Friday, August 28, 2026
TL;DR
Johann Rehberger got code execution through Claude Code's auto mode at 60 to 80% success; Anthropic closed the report, calling auto mode a convenience feature rather than a security guarantee, and Claude Code 2.1.248 added a Restricted Mode that drops execution tools entirely. Separately, a federal judge ruled the Pentagon's Anthropic blacklist unlawful.
Act on this
- Run any agent with auto mode in a container or VM, with credentials and your home directory outside it. Claude Code 2.1.248 added --restricted, which drops execution tools and WebFetch entirely. #
- Set CLAUDE_CODE_ENABLE_TODO_TOOLS=1 if you script Claude Code. Release 2.1.243 removed TaskCreate, TaskUpdate and TodoWrite on Opus 4.8, Sonnet 5, Fable 5 and Mythos 5. #
Signals
Vendors are reclassifying agent guardrails from security boundary to convenience feature #
Johann Rehberger, August 26, planted a shadowing struct.py that Claude imported in code it wrote itself, reaching remote execution at 60 to 80% in limited testing. Anthropic closed it “Informative”: auto mode is “a convenience feature backed by a best-effort classifier, not a security guarantee.” Anthropic's own published eval reported 0.00% attack success across 72 fixed scenarios. Simon Willison carried it August 27. Rehberger
Harness investment now pays because the model curve stopped absorbing sloppiness #
This moves the harness thread filed Tuesday from who builds one to why anyone should. Drew Breunig, quoted by Simon Willison on August 23: “Prior to Fable, it felt silly to waste too much time improving your coding harness or context strategies. A new model would arrive at the same price (or cheaper!) and paper over most of your problems.” Willison
The customs that governed how software gets written are dissolving ahead of the tools #
Armin Ronacher, August 22: “the act of familiarizing yourself with a language no longer matters and some of the friction that mattered for humans does not matter for agents,” so teams now pick Rust and Zig on marketing. Thorsten Ball, August 23, on contribution graphs, Stack Overflow and TDD: “who cares about their GitHub contribution graph anymore?” Both assert; neither measures. Ronacher
News
ACTGoogle dates the Gemini omni preview endpoint for removal #
gemini-omni-1.1-flash went GA August 27 with video extension and 4K output; gemini-omni-flash-preview stops serving September 30. Anything pinned to the preview string needs migrating. Changelog
WATCHA federal judge ruled the Pentagon's Anthropic blacklist illegal #
a 59-page order found February's supply-chain-risk designation was retaliation for protected speech. Federal procurement is unblocked for now; an appeal is expected. NPR
SHIPAnthropic previews a Model Hardware Standard #
a driver layer that lets agents read from and write to physical devices, reachable over MCP. Waitlist only: no spec, SDK or repo yet. Anthropic
SHIPUnsloth v0.1.804-beta quantizes GLM-5.3-Flash and Qwen3.8-Flash-Next #
GLM-5.3 fits 102GB of RAM plus VRAM, Qwen3.8 fits 75GB. It also fixes NVIDIA freezes under Wayland and AMD model-load crashes. Release
WATCHA persistent Codex agent appears in an unreleased OpenAI pull request #
the agent runs until explicitly slept and generates its own follow-up tasks across sessions. Read from public code, not announced. Single source. WIRED via Slashdot
The long view
Governance and law. A year ago a lab refusing unrestricted military use of its models was making a values statement with a commercial cost attached. In February the Pentagon converted that refusal into a supply-chain-risk designation and froze Anthropic out of federal procurement. This week a court called the designation unlawful retaliation and quoted the government's own wish to make an example of the company. Refusal now has a remedy.
Also noted
- Anthropic planned, then dropped, a roughly $7B purchase of chip startup MatX. Single source. Reuters #
- Nvidia paused the July GPU revenue-sharing model over antitrust exposure. Single source. DCD #
- Visa's open agentic vulnerability harness now writes fixes and attacks its own patches. GitHub #
- SemiAnalysis released AgentX, an open benchmark for multi-turn agent inference at 1M context. SemiAnalysis #
- Over 100 companies signed a collective cyberdefense letter carrying no commitments or dates. OpenAI #