sandboxing. In v2.1.88, the session bypass flag and computer-use app allowlist are not stored in the transcript, so a session resumed in a new process starts without them; these temporary states are separate from persistent permission settings.
[!WARNING] Bounded analysis: The legacy parser limits per-subcommand analysis to avoid blocking the event loop. If that path produces more than 50 subcommands, it returns
ask. This fallback requests an approval decision; it does not automatically allow the command.
More details: authorization pipeline, auto-mode classifier, CVEs
Authorization pipeline: Pre-filtering (strip denied tools) → PreToolUse hooks → Deny-first rule evaluation → Permission handler (4 branches: coordinator, swarm worker, speculative classifier, interactive)
Auto-mode classifier (yoloClassifier.ts): Separate LLM call with internal/external permission templates. Two-stage: fast-filter + chain-of-thought.
Pre-trust execution window: 2 patched CVEs share this root cause -- in earlier releases, MCP server connections and settings environment variables took effect during initialization before the user accepted the trust dialog, creating a structurally privileged attack window outside the deny-first pipeline. In the analyzed v2.1.88 snapshot, the standard interactive startup path requires trust acceptance before hooks run, project MCP servers connect, or project settings environment variables beyond a safe allowlist apply.
Extensibility
Four extension mechanisms: Hooks, Skills, Plugins, and MCP. Their context cost depends on the instructions, definitions, and results exposed to the model. They act at three points in the loop: assemble() (what the model sees), model() (which tools it can call), and execute() (whether and how actions run).
Tool pool assembly (5-step): Base enumeration (up to 54 tools) → Mode filtering → Deny pre-filtering → MCP integration → Deduplication
27 hook events across 5 categories with 4 execution types (shell, LLM-evaluated, webhook, subagent verifier)
Plugin manifest accepts 10 component types: commands, agents, skills, hooks, MCP servers, LSP servers, output styles, channels, settings, user config
Skills: SKILL.md with 15+ YAML frontmatter fields. Key difference -- SkillTool injects into current context; AgentTool spawns isolated context.
Context and Memory
9 ordered sources build the context window. CLAUDE.md instructions enter as user context. Prompt instructions guide model behavior; permission checks and sandboxes enforce access limits outside the model. Memory in this version is file-based, so its contents can be inspected, edited, and versioned.
4-level CLAUDE.md hierarchy: Managed (/etc/) → User (~/.claude/) → Project (CLAUDE.md, .claude/rules/) → Local (CLAUDE.local.md, gitignored)
Five context-management stages, each with its own conditions: Budget reduction → Snip → Microcompact → Context Collapse (a non-destructive read-time projection) → Auto-Compact (model-generated summarization).
Memory retrieval: LLM-based scan of memory-file headers, selects up to 5 relevant files. No embeddings, no vector similarity.
Subagent Delegation
6 built-in types (Explore, Plan, General-purpose, Guide, Verification, Statusline) + custom agents via .claude/agents/*.md. Sidechain transcripts keep worker histories separate, and concise returns can limit what enters the parent's context. Worktree, remote, and in-process modes provide different execution arrangements; context separation alone does not determine file access or authority. Coordination uses POSIX flock().
SkillTool vs AgentTool: SkillTool adds guidance to the current context; AgentTool delegates work to another context. Token cost depends on the work performed and the results returned.
Permission override: Subagent permissionMode applies UNLESS parent is in bypassPermissions/acceptEdits/auto (explicit user decisions always take precedence).
Custom agents: YAML frontmatter supports tools, disallowedTools, model, effort, permissionMode, mcpServers, hooks, maxTurns, skills, memory scope, background flag, isolation mode.
Session Persistence
Three channels preserve session history: append-only JSONL transcripts, global prompt history, and subagent sidechains. In v2.1.88, the session bypass flag and computer-use app allowlist are not stored in the transcript: a new process started with --resume begins without them, while resuming or forking inside a running session keeps the grants already given. Persistent policy, session mode, and temporary grants have different lifetimes.
Chain patching: Compact boundaries record headUuid/anchorUuid/tailUuid. The session loader patches the message chain at read time. Nothing is destructively edited on disk.
Checkpoints: File-history checkpoints for --rewind-files, stored at ~/.claude/file-history//.
New Signals in the Agent Design Space
Claude Code gives us a concrete starting point: a model chooses actions inside a system that manages tools, context, permissions, and recovery. More recent work connects those choices across a longer task: how work is organized, what survives interruption, which experience is reused, and what evidence is needed to move on.
| Design Implication | What it means for agent builders | Representative signals |
|---|---|---|
| Graph Engineering makes relationships explicit | Express task dependencies, agent responsibilities, and runtime state separately. Graph nodes can still contain agents that choose their own actions. | Graph Engineering survey, Agent Graph |
| Long tasks need explicit runtime state | Track goals, sessions, workers, checkpoints, and result delivery explicitly. Recovery needs a clear owner for each unfinished action. | Cursor cloud agents, Google Managed Agents, Microsoft Agent 365, Databricks Omnigent |
| Context and memory need lifecycle rules | Manage the working context and reusable memory according to their different lifetimes. Keep the source, scope, update rules, and retrieval cost of remembered experience visible. | LangChain Context Hub, AWS AgentCore, Anthropic managed-agent memory |
| Access limits need execution boundaries | Permissions, network reachability, filesystem access, credential custody, tenant isolation, and sandboxing belong in the architecture. | Codex Windows sandbox, Running Codex safely, Anthropic self-hosted sandboxes |
| Tools and skills are a supply chain | Manage the sources and versions of tools, skills, and plugins. Define installation policy, update policy, server identity, and action approvals separately. | NSA MCP security, GitHub MCP allowlists, A2A milestone |
| Humans need control over the whole run | Support goals, plans, approvals, interrupts, reviewable diffs, escalation, and explicit ownership when several agents can write. | Codex from anywhere, Copilot cloud agent, Cognition multi-agents |
| Control decisions need their own evaluation | Evaluate when an agent should continue, verify, ask for help, or stop, as well as the worker's ability to execute a step. | LoopArena |
| Observability must close the improvement loop | Turn traces into testable failure hypotheses. Check proposed changes on relevant tasks, protect prior successes with regression tests, and confirm gains on fresh cases. | LangSmith Engine, OpenAI agent improvement loop, AWS AgentCore Evaluations |
The Graph Engineering survey organizes this discussion around task graphs, agent graphs, and runtime state graphs. This is the authors' proposed framework, with earlier graph-based systems as precedents. It connects naturally to the guide's decisions about reasoning, delegation, and persistence.
Codex local memories carry selected experience between sessions when enabled. Working-context management is a separate choice: v0.153.4 retains summarizing compaction, while its experimental context-management mode uses notes, searchable history, and fresh context windows. The latter changes how a long task continues across windows; it is distinct from background experience extraction across sessions.
The experimental switch was released in Codex CLI 0.153.0 and is off by default, with account and backend restrictions. A September 6 source change adds a model-support check and marks the bundled GPT-6-Astra model as supported. The source notes distinguish this later source revision from v0.153.4. This is a change in the context-management protocol and its model integration; the public evidence does not establish a new form of permanent memory inside the model.
Graphs can support review of completed runs. Agent communication needs rules for message delivery. Memory needs rules for recall and correction. Changes to models, prompts, or skills need explicit acceptance tests. The September 15 source notes give the sources, dates, and versions.
Recent releases and studies add further examples. In Claude Code, plugins can now run code inside the agent's own process and approve tool calls, so the order in which organization policy, user extensions, and approval prompts apply becomes part of the permission design. Claude Code also separates stopping a turn from stopping background work. Retries and rollbacks need rules that keep an action from running twice, and a way to undo side effects, including changes made on remote systems. Some measured differences between harnesses are no larger than the variation between repeated runs of the same configuration, and a fixed LLM judge can make errors that change with the agent version it evaluates. The October 6 source notes give the sources, dates, and versions.
The design guide develops these choices. Source notes record the reviewed versions, publication dates, and limits of the evidence.
Build Your Own AI Agent: A Design Guide
A guide to the design decisions behind an agent, drawing on Claude Code's architecture and the wider systems discussed here.
Every production agent must navigate these decisions:
| Decision | The Question | Key Insight |
|---|---|---|
| Reasoning placement | How much logic in the model vs. harness? | Choose which dependencies and checks belong in code, and which decisions remain with the model. |
| Safety posture | How do you prevent harmful actions? | Give each control a clear scope and define what happens when a check cannot decide. |
| Context management | What does the model see? | Separate the current conversation budget from the lifecycle of reusable experience. |
| Extensibility | How do extensions plug in? | Treat discovery, installation, updates, and execution authority as separate choices. |
| Subagent architecture | Shared or isolated context? | Define ownership, context boundaries, and the evidence each worker returns. |
| Session persistence | What carries over? | Restore task state under current policy, with explicit lifetimes for temporary grants. |
Read the full guide: docs/build-your-own-agent.md
Cross-System Comparison: Claude Code vs OpenClaw vs Hermes-Agent
The same recurring design questions admit different architectural answers when the deployment context changes. The table below contrasts Claude Code v2.1.88 with two notable peers — OpenClaw, a local-first multi-channel personal-assistant gateway, and NousResearch/hermes-agent, a self-improving multi-deployment agent — across the six design dimensions Section 10 of the paper uses for the OpenClaw comparison. Cells are source-grounded; this is not a feature scoreboard.
| Design Dimension | Claude Code (v2.1.88)  |
OpenClaw  |
Hermes-Agent  |
|---|---|---|---|
| System scope & deployment | Per-user CLI / SDK / IDE interface for coding; one queryLoop async generator across entry points. |
Local-first WebSocket gateway (default port 18789, loopback-bound by default; other binds available); routes ~23 messaging channels to an embedded agent runtime; companion apps for macOS, iOS, Android. | Three entry points: hermes (interactive CLI), hermes-agent (programmatic runtime), hermes-acp (ACP server); gateway adapters route messages to per-session AIAgent instances cached LRU-style (max 128, 1 h idle TTL); also runs as MCP server via hermes mcp serve. |
| Trust model & security | Deny-first per-action evaluation; 7 permission modes; LLM-based auto-mode classifier (yoloClassifier / sideQuery); session-scoped permission state (session bypass flag, app allowlist state) is not stored in the transcript, so a session resumed in a new process starts without it. |
Single trusted operator per gateway; DM pairing codes, sender allowlists, gateway authentication; per-agent allow / deny tool policy; opt-in sandboxing via Docker / SSH / OpenShell, off by default; non-main mode sandboxes only non-main sessions; hostile multi-tenant isolation explicitly not supported. |
Dangerous-command pattern detection with per-session approval state; CLI interactive prompts and gateway async prompts; auxiliary-LLM smart approval auto-approves low-risk commands; permanent allowlist persisted in config.yaml; subagent worker threads default to auto-deny dangerous commands (opt-in subagent_auto_approve for batch / cron runs). |
| Agent runtime & tools | Single queryLoop async generator with streamed event yields; environment- and feature-gated tool registry; before-API compaction (Snip, Microcompact, Context Collapse, Auto-Compact) runs conditionally, with Auto-Compact first attempting session-memory compaction. |
Embedded agent runtime inside the gateway's RPC dispatch (the agent RPC validates parameters, accepts immediately, runs asynchronously, and streams lifecycle / stream events back over the gateway protocol); per-session queue serialization with an optional global lane. |
While-loop with explicit per-turn iteration budget and grace-call slot; per-turn checkpoint dedup; gateway step_callback hook fires on each iteration; auxiliary-model context compression summarizes middle turns while protecting head and tail. |
| Extension architecture | Four extension mechanisms: hooks, skills, plugins, and MCP; context cost depends on exposed content; 27 hook events; 10 plugin component types. | Manifest-first plugin system with 12 documented capability categories; central registry exposes tools, channels, provider setup, hooks, HTTP routes, CLI commands, services; separate skills layer with multiple sources (workspace highest precedence) plus the ClawHub public registry; openclaw mcp provides both an MCP server interface and an outbound client registry for other MCP servers. |
12 bundled plugins under plugins/ (context_engine, disk-cleanup, example-dashboard, google_meet, hermes-achievements, image_gen, kanban, memory, observability, platforms, spotify, strike-freedom-cockpit); MCP server (mcp_serve.py) exposes 10 tools; ACP adapter (acp_adapter/) exposes Hermes as an ACP server. |
| Memory & context | 4-level CLAUDE.md hierarchy; before-API compaction (Snip, Microcompact, Context Collapse, Auto-Compact); LLM-based selection from file-based Markdown memory files. | Workspace bootstrap files (AGENTS.md, SOUL.md, TOOLS.md, IDENTITY.md, USER.md) plus conditional BOOTSTRAP.md / HEARTBEAT.md / MEMORY.md; separate memory system (MEMORY.md, daily notes under memory/YYYY-MM-DD.md, optional DREAMS.md); hybrid vector + keyword search when an embedding provider is configured; experimental dreaming for long-term promotion; pluggable compaction providers. |
SQLite state store with FTS5 full-text search and WAL-mode concurrent readers; sessions linked by parent_session_id chains for compression-triggered splits; 8 swappable memory backends under plugins/memory/ (byterover, hindsight, holographic, honcho, mem0, openviking, retaindb, supermemory); auxiliary-LLM compression as a separate context-management layer. |
| Multi-agent architecture | Sub-agent delegation via sidechain transcripts; 6 built-in agent definitions (availability conditional on build / mode) plus custom; a single summary message returns to parent (in-process / viewable transcript cases preserve more internal detail); agent-isolation settings include worktree and remote, with an in-process teammate backend in the swarm path. |
Two layers. (1) Multi-agent routing: per-channel isolated agents with their own workspace, auth profiles, session store, and model configuration, dispatched via deterministic binding rules. (2) Sub-agent delegation: maxSpawnDepth range 1–5, default 1, recommended 2; tool policy varies by depth; project vision (VISION.md) rejects agent-hierarchy frameworks as the default. |
delegate_task tool spawns child AIAgent instances in a ThreadPoolExecutor (parent blocks until children complete); each child has fresh conversation history, its own task_id, and a restricted toolset (DELEGATE_BLOCKED_TOOLS strips delegate_task, clarify, memory, send_message, execute_code); default depth MAX_DEPTH = 1 (configurable up to cap 3); default 3 concurrent children. |
What this contrast reveals. Three observations follow from the table. First, deployment context drives the rest of the design: a per-user coding CLI converges on per-action approval and a single execution loop, a multi-channel gateway converges on perimeter trust and channel-bound agents, and a multi-deployment messaging-and-cloud agent converges on opt-in container/cloud isolation, an LLM-based smart approval, and a swappable-backend memory layer. Second, the extension layer is where each system most clearly differentiates: Claude Code provides four distinct extension mechanisms, OpenClaw treats extension as registry-managed capabilities at the gateway, and Hermes-Agent ships bundled plugins plus dual MCP server / ACP server interfaces other agents can connect to. Third, memory architectures sit on a spectrum: file-based and inspectable Markdown (Claude Code), file-based plus optional vector + experimental dreaming (OpenClaw), or full-text indexed (FTS5) plus eight swappable plugin backends including dedicated vector / RAG providers (Hermes-Agent). The table is best read not as a scoreboard but as three different fixed points in the same design space.
Find Resources by Design Question
The sections above give Claude Code's own answer to each design question. The catalogs below are organized by resource type instead. This table joins the two, so you can start from a question rather than from a resource type.
For shifts that cut across every axis rather than sitting on one, see New Signals in the Agent Design Space.
Community Projects & Research
A curated map of the repos, reimplementations, and academic papers surrounding Claude Code's architecture.
Official Anthropic Resources
Primary sources referenced throughout the paper — Anthropic's own engineering and research publications, plus product documentation.
Research & Engineering Blogs
| Article | Topic |
|---|---|
| Building Effective Agents | Foundational: simple composable patterns over heavy frameworks. |
| Effective Context Engineering for AI Agents | Context curation and token-budget management. |
| The New Rules of Context Engineering for Claude 5 Generation Models | Anthropic removed over 80% of Claude Code's system prompt for newer models with no measurable loss on its coding evals. The post recommends replacing blanket rules with model judgment, tool-use examples with clearer interfaces, and up-front context loading with skills and tool definitions loaded on demand. Its broader point is that a harness should be reviewed and pruned as models change, rather than only accumulating instructions. |
| Reducing cost and improving performance with Claude Platform, Automating eval design and hillclimbing with Claude | September 8: Anthropic describes prompt-audit, hillclimb, and cost-optimize workflows in the Claude API skill. Given an evaluation, hillclimb uses training cases to guide changes and a held-out test set to assess the final configuration. A September 28 follow-up adds build-eval, which builds an evaluation in the codebase and checks grader consistency and infrastructure failures. Before hillclimbing, the skill checks that evaluation noise is smaller than the smallest gain worth acting on, and it recommends against merging when the final gain is within that noise. The examples are Anthropic's own and have not been independently replicated. |
| A Harness for Every Task: Dynamic Workflows in Claude Code | Anthropic's design account of programmatic subagent orchestration. It names six reusable patterns — classify-and-act, fan-out-and-synthesize, adversarial verification, generate-and-filter, tournament, and loop-until-done — and moves coordination state from one model context into a script that can run and re-run many isolated agents. |
| Prompt Caching with Claude | Cache reads at 10% cost, writes at 125%; 5-min default TTL. The platform feature that makes Claude Code's cache-aware compaction architecturally meaningful. |
| Harness Design for Long-Running Application Development | Harness architecture for autonomous full-stack dev; multi-agent patterns. |
| Claude Code Auto Mode: A Safer Way to Skip Permissions | ML-classifier approval automation; source of the 93% approval-rate finding. |
| Auto Mode Is Now the Default in Claude Code | Auto mode becomes the default on Pro, Max, and Team plans (announced August 7, 2026, with rollout completed August 14), while Enterprise and the API surfaces (the Claude API, Bedrock, Vertex, and Foundry) stay opt-in. A 1,053-tester study is the argument: manual review caught 13.6% of injected dangerous commands against 89% for the classifier, and the harmful-action rate fell from 6.3% of manually approved sessions to 2.4%. The successor milestone to the auto-mode engineering post above, now a default rather than a setting. |
| Beyond Permission Prompts: Making Claude Code More Secure and Autonomous | Sandbox-based security; 84% reduction in permission prompts. |
| How We Contain Claude Across Products | Containment across claude.ai, Claude Code, and Cowork (May 2026); Claude Code's human-in-the-loop sandbox, approval fatigue, and capping the blast radius. |
| Measuring AI Agent Autonomy in Practice | Longitudinal usage: auto-approve rates grow from ~20% to 40%+ with experience. |
| Agentic Coding and Persistent Returns to Expertise | Anthropic's first quantitative account of how the work actually splits: humans make roughly 70% of planning decisions but only 20% of execution decisions, and a single prompt triggers about 10 Claude actions on average, with some stretches running past 100 actions between human touchpoints. An empirical anchor for the paper's claims about human control surfaces and supervision cost. |
| Our Framework for Developing Safe and Trustworthy Agents | Governance framework for responsible agent deployment. |
| When AI Builds Itself | Anthropic Institute on recursive self-improvement: AI accelerating AI development, the direction-setting and research-taste gaps, and governance scenarios. |
| Scaling Managed Agents: Decoupling the Brain from the Hands | Hosted-service architecture separating reasoning, execution, and session. |
| An Update on Recent Claude Code Quality Reports | Postmortem on three bugs behind perceived quality drops: a reasoning-effort default, a cache optimization bug, and a system-prompt change. |
| Introducing Claude Opus 4.8 | May 2026 model update: sharper judgment and honesty (~4x fewer unremarked code flaws), longer autonomous runs; introduces dynamic workflows in research preview. |
| Claude Fable 5 and Claude Mythos 5 | June 2026 Mythos-class tier sitting above Opus; Fable 5 is the general-use configuration (risky queries fall back to Opus 4.8), with state-of-the-art software-engineering and agentic-coding performance. Access was suspended globally on June 12, 2026 (see next row). |
| Statement on Suspending Access to Fable 5 and Mythos 5 | Anthropic's statement on suspending Fable 5 and Mythos 5. A US export-control directive (June 12, 2026) restricted access for foreign nationals, but Anthropic disabled both models for all users worldwide, just days after launch. A rare case of regulation forcing a deployed frontier model offline, and a concrete example of the compliance and safety pressures that agent systems face in deployment. |
Product Documentation
| Document | Topic |
|---|---|
| How Claude Code Works | Official overview of the agent loop, tools, and terminal automation. |
| Permissions | Tiered permission system, modes, granular rules. |
| Hooks | 27-event hook reference, execution models, lifecycle events. |
| Mods, Manage mods for your organization | First listed in v2.1.287 (October 1, 2026). Mods are JavaScript or TypeScript functions shipped in plugins. They run inside the Claude Code process without a sandbox and can observe, rewrite, or answer tool calls, prompts, permission checks, and interface events. A mod can approve a tool call before the permission prompt appears, but it cannot change what the prompt shows. Where managed settings or a Team or Enterprise login apply, a built-in guard loads first: deny rules (unless the administrator sets allowModsToOverrideDenyRules) and managed PreToolUse hooks take precedence over a user's mod, and the guard refuses users' mods if it cannot read managed settings. A user's mod can still approve a call that an ask rule would prompt for, and in auto mode that call skips the classifier. Deny rules do not cover a mod's own file and process calls, and in an interactive session in an untrusted directory no mod loads before the trust prompt is answered. |
| Memory | CLAUDE.md hierarchy, auto memory, learned preferences. |
| Programmatic tool calling | The first beta was released in November 2025. Current documentation describes Python code that pauses for client tool results, then resumes in the same container. The client returns the container ID with the results. The model receives the final program output, so the program can process raw tool data first. |
| Sub-agents | Specialized isolated assistants, custom prompts, tool access. |
| Orchestrate Subagents at Scale with Dynamic Workflows | Claude writes a JavaScript orchestration script; a background runtime fans out to up to 16 concurrent and 1,000 total subagents, with intermediate state held in script variables outside the context window (v2.1.154+). The permission design is the part worth noting: the launch prompt follows your permission mode, but the subagents a workflow spawns always run in acceptEdits and inherit the session tool allowlist regardless of that mode, so file edits are auto-approved inside a run. |
| Configure Auto Mode | The fullest official account of the auto-mode classifier as a policy engine: a four-tier precedence (hard_deny over soft_deny over allow over explicit user intent), rules written as natural-language prose rather than regexes, and one deliberate exclusion. The classifier reads CLAUDE.md but never the shared .claude/settings.json, so a checked-in repo config cannot grant itself permissions. |
| Orchestrate Teams of Claude Code Sessions | Agent teams as a primitive distinct from subagents: teammates hold separate contexts, message each other through mailboxes, and share a file-locked task list with dependencies and self-claiming. The trust boundary is explicit: a teammate cannot approve a permission prompt on the user's behalf, and a denied action cannot be handed to another teammate to get around it. |
| What's New in Claude Opus 4.8 | Mid-conversation system messages (prompt-cache-preserving), lower cacheable-prompt minimum, fewer compactions and better compaction recovery. |
| What's New in Claude Sonnet 5 | The model takes back two dials the harness used to hold: manual extended thinking is gone (thinking: {budget_tokens: N} now returns 400) and non-default temperature/top_p/top_k also return 400. A new tokenizer yields roughly 30% more tokens for the same text, so the usable context budget shifts with the model. |
| Claude Code CHANGELOG, v2.1.299 | Release notes. Dynamic workflows and Opus 4.8 land in v2.1.154. Across v2.1.178 to v2.1.207 (June to July 2026): subagents run in the background by default with agent_needs_input/agent_completed hooks, and an agent's message is still never treated as the user's approval; the default permission mode is renamed to Manual; a Tool(param:value) rule syntax arrives (for example Agent(model:opus)); auto mode stops reading a repo's .claude/settings.local.json; and sandbox.credentials blocks sandboxed commands from reading credential files and secret environment variables. Through v2.1.215 (July 2026): v2.1.212 adds per-session caps on WebSearch calls and on subagent spawns (default 200 each, tunable by environment variable), moves MCP tool calls running past two minutes to the background automatically, turns /fork into a background session with the in-session behavior split out as /subtask, deprecates the Task tool's mode parameter so subagents inherit the parent session's permission mode, and stops plan mode auto-running file-modifying Bash commands without a prompt. v2.1.214 adds the EndConversation tool, requires permission for docker commands carrying daemon-redirect flags, and fixes a permission-scoping bug where a single-segment rule like Edit(src/**) auto-approved writes to a nested src/ anywhere in the tree instead of only /src. The v2.1.221–v2.1.224 cluster (August 2026) adds masked credential files, cross-machine SendMessage/ListAgents, and claude self-hosted-runner; routes inbound cross-session messages through permission review; and closes worktree, dynamic-import, policy-bypass, hidden-command, and trailing-slash denyRead escapes. Credential masking also expands to structured extraction, JWT claims, and AWS request re-signing, while sandbox violations are returned to the model as recovery feedback. The v2.1.225 to v2.1.233 run (August 2026) makes auto mode the default on Pro, Max, and Team plans, turns subagent forking on by default so a fork subagent inherits the parent context and prompt cache, matures cross-session messaging with @name mentions and inbound accept and hold controls, removes the todo and task-tracking tools by default on newer models (CLAUDE_CODE_ENABLE_TODO_TOOLS=1 restores them), and closes a Windows NT device-prefix path-validation bypass that had leaked NTLM credentials. September 8–14 releases v2.1.265–271 also update context and authority. Stable prompts and tool definitions are recorded by default. After compaction, Claude receives the current Git status. Auto mode with sandboxing supports per-command allowed_domains for Bash, PowerShell, and Monitor. Restrictions remain when the specified managed MCP, hook, or channel settings cannot be read. In v2.1.271, --accept-command binds marketplace command approval to the displayed command, plugin, and catalog. See the dated source notes for versions and conditions. Releases v2.1.275 to v2.1.290 (September 17 to October 5, 2026) read AGENTS.md when no CLAUDE.md exists, neutralize invisible characters and markup-imitating tags in recalled memory, stop project settings from widening an admin-required sandbox, no longer drop a whole managed settings block when one nested value is invalid, and start interactive sessions with no configured permission mode in auto mode. The send-now key (ctrl+enter, which sends queued messages while Claude is still working) now moves running tools to the background instead of cancelling the turn, and in VS Code, Stop and Escape end only the current turn while background agents keep running and can be stopped one by one from the agent map. See the October 6 source notes for versions and conditions. Releases v2.1.291 to v2.1.299 (October 6 to 14, 2026) make a guard hook that fails block the action: onFailure: "block" for command and HTTP hooks, and refusal by default when a plugin hook cannot receive an action or return its answer. Plan mode no longer runs a write that a hook allowed, UserPromptSubmit hooks run before a skill or slash command expands, and an MCP allow rule reaches only the server it names. Idle compaction compacts a 200K+ token conversation after about 54 minutes idle, before its one-hour prompt cache expires, and subagents get their own autoCompactWindow. Resume no longer re-runs a finished turn or runs an approved tool call twice. See the October 14 source notes. |
Architecture Analysis
Deep dives into Claude Code's internal design.
| Repository | Description |
|---|---|
ComeOnOliver/claude-code-analysis  |
Comprehensive reverse-engineering: source tree structure, module boundaries, tool inventories, and architectural patterns. |
alejandrobalderas/claude-code-from-source  |
18-chapter technical book (~400 pages). All original pseudocode, no proprietary source. |
liuup/claude-code-analysis  |
Chinese-language deep-dive — startup flow, query main loop, MCP integration, multi-agent architecture. |
sanbuphy/claude-code-source-code  |
Quadrilingual analysis (EN/JA/KO/ZH) — multi-domain reports covering telemetry, codenames, KAIROS, unreleased tools. |
cablate/claude-code-research  |
Independent research on internals, Agent SDK, and related tooling. |
Yuyz0112/claude-code-reverse  |
Visualize Claude Code's LLM interactions — log parser and visual tool to trace prompts, tool calls, and compaction. |
Piebald-AI/claude-code-system-prompts  |
Version-tracked corpus of Claude Code's internal prompts, extracted from each release's published package: the main system prompt, builtin tool descriptions, sub-agent prompts (Plan/Explore/Task), slash-command prompts, and system-reminder injections, with a changelog spanning every tracked release since v2.0.14. Updated within minutes of each release. |
AgiFlow/claude-code-prompt-analysis  |
API request and response logs captured across five conversation sessions. Empirical methodology with reproducible data rather than static code reading. |
Open-Source Reimplementations
Clean-room rewrites and buildable research forks.
| Repository | Description |
|---|---|
chauncygu/collection-claude-code-source-code  |
Meta-collection of community Claude Code source artifacts -- includes claw-code (Rust port), nano-claude-code (Python), and the extracted original source archive. |
777genius/claude-code-working  |
Working reverse-engineered CLI. Runnable with Bun, 450+ chunk files, 31 feature flags polyfilled. |
T-Lab-CUHKSZ/claude-code  |
CUHK-Shenzhen buildable research fork — reconstructed build system from raw TypeScript snapshot. |
ruvnet/open-claude-code  |
Nightly auto-decompile rebuild — 903+ tests, 25 tools, 4 MCP transports, 6 permission modes. |
Enderfga/openclaw-claude-code  |
OpenClaw plugin — unified ISession interface for Claude/Codex/Gemini/Cursor. Multi-agent council. |
memaxo/claude_code_re  |
Reverse engineering from minified bundles — deobfuscation of the publicly distributed cli.js file. |
agentforce314/clawcodex  |
Python rebuild with multi-provider LLM support. |
ultraworkers/claw-code  |
Clean-room Rust reimplementation that compresses a roughly 512K-line TypeScript codebase into about 20K lines of Rust, which makes it a useful read on what is essential to the harness and what is incidental. |
Claude Code Guides & Learning
Tutorials and hands-on learning paths for Claude Code itself.
| Repository | Description |
|---|---|
shareAI-lab/learn-claude-code  |
"Bash is all you need" — 19-chapter 0-to-1 course with runnable Python agents, web platform. ZH/EN/JA. |
FlorianBruniaux/claude-code-ultimate-guide  |
Beginner-to-power-user guide with production-ready templates, agentic workflow guides, and cheatsheets. |
affaan-m/everything-claude-code  |
Agent harness optimization — skills, instincts, memory, security, and research-first development. |
hesreallyhim/awesome-claude-code  |
Curated list of skills, hooks, slash-commands, agent orchestrators, and plugins. |
nblintao/awesome-claude-code-postleak-insights  |
Curated post-leak findings, including the internal codenames (BUDDY, KAIROS, ULTRAPLAN), Undercover Mode, and AutoDream memory consolidation. |
rohitg00/awesome-claude-code-toolkit  |
Bundled toolkit of agents, skills, commands, plugins, hooks, rules, templates, and MCP configurations. |
General Harness Engineering Design Space Resources
External resources that complement this paper's design-space analysis — concept essays, curricula, and code that illuminate the harness layer as an engineering practice.
| Repository | Description |
|---|---|
deusyu/harness-engineering  |
Learning archive — original concept essays, independent thinking pieces, and curated translations of harness-engineering writing; from concept to independent practice. |
walkinglabs/learn-harness-engineering  |
Project-based English course with PDF coursebooks, syllabus, and capstone, organized around five harness subsystems: instructions, state, verification, scope, and session lifecycle. |
china-qijizhifeng/agentic-harness-engineering  |
Observability system that auto-evolves a coding agent's harness — a meta-agent reads execution traces and rewrites system prompts, tools, middleware, skills, sub-agents, and memory. |
ZhangHanDong/harness-engineering-from-cc-to-ai-coding  |
The "Horse Book" (《马书》) — Chinese mdBook framing Claude Code v2.1.88 as a Harness Engineering case study; covers architecture, prompt engineering, context management, prompt cache, security, and lessons for builders. |
alchaincyf/loop-engineering-orange-book  |
花叔 (HuaShu)'s plain-language guide to loop engineering, in both Chinese and English. It puts the loop one layer above the harness, walks through what a loop does and the pieces it needs, and credits Steinberger, Osmani, and Anthropic's Claude Code team. |
stanford-iris-lab/meta-harness  |
Reference implementation for the Meta-Harness paper. Holds the model fixed and searches the harness itself (memory, retrieval, context construction, prompts, tool selection) through a propose, score, and Pareto-frontier loop. Turns the harness from something you design by hand into something you can optimize. |
Blog Posts & Technical Articles
| Article | What Makes It Valuable |
|---|---|
| Marco Kotrotsos — "Claude Code Internals" (15-part series) | Most systematic pre-leak analysis. Architecture, agent loop, permissions, sub-agents, MCP, telemetry. |
| Alex Kim — "The Claude Code Source Leak" | Anti-distillation mechanisms, frustration detection, Undercover Mode, ~250K wasted API calls/day. |
| Haseeb Qureshi — Cross-agent architecture comparison | Claude Code vs Codex vs Cline vs OpenCode — architecture-level comparison. |
| George Sung — "Tracing Claude Code's LLM Traffic" | Complete system prompts and full API logs. Discovered dual-model usage (Opus + Haiku). |
| Agiflow — "Reverse Engineering Prompt Augmentation" | 5 prompt augmentation mechanisms backed by actual network traces. |
| Engineer's Codex — "Diving into the Source Code Leak" | Modular system prompt, ~40 tools, large query/tool subsystem, anti-distillation. |
| MindStudio — "Three-Layer Memory Architecture" | In-context memory, MEMORY.md pointer index, CLAUDE.md static config. Best single resource on memory. |
| WaveSpeed — "Claude Code Architecture: Leaked Source Deep Dive" | 512K-line TS source deep dive; context compression and anti-distillation. |
| Zain Hasan — "Inside Claude Code: An Architecture Deep Dive" | Layered architecture, 5 entry modes, multi-agent walkthrough. |
| Addy Osmani — "Agent Harness Engineering" | Frames harness engineering as a discipline with named primitives (filesystem/git state, sandboxes, AGENTS.md memory, compaction, planning loops, hooks); cites Claude Code as the canonical mature example. |
| Addy Osmani — "Loop Engineering" | A practitioner account of building the loop that repeatedly prompts an agent: automations, worktrees, skills, connectors, subagents, and persistent progress records. Useful alongside the paper's analysis of the surrounding harness. |
| Armin Ronacher — "The Coming Loop" | Splits the agent loop (tool calls inside one run) from the harness loop (a system that keeps re-prompting the agent to run again). Ronacher is skeptical: loops work well for porting code, tuning performance, and scanning for security bugs, but the code they leave behind tends to be more defensive and harder to maintain, so people still have to read it and decide what to keep. |
| LangChain — "The Art of Loop Engineering" | Describes four loops built around an agent: the agent loop, a verification loop that scores the output and retries, an event-driven loop that starts agents on outside triggers, and a hill-climbing loop that reads production traces to improve the harness itself. The point: most of the value comes from these loops, not the model on its own. |
| Andrej Karpathy — "Sequoia Ascent 2026" | Argues for "agentic engineering": humans orchestrate and verify rather than write code. "LLMs and reinforcement learning automate what you can verify"; "you can outsource your thinking, but you can't outsource your understanding." |
| Lilian Weng — "Harness Engineering for Self-Improvement" | Defines the harness as "the system surrounding a base model that orchestrates execution and decides how the model thinks and plans, calls tools and acts, perceives and manages context, stores artifacts, and evaluates results," then argues that the near-term path to recursive self-improvement does not start with a model rewriting its own weights: it starts with coding agents evolving the harness itself. Covers design patterns, harness optimization, evolutionary search, and joint optimization with weights. |
| Armin Ronacher — "Better Models: Worse Tools" | The clearest evidence yet that the harness shapes the model, not only the reverse. Opus 4.8 and Sonnet 5 invent fields like requireUnique and oldText2 that no schema defines, while the surrounding payload stays byte-correct. Ronacher's reading: the models were trained in Claude Code's forgiving harness, which quietly repairs malformed calls by dropping unknown keys and accepting parameter aliases, so slightly-wrong calls still got rewarded. Tool schemas are not a neutral abstraction. |
| Addy Osmani — "Agentic Autonomy Levels" | Separates two axes that usually get collapsed: agency (how independently one agent runs) and orchestration (how several agents coordinate). Proposes a pre-execution contract covering goal, scope, non-goals, tools and permissions, stop conditions, evidence requirements, escalation path, and budget, offering a structured alternative to Claude Code's in-the-moment approval prompts. |
| Geoffrey Litt — "Understanding is the new bottleneck" | As agents get better at verifying their own work, the scarce resource stops being correctness checking and becomes human comprehension. Litt argues the interface should build understanding rather than present diffs, proposing literate diffs with embedded explanation, interactive micro-worlds for stepping through a change, and shared spaces where a team forms a common mental model. A control-surface argument about what the harness owes the human, not what it lets the agent do. |
| Haseeb Qureshi — "Inside the Claude Code source" | Key module analysis: the React/Ink UI, four compaction strategies, and the dynamic prompt boundary system. |
| Han HELOIR YAN — "Nobody Analyzed Its Architecture" | "The moat is the harness, not the model." An early statement of the thesis this paper develops in full. |
| Marco Kotrotsos — "Part 8: The Permission System" | The permission-focused installment of the Internals series; the closest pre-leak reconstruction of the approval path. |
| Vincent Qiao — "Permissions System Deep Dive" | Settings-level walkthrough of how permission rules are actually written and resolved in practice. |
| ClaudeCodeCamp — "How Prompt Caching Actually Works" | The clearest practical account of cache behavior in Claude Code, which is the constraint most compaction designs have to work around. |
| Gigi Sayfan — "MCP Unleashed" | Deep dive on the MCP integration path: transports, server lifecycle, and how external tools enter the tool surface. |
| DEV Community — "Architecture via Rust Rewrite" | Reads the architecture through a Rust reimplementation, laying out the tool set in a three-layer structure. |
| Reid Barber — "Reverse Engineering Claude Code" | One of the earliest analyses (mid-2025), covering the REPL architecture and the original tool suite. |
| Kir Shatrov — "Reverse Engineering Claude Code" | Used mitmproxy to intercept API traffic and reported a single measured experiment end to end, including LLM time and cost. |
| Sabrina Ramonov — "Reverse-Engineering Using Sub Agents" | Methodologically interesting: builds custom sub-agents (File Splitter, Structure Analyzer) and uses them to reverse-engineer the minified bundle. |
| Simon Willison — "Auto mode is now the default" | An independent reading of Anthropic's auto-mode default announcement. Willison's caution is that the headline comparison (89% of dangerous commands caught by the classifier against 13.6% for tired human reviewers) blends accidental damage with deliberate prompt injection, which a classifier cannot reliably stop, so the durable fix is withholding sensitive data and high-risk tools rather than trusting automated approval. The skeptic's counterweight to the vendor announcement in the official-resources list above. |
| Birgitta Böckeler — "TDD inside the agent loop: theater or actual value?" | Runs the experiment instead of asserting the practice: agent-driven TDD cost roughly three to eight times more tokens without producing better designs than test-after runs, because an agent does not get the human psychological benefit that makes TDD work. Recommends judging agents by outcome measures such as mutation testing and static analysis rather than mandating a process the loop cannot feel. |
| "Why does Opus 5 feel worse to work with?" | Locates a harness-relevant failure in benchmark incentives: optimizing for benchmarks rewards agents that make a bold, usually-correct guess under ambiguity instead of asking a clarifying question, the opposite of what consequential, high-ambiguity work needs. A widely-shared argument about the autonomy-versus-checking-in dial in agent loop design. |
| Florian Herrengt — "AI is removing the middle class of software engineering?" | AI lifted the speed limit on writing code but not on understanding it, so the review burden becomes the binding constraint and shifts onto the engineers who can still judge code. A labor-market framing of the same review-is-the-bottleneck argument running through the loop-engineering essays above. |
| Steve Yegge — "The Shape of Things to Come" | Argues agent-harness architecture is converging on loops, graphs, and issue trackers, that sequential CI/CD does not survive at agentic scale (proposing a batch, swarm-diagnosis model in its place), and that bespoke in-house harnesses beat reusable third-party frameworks because the harness has to be fitted to the codebase. A practitioner's map of where the harness layer is heading. |
Cross-Vendor Code-Agent Engineering
Official engineering posts from other vendors building code agents — useful for seeing how the same design questions are answered outside Claude Code.
| Resource | Vendor | What's Notable |
|---|---|---|
| Codex v0.153.4 | OpenAI | A versioned comparison of summarizing compaction, experimental context-window management, and cross-session memory. The source notes distinguish their activation and lifetimes, including the later model-capability check. |
| Deep Agents vs LangChain vs LangGraph | LangChain | Explains how its harness, framework, and runtime compose. An agent loop can run inside a graph, and a custom graph can be exposed as a subagent. Published August 6, 2026; a useful earlier source for the guide's reasoning-placement decision. |
| Cloud Agents and Cursor Harness Improvements, Self-hosted machines, Projects | Cursor | The August 19 update adds event subscriptions, persistent goals, and subagents on separate machines. The September 2 update adds scheduling across named worker pools. Together they motivate separating the lifetime of a goal, a session, and its execution machine; the announcements do not establish exactly-once event or result delivery. Projects entered beta on September 10. A cloud coordinator plans work, delegates implementation, and returns results for user review. A project synchronizes a set of files across cloud and local agents. |
| Introducing the Agents API, Agents API computer use | OpenAI | The September 10 public beta exposes the Codex harness as a managed service. Applications provide tools and choose an execution environment. OpenAI runs the agent loop and manages sessions, context, and recovery. Computer use was added on September 29, with the browser running in an OpenAI-hosted environment. Each new website origin needs the user's approval, separate from the environment's network policy, and origin approval does not confirm individual actions. Sign-in values go through a dedicated event that stays outside the model's input and session history, and only the main agent, not a subagent, can request sign-in. |
| Mastra Factory beta | Mastra | Entered beta on September 8. Current documentation separates stage transitions, entry and exit actions, and transition approval. PR review and task completion are tracked separately. |
| Rethinking skills and prompts for GPT-6 Astra | OpenAI | September 11 guidance for GPT-6 Astra recommends short skill descriptions, task-specific document references, and explicit completion conditions. Codex can shorten descriptions when the skill catalog is large. Old instructions can add needless work or cause an early stop. |
| Managed marketplace updates, Content exclusions in app and CLI, Managed operation permissions | GitHub | Adds controls over plugin-marketplace updates and, for Business/Enterprise app and CLI users, excluded context. These govern different parts of the system. Content exclusion has client and input-path limits and is not a general filesystem sandbox. Managed operation permissions became generally available on September 9 for Business/Enterprise app, CLI, and VS Code Agent Host sessions. Rules use deny > ask > allow, and declared allowlists are intersected. Each managed ask needs new approval. |
| Local sandboxing, Default enablement, Computer use | GitHub | Public preview from September 23: the Copilot app can sandbox each project's files, network, and Git or GitHub CLI credentials. Enterprise settings can make the effective policy stricter, and if the OS cannot enforce it the sandboxed shell fails instead of running unsandboxed. A September 24 policy for Copilot Business and Enterprise, effective October 22, lets administrators choose a default (enabled, disabled, or left to organizations) for eligible generally available features left unconfigured, current and future, including the MCP servers policy; explicit choices are kept. Computer use (public preview from October 1) asks before controlling each app and keeps a reviewable always-allow list. |
| Copilot Memory in autofix, About Copilot Memory | GitHub | From September 25 (public preview), agentic autofix reads Copilot Memory when fixing security alerts and stores fix patterns that other Copilot features can use. Repository facts cite supporting code, are checked against the current branch before use, come only from users with write access, and are used only in that repository. |
| Rollouts | Cursor | Added September 23 for Teams and Enterprise, Rollouts extends review past the merge. When a pull request opens, it posts a monitoring plan that the author can edit: risks, the intended effect, the signals to check, and missing instrumentation. On each deploy it reports a separate verdict per environment: healthy, regression, or inconclusive. On a regression, depending on configuration, it can open a revert PR for review or hand the finding to an agent, but it does not merge or roll back on its own. |
| Improved token efficiency for longer agent runs | Cursor | September 23: Cursor reports that harness changes cut user token costs by 7% without reducing agent quality, and says it used A/B tests on its user base to tune the changes. As models improved it removed about 66% of the system prompt, loaded rarely used built-in tools on demand, placed cache breakpoints after the parts of each request that rarely change, and dropped instructions that pushed subagent use, since newer models had learned that pattern in training. The figures are vendor-reported, and the evaluation details are not published. |
| Dynamic workflows in Copilot CLI and the Copilot app, concepts | GitHub | Public preview from October 1 in Copilot CLI, the Copilot app, and the Copilot SDK. A workflow is code that defines the steps, when agents are involved, and how their results are used. Limits cover concurrent agents, total agents, active running time, and approximate AI credits. Reaching the concurrency limit makes new agents wait; the other limits stop the run but keep its status and saved results for resuming, and a raised limit still counts usage from before the stop. On resume, saved results from completed steps and subagents can be reused, while unsaved work may need to run again. Workflow subagents inherit the session's permission grants, so a session-long grant made for one subagent applies to the others. |
| Harness Engineering: Leveraging Codex in an Agent-First World | OpenAI | Frames the "harness" as the constraints, feedback loops, and documentation that make agents reliable; reports a roughly 1M-line beta built with essentially no hand-written code. |
| Codex 0.147.0 | OpenAI | Brings portable Agent Plugins into a catalog spanning local, personal, workspace, and remote sources; adds --approve-for-me, an opt-in implementation of the 2026-07-28 MCP protocol, remote compaction, transcript sections, and imports from Cursor-managed skills and Claude/Cursor conversations. The security boundary tightens at the same time: unfamiliar local projects require explicit trust, bearer tokens are redacted from history and replay, and failed plugin policy updates fail closed for network access. Codex 0.157.0 (September 25) applies network restrictions to redirects and to ongoing HTTP and WebSocket traffic, and cancels a connection when a policy change revokes access. Codex 0.156.0 (September 22) reloads global instructions before each model request, so an edited global AGENTS.md applies in a running session, while repository instructions reload only when the environment or trust level changes. Codex 0.158.0 to 0.162.0 (September 28 to October 8) scope approvals more narrowly: approved commands keep explicit filesystem denials and .aws is protected under writable roots (0.159.0), an approved filesystem escalation widens writes while denied reads and network restrictions stay in force, background tasks keep the permissions of the turn that started them (0.161.0), and saved permissions are restored on resume (0.160.0). The opt-in Guardian approval reviewer can retrieve earlier user instructions and handoff context (0.160.0), and managed Git worktree tools work only from trusted local projects (0.162.0). See the October 14 source notes. |
| Deep Agents v0.7 | LangChain | Removes the base system prompt and default todo middleware, cuts built-in tool descriptions by 43%, and lowers first-turn base input from about 6K to 2K tokens; the reported multi-model evaluation does not show a statistically clear loss in overall reward. The post also identifies when todo planning helps and exposes summarization thresholds, search truncation, and file pagination as harness controls. Unlike Anthropic's context-engineering post above, this one tests the change across several model backends. |
| Best Practices for Coding with Agents | Cursor | Articulates an agent harness as three components — Instructions, Tools, and Model — orchestrated per model. |
| Build with Google Antigravity | Agent-first platform: a Manager view for asynchronous multi-agent orchestration, with Artifacts (plans, screenshots, recordings) as the verification mechanism instead of raw logs. | |
| Microsoft Agent Framework at BUILD 2026: Agent Harness, Hosted Agents, CodeAct | Microsoft | Adds a built-in "agent harness" with automatic context compaction, file-based memory, plan and execute modes, skill discovery, parallel sub-agents, and a sandboxed shell. Also adds CodeAct, which lets the model run several tool calls as one Python program inside a fresh Hyperlight micro-VM each call. |
| Codex Security: Now in Research Preview | OpenAI | Application-security agent that builds a project-specific threat model, then finds and pressure-tests vulnerabilities in sandboxed validation environments. It has since shipped as the @openai/codex-security CLI and TypeScript SDK (first published July 28, 2026), adding deep-scan workers, Linear issue publishing, and CI integration behind a verified-access requirement. |
| Meet Your Agent Harness and Claw, Working with Your Data, Safely, Scaling Harness Capabilities | Microsoft | A four-part harness series. Notable for the authorization design: a standing rule ("always approve this tool", "always approve these arguments") lives only inside the session and is never baked into the agent, which is a direct point of comparison with Claude Code's permission model. Capability growth is split into four orthogonal mechanisms: Skills, a restricted Shell, CodeAct, and Background Agents. |
| Transitioning Gemini CLI to Antigravity CLI and antigravity-cli | Gemini CLI is retired (effective June 18, 2026) in favor of a Go rewrite that shares one agent harness with the Antigravity 2.0 desktop app. Per its CHANGELOG (the repo ships releases and examples, not source), the mechanisms sit close to Claude Code's: nested subagents to grandchild depth and beyond, whose subtrajectory updates are recursively relayed to the root conversation; workspace-level .agents/hooks.json where a pre-tool hook decides whether a tool call is permitted; and per-project permission config, stored under ~/.gemini/config/projects/ rather than in the repo, taking precedence over global settings. |
|
| Governing Agent Autonomy with Auto-review | Cursor | A classifier runs inside the agent loop rather than as a separate endpoint. When it blocks an action it returns an explanation to the parent agent, which can often route around it safely without ever interrupting the user. Roughly 4% of actions get blocked while only about 7% of chats end up interrupting a human. Blocking as a steering signal, not just a stop. |
| Customize Cursor | Cursor | Plugins, skills, MCPs, subagents, rules, commands, and hooks collapse into one extension surface with user, team, and workspace scopes. A non-Anthropic vendor converging on almost exactly Claude Code's extension points. |
| Codex-maxxing for Long-Running Work | OpenAI | The memory vault keeps AGENTS.md, TODO.md, projects/, and people/ in GitHub so that the diff becomes the review interface for memory. States the design position directly: memory must be open-able, edit-able, diff-able, and reusable. |
| Devin Fusion and Agentic MapReduce, Fusion on Desktop and CLI | Cognition | Fusion couples two mechanisms usually treated separately: a classifier re-scores task difficulty mid-session, and the model swap is timed to land on context compaction, to avoid an extra cache miss from the switch. MapReduce draws a clean line between agents and deterministic compute: put an agent only where reasoning is needed, make everything else deterministic. Fusion reached Devin Desktop and CLI on September 11. The design account describes model-pair choices about task brief detail, whether workers can question instructions, and exploration duties. |
| AI SDK 7 | Vercel | HarnessAgent treats Claude Code, Codex, and Pi as interchangeable backends behind one API, with sessions that park and resume. WorkflowAgent makes each tool call a durable retryable step that survives process restarts. Tool approvals are HMAC-signed, which addresses a rarely-discussed problem: forged approvals. |
| MCP 2026-07-28 specification and Enterprise-Managed Authorization | MCP | Removes protocol-level sessions and the initialize handshake; capability discovery uses server/discover. Multi Round Trip Requests let a logical tool operation request input and continue across separate requests. Application state and continuation state still need an owner. Roots, sampling, and logging are deprecated; Tasks move to an extension. Enterprise-managed authorization provides a separate organization-level control. |
| Droid Shield 2.0 | Factory | A deterministic regex scanner flanked by two fine-tuned models: one re-reads context for recall when the scanner stays silent, the other masks the candidate secret and judges from context alone whether the scanner produced a false positive. Deterministic rules and learned models wired into a two-way correcting gate. |
| Software Is Made Between Commits (DeltaDB) | Zed | Version control rebuilt for agent sessions. A message and the edit it produced are stored side by side so neither drifts from the other, and every reference anchors to a delta rather than a line number, so it survives as code moves underneath it. The argument: git is organized around discrete commits and was never designed to hold the conversation that produced the code. |
| Multi-agent orchestration in the Responses API | OpenAI | Subagent orchestration moves out of client code and into the API. A root agent spawns a named tree (/root/researcher) coordinated by six hosted actions (spawn_agent, send_message, followup_task, wait_agent, interrupt_agent, list_agents), with max_concurrent_subagents capping how many subagents may be active at once across the whole tree (descendants count, the root agent does not). The tradeoff is stated plainly: reasoning summaries and max_tool_calls are unavailable while multi-agent is on. |
| Programmatic Tool Calling | OpenAI | The model writes JavaScript that reaches tools through a tools.* namespace, run in a fresh isolated V8 with no filesystem, no network, and no state carried between programs. Tools opt in through allowed_callers, so a tool can be reachable by the program, by the model directly, or both. Batching and filtering happen inside the program, which keeps intermediate tool output out of the context window. |
| Copilot CLI changelog | GitHub | Three July changes worth setting against Claude Code's permission model: an auto allow-all mode that approves whatever an LLM judge rates acceptable; a trusted repository pinning model, effort level, and context tier and extending the URL, MCP, and skill deny lists through .github/copilot/settings.json; and preToolUse hooks that deny a tool call by exiting with code 2. Plan mode hard-blocks built-in tools that would modify the workspace, but MCP and external tools stay allowed, a narrower boundary than the name suggests. |
| Why We Built ADK 2.0, ADK Python 2.11.0, 2.9.0 | Workflows turn orchestration into a directed graph whose node transitions are evaluated in code rather than chosen by the model, so deterministic steps such as tool calls and human-in-the-loop approvals sit in the same graph as open-ended agent steps. The context decision is deliberate: the engine passes only the necessary subset of data to each downstream node, "shielding them from verbose, unrelated execution history" instead of letting a subagent inherit the whole trace. ADK Python 2.11.0 (October 1, 2026) lets an abort signal stop a Runner, workflow, or node gracefully, and makes tool nodes in a workflow pause for user approval instead of passing an error downstream. Since 2.9.0 (September 10), a failed node reruns when the workflow resumes instead of being replayed as completed, so the release notes ask for idempotent node bodies. | |
| Introducing Harness Optimizer | AWS | Treats the harness as tunable parameters rather than something written by hand: system prompts, tool descriptions, and skills become a Formula, a RewardFunction scores execution traces, and a Trainer runs rollout, reward, and update epochs. The default optimizer is itself an LLM that reads winning and losing traces contrastively and rewrites the Formula to encode the difference. Open source, and offered in production as AgentCore Optimization. |
| The Self-Driving Company | Replit | A rare look at how a vendor runs agents internally rather than what it sells. Every employee gets a manager agent that spawns and orchestrates further agents on the company's own harness, microVMs, and remote filesystem, with the whole arrangement placed "behind access policies, token proxies, audit logging, and our ZeroTrust network." Human escalation is designed in rather than left as a fallback: the code-review agent grades risk and pulls in a second human reviewer only when warranted. |
| Amp news | Sourcegraph | Two July entries push the same direction. Agents can now spawn other agents, message them, and exchange files across threads, which is peer-to-peer coordination rather than a parent collecting subagent reports. Separately, the Orb remote sandboxes moved to OIDC workload identity, replacing static credentials for agents that execute remotely. |
| Agent Plugins 1.0 (launch) | Cross-vendor | A portable plugin package format published in August 2026: a plugin.json manifest bundling Agent Skills (a skills/ directory) and MCP servers (mcp.json) into one directory that installs across clients. Its initial Technical Steering Committee lists Core Maintainers from Amazon, Cursor, Microsoft, OpenAI, and Vercel, and support ships day-one in VS Code, Copilot CLI, and the Copilot app. The extensibility-layer counterpart to what MCP did for tools: the two surfaces this paper analyzes, skills and MCP, getting one shared distribution format across vendors. |
| One Agent, Every Surface: How We Built the Kiro Agent Harness | AWS | Consolidates three separate agent implementations (IDE, CLI, and web) into a single standalone harness process addressed over the Agent Client Protocol, and replaces three incompatible permission systems with one capability-based model backed by Cedar, a formally-verified policy language. Context management and compaction become uniform across surfaces. A vendor answering the permission-model question with a verified policy engine rather than hand-written rules. |
| Introducing Delta | Zed | A standalone app for multiplayer coding with agents rather than a feature added to the editor. Built on DeltaDB (listed above), it replicates the conversation and the worktree together in real time for everyone in a thread, with comments anchored to code as it changes underneath them. Puts the thread, not the file, at the center of the session architecture. |
| Global Plugins and Skills | Sourcegraph | Centralizes plugin and skill management across two scopes: a personal tier for individual experimentation with live reload, and an admin-managed workspace tier that sets team defaults, with sharing between them. Extension distribution as a governed, team-scoped surface rather than a per-repo file. |
| How to Build a Cloud Software Factory: Computer Use Verification | Warp | A verify-behavior skill lets an agent drive a running application with mouse and keyboard to confirm its own work against the spec, instead of inspecting code alone. The same skill serves triage agents that reproduce bugs, implementation agents that validate features, and review agents that produce screenshot and video evidence for a human, all cloud-side so the developer's machine is untouched. Self-verification promoted from code inspection to behavioral proof. |
Runtime & Sandbox Infrastructure
Where and how agent actions actually execute: sandboxes, managed runtimes, control planes, and the session protocols wrapped around them. The counterpart to Claude Code's own shell sandbox and execution boundary.
| Resource | Vendor | What's Notable |
|---|---|---|
| Temporal Deep Agents integration, Workflow Pause | Temporal | Listed as pre-release in the August 27 digest. The integration runs the control loop in a replayable Workflow and model calls in Activities; tools and backends with real I/O need explicit wrappers. Pause stops new dispatch while in-flight Activities may still finish. |
| Bedrock AgentCore Harness is Generally Available | AWS | The harness stops being a loop you write and becomes a managed configuration object: CreateHarness and InvokeHarness declare the model, tools, skills, memory policy, and container environment, over seven primitives (microVM Runtime, Memory, Gateway, sandboxed Browser, Code Interpreter, Identity token vault, Observability). A new coordinate in the design space: who owns the loop, the environment, and the tool boundary. |
| AgentCore Policy with Guardrails | AWS | Enforcement happens at the gateway boundary, outside the agent's own code, so it holds no matter how autonomous the agent becomes. A sharp architectural contrast with in-loop permission checks. |
| Running Untrusted Agent Code Without a Sandbox and Dynamic Subagents in Deep Agents | LangChain | Capability isolation run backwards from the container model: QuickJS inside WASM starts at zero capability and the harness bridges in each capability explicitly. Interpreter memory can be serialized for a durable pause that waits on human approval. Subagent dispatch then drops from conversation turns into program control flow, with the model writing a script that calls task({...}). |
| A Single Pane of Glass for All Your Cloud Agents | Warp | Oz as a multi-harness control plane: launch, track, govern, and steer Claude Code, Codex, and Warp Agent from one surface, compare their effectiveness, pick different harnesses for different tasks, and keep one consistent audit trail. Agent Memory carries across harnesses. |
| Introducing the Warp Agent CLI | Warp | Builds the agent on a PTY multiplexer rather than a line-oriented shell wrapper, so sessions survive directory changes and SSH hops and can operate interactive programs such as debuggers and editors. Native subagents can delegate across Warp, Claude Code, and Codex; a local session can hand off to the cloud for web monitoring and steering. PTY management is therefore part of the harness runtime, not merely a shell tool exposed to the model. |
| Agent Host and the Agent Host Protocol, VS Code 1.137, VS Code 1.140 | Microsoft | VS Code 1.129 moves agent sessions out of the editor into a dedicated process addressed over an open Agent Host Protocol. Because the session lives in its own process it keeps running with no client attached and can be rendered from several windows at once, and one host runs Copilot, Claude, and Codex behind a single session model. Agents on the host can list other sessions, read their transcripts, spawn a session to hand off a subtask, and message another session, with sends requiring user confirmation and a burst cap so one request cannot fan out into unbounded sessions. Version 1.137 queues agent messages to a busy chat and starts them in send order after the active turn succeeds. Automations is in Preview and needs an awake machine and the relevant running host. Disabling a schedule leaves its active run in progress. Version 1.140 (September 30) adds experimental tools for delegating work to connected remote agent hosts, chosen by name or by operating system, memory, and CPU requirements. A remote session gets no workspace unless one is named, and normal approvals still apply. Remote agents report back with send_remote_message; their final answers are not forwarded automatically. Reaching an orchestration limit blocks new orchestration actions but does not interrupt work already running. |
| Gemini Enterprise Agent Platform | Computer Use and Shell sandboxes became generally available on September 9. Each Shell call starts a new shell. Separately, VPC Service Controls support for Agent Gateway requires ALL_TRAFFIC and a gateway created after September 8 with an agent connectivity template. | |
| Sandbox forking | E2B | Sandbox.fork() checkpoints a running sandbox in place, briefly pausing it, snapshotting full memory state, and resuming it with its ID and expiration untouched, then starts N independent sandboxes from that snapshot. Gives a harness a cheap way to branch one expensively-configured environment across parallel attempts instead of rebuilding it for each. |
| Docker VMM Public Beta | Docker | Docker's first self-owned hypervisor, replacing the third-party libkrun underneath Docker Desktop. The same engine powers Docker Sandboxes, the microVM isolation layer used for agent execution, so every change lands in both. Claims faster container and sandbox startup, better host-to-guest file I/O, and Hyper-V-grade isolation on Windows. The isolation substrate under a widely-used agent sandbox. |
| Sandboxing | Zed | Agent terminal and fetch tools are sandboxed by default using OS-level primitives (Seatbelt on macOS, bwrap and namespaces on Linux, WSL on Windows), blocking writes outside the project, .git access, and unapproved network calls. The post walks through a symlink-swap attack to show that instruction-based restrictions alone are insufficient, the same lesson the GhostApproval research draws. |
| Cloudflare Gateway: MCP Detection and AI Security Dashboard | Cloudflare | Cloudflare Gateway now fingerprints MCP traffic from its headers and payload shape, adds a policy selector to allow, block, or isolate it, and reports MCP request volume, unique users, and unique servers over time. Treats MCP as a network-inspectable, policy-governable traffic class at the enterprise perimeter rather than only an application-layer protocol. |
Security Research & Incidents
Vulnerability research, disclosures, and real-world incidents involving coding agents, from any vendor. The safety envelope tested against an adversary rather than described on paper.
| Report | What It Shows |
|---|---|
| APPA: Recoverable Information-Flow Control for Real-World LLM Agents | The August 26 revision checks tool calls before execution and checks returned data before it enters context. It uses temporary branches to inspect untrusted data and restricts what those branches can return. |
| Twin Agent: Context Residual Compression for Privilege Separated Agents | Assigns untrusted reading and privileged execution to different agents. The reader sends compact hints to the executor. This makes observation access, action authority, and the return channel separate design choices. |
| MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair | Tests whether malicious content is stored, later changes an action, and can be removed while useful memory is retained. Compares complete agent, memory-backend, and model configurations. |
| Tenet Security — "One Fake Bug Report Hijacked a $250 Billion Company's AI Agent, Then 100+ More" | The sharpest demonstration to date that a tool's return value is untrusted input. A Sentry DSN is public by design (Sentry documents it as safe to embed in frontend JavaScript) and accepts arbitrary error payloads, so an attacker can POST an event carrying markdown instructions that render as a fake "Resolution" section. A developer then asks their agent to look into the Sentry issue, the agent pulls the poisoned event back through MCP, reads it as trustworthy remediation guidance, and runs an attacker-controlled npm package that exfiltrates AWS keys, GitHub tokens, and SSH credentials. Confirmed against Claude Code, Cursor, and OpenAI Codex, including sandboxed variants and CI/CD pipelines. |
| AWS Security Agent bucket ownership advisories | AWS disclosed CVE-2026-87912 and CVE-2026-87913 on September 10, 2026. They concern missing bucket ownership checks when uploading workspace archives. Fixed plugin 1.1.0 and MCP server 0.2.0 check the expected owner and stop on a mismatch. |
| Claude Desktop shared-folder advisory, CVE-2026-103435 | Two Anthropic advisories about the gap between what was checked and what took effect. On September 25, Anthropic disclosed that Claude Desktop's list of file types blocked from opening out of a Cowork shared folder missed one type that macOS runs on open, so a file written by a prompt-injected agent inside the sandbox could run commands on the host when the user opened it (fixed in 1.15962.0). On October 5, CVE-2026-103435 described Claude Code checking a write path at permission time but resolving it again at write time; an attacker with write access to a shared workspace who won the race could swap in a symlink and redirect the write outside the project (fixed in 2.1.129, well before the disclosure). |
| Manifold Security: GitSpawn | Published September 1, 2026. Several CLI coding agents ran git status or git diff at startup or early in a session without stripping the repository's own git configuration, so a setting such as core.fsmonitor ran a repository-chosen command as the user, outside the sandbox and with no approval prompt. In Claude Code 2.1.193 this happened before the workspace trust prompt was accepted (fixed by 2.1.196); a second Claude Code finding, on the claude ultrareview path and using a different git setting, was still unpatched on 2.1.252 at publication. The attack needs a repository delivered as files with its .git directory, not a normal clone. The researchers report eight findings across seven agents, four unpatched at publication. Background context gathering belongs inside the trust boundary. |
| Agent Approval Laundering, Approval Laundering, When Consent Outlives Context: Residual Authority Replay in Long-Lived Agents | Three late-September preprints on what an approval covers and how long it lasts. Agent Approval Laundering (September 23) shows that an approval record names the entry command while its workflow, such as package lifecycle hooks, can have other effects, and proposes attaching a prediction of the workflow's effects to the approval record before the user approves. Approval Laundering (September 30) classifies six ways an executed action can differ from the approved one; a keyed approval token removed delegation mismatches in its tests but did not fix scope or argument mismatches. When Consent Outlives Context: Residual Authority Replay in Long-Lived Agents (September 27) reports that approvals kept across tasks raise prompt-injection success by up to 35.1 percentage points. Two of the studies build on Claude Code's PreToolUse hook, one to measure approval mismatches and one to carry its approval record. All results are author-reported. |
| Wiz — "GhostApproval" | An informed-consent bypass aimed at the approval dialog itself. A repository ships a symlink named something harmless like project_settings.json that actually points at ~/.ssh/authorized_keys or ~/.zshrc, so the dialog shows the decoy name and the user approves a write that lands somewhere else entirely. Amazon Q Developer, Cursor, and Google Antigravity shipped fixes; Augment and Windsurf acknowledged without one. Anthropic disputed it for Claude Code, arguing the scenario sits outside its threat model because the developer chose to trust the folder and then approved the edit. Worth reading with that disagreement intact, since it is really a dispute about where consent is supposed to come from. |
| Poisoning Claude Code: One GitHub Issue to Break the Supply Chain | The disclosure documents two routes rather than a completed compromise: agent mode treated any GitHub App actor as trusted; separately, an official low-privilege triage example could be chained into a privileged tag-mode workflow. In either route, prompt-injected Claude could read OIDC request credentials from /proc/self/environ and exfiltrate them through issue updates. Anthropic mitigated the issues by claude-code-action v1.0.94. |
| Towards a Risk Assessment of Malicious Skill Files in Coding Agents | Treats agent skills as a software supply chain rather than inert prompt text. The authors transform 471 real shell commands into 2,826 benign-looking skills spanning 11 MITRE ATT&CK tactics, then complete 5,629 runs against Gemini CLI and Qwen Code. Reported exploitation rates are 95.5–96.1% and 71.6–74.0%, while explicit safety recognition appears in only 1.99% of runs. Although the preprint uses one synthetic attack template and two CLIs, the results support explicit skill admission, provenance, scanning, and runtime least privilege. |
| HiddenLayer — "Five Layers of Securing AI Agent Harnesses" | Industry security research that names the harness, not just the model, as the primary coding-agent attack surface, and documents concrete techniques against it: instructions hidden in ``-style XML tags that inherit system authority, MCP tool-definition metadata that steers behavior from inside the system prompt, skill YAML-frontmatter permission abuse, and "CopyPasta," a self-propagating prompt injection disguised as a license header that spreads across repositories. |
| AI Guardrail Survival under Single-Cycle Agentic Self-Summarization | Shows that safety rules embedded in an agent's context often survive compaction textually while silently losing their force: behavioral violation rates rise 34 to 57 percentage points when degraded post-compaction rules are compared against intact ones, and the loss is invisible to anyone inspecting the summary text, since "a presence check is not a safety check." The safety-side companion to the compaction-as-truth-loss work in the papers list, aimed at mechanisms like Claude Code's /compact. |
| ColluSkill and SkillsMetric | Two August studies mapping the limits of skill scanners. ColluSkill splits a malicious payload across several individually-benign skills that compose into harmful behavior only at runtime, reaching 96% average attack success against six representative scanners, with a proposed defense cutting it to 22.5%. SkillsMetric tests a five-stage static-analysis framework on 2,266 malicious skills and finds a blind spot the aggregate AUC hides: host-destruction attacks using ordinary shell commands are detected 0% of the time. Together they push the malicious-skills thread above into the arms race between composition attacks and static scanning. |
| Embrace The Red — "LLM Heist: Hijacking LiteLLM for Traffic Interception, Key Theft, and Tool-Call Injection" | An attacker with proxy-admin access to a LiteLLM gateway can reroute its traffic to an attacker-controlled instance, harvest backend provider keys, and inject forged tool calls into responses after inference, which bypasses prompt-level defenses because the agent client sees a legitimately-formatted call. A trust-boundary attack against the LLM-gateway layer many agent deployments sit behind. The precondition is pre-existing admin access, so it reads as a post-compromise amplifier rather than a zero-click break. |
| Orca AI Incident Archive | An open dataset of AI agent security events, one Markdown record per event with links to its public sources, a source-quality grade, and a real_harm field that separates confirmed damage from research demonstrations. Coding-agent records include Replit Agent deleting a production database, Claude Code running terraform destroy against DataTalks.Club's produc |