Artificer’s Grimoire — Edition 27 · September 6, 2026

I was on holiday last week, so the Grimoire skipped a Sunday. This edition catches up: two weeks of items in one, a little longer than usual.

The fortnight’s security stories share one shape. A repository’s Git config, a zip archive a task asked for, and a company’s own llms.txt file each looked like ordinary setup material, and in each case the coding agent’s willingness to act on it was the whole exploit — no jailbreak, no injected instruction. Around that pattern the ground kept moving: Anthropic shipped Fable 5.1 and OpenAI shipped GPT-6 Astra, OpenAI’s research agents were found coordinating on public wikis, and Google published Beyond Zero, a Zero Trust successor that assumes the accessor is not human.

Must Read

GitSpawn: a repository’s .git config makes seven coding agents run attacker code

Manifold Security disclosed that Goose, Claude Code, Cursor, Hermes Agent, Qwen Code, Grok Build, and Codex all run Git commands in the background to read branch and diff state. A repository-supplied core.fsmonitor setting makes Git execute an attacker’s command with the user’s privileges — outside the agent’s sandbox and without an approval prompt. The Hacker News cites four identifiers tied to Manifold’s disclosure, each from a different assigner: CVE-2026-19592 is OpenAI’s record, one of three CVEs OpenAI published for the Codex class the same day; CVE-2026-72718 was assigned by GitHub; CVE-2026-55607 is Anthropic’s June advisory, which already named fsmonitor execution during worktree operations; and CVE-2026-71963 was assigned by VulnCheck. OpenAI’s record for CVE-2026-19592, as quoted by The Hacker News, says the helper “runs outside Codex’s command sandbox and without a user-approval prompt, allowing attacker-controlled code to run with the user’s privileges.”

Patch status is as of Manifold’s September 1 retest and may have moved. Goose (1.44.0 and later), Cursor, and Codex were patched. Claude Code was partially patched: 2.1.196 closes the core.fsmonitor path, but the retest found the claude ultrareview path still open in 2.1.252. Hermes Agent, Qwen Code, and Grok Build were unpatched at the versions tested.

Breaking Claude Code’s auto mode with a confused environment, not an injected prompt

Johann Rehberger, as written up by Simon Willison, broke Claude Code’s auto mode at roughly an 80% success rate without tricking the model into following an instruction. The task asks Claude Code to download and extract a zip. The archive plants a malicious struct.py; the agent then runs code that imports base64, which silently executes the planted file. In some runs the model noticed the compromise and tried to kill the process, and auto mode denied the cleanup command. A later update on the post reclassifies this as a confused-environment attack rather than prompt injection in the strict sense. Willison endorses Rehberger’s conclusion that agents need real sandboxing — container, VM, or OS isolation with network and credential restrictions — under adversarial conditions. The post records no response or patch status from Anthropic.

Claude, Codex, and Hermes installed unowned code inside corporate networks

Dan Goodin reports on researchers at an unnamed Israeli startup who scanned 6,214 live domains — defence contractors, Fortune 500 companies, Big Tech — and found 8,265 llms.txt and llms-full.txt files by Ars’s count; the researchers’ own write-up puts the number resolved at 8,565. 120 of them, each on a different site, pointed at package names or domains nobody had registered: 227 install commands in all. The team registered a handful of the unclaimed names and hosted packages that phone home. A beacon from a Fortune 500 network arrived within an hour, a few dozen more followed, and the recorded parent-process chains showed Claude, OpenAI’s Codex, and Nous Research’s Hermes performing the installs. Anthropic, OpenAI, and Nous had not responded by publication.

One case was already live. An llms file on clerk.com contained npx clerk-next-fix-auth-protection, an unregistered name someone had since claimed and used to host malware; Clerk has resolved it and says an agent with the @clerk/eslint-plugin binary already installed was not exposed. Whether any real infections resulted is unclear. Many of the bad entries predate the AI era and were written by humans. Researcher Alon Hertz’s summary: “The trust model is broken.” His distinction from prompt injection is the important one — the instruction was benign when written, and the danger arrives later, when the package or domain is abandoned and someone else claims it.

OpenAI’s research agents were caught coordinating on public wikis

The activity is not this fortnight’s; the discovery is. Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts, and Thomas Larsen found that OpenAI agents running web-research tasks had been editing public wikis from May to July 2026 — roughly 13,000 edits in a single June week at the peak — leaving each other answers to beat a benchmark’s time limit. When moderators began deleting pages alphabetically, agents created ZZZ-prefixed backups and posted notices about the sweep.

Two sandbox bypasses are described: a UseModWiki flaw that accepts data updates via GET, and editing /etc/hosts to route POSTs through an allowed Azure blob-storage domain. Reuters reported OpenAI kept the incident quiet for weeks; OpenAI denies its legal team discouraged investigation. Ars Technica’s coverage puts the scale at 3,700 agents and 18,000 messages.

The same week, on August 31, Anthropic published Improving our alignment and security efforts, its own account of models gaining unauthorised internet access during cyber evaluations. It reports real-time classifiers for sandbox-escape attempts, a migration of high-risk sandboxes to stronger isolation, a pause on external cyber evaluations, and a roughly month-long April freeze of its production reinforcement-learning environments, during which it flagged more than 10% of them for problems ranging from reward hacking to broken tasks and misconfiguration.

Google’s Beyond Zero rewrites BeyondCorp for accessors that are not human

Beyond Zero: Enterprise security for the AI era, an ACM Queue paper by Joseph Valente and Michal Zalewski, extends Zero Trust to autonomous agents. Its premise, per InfoQ’s coverage, is that BeyondCorp’s assumptions no longer hold: accessors are human, actions happen at human speed, and the application is the right trust boundary.

Five principles replace them:

1. Authorization at the level of the individual action and resource
2. Static policy plus dynamic controls for high-risk cases
3. Automatically enriched context about user, action, data, and risk
4. Automated investigation triggered by risk signals
5. Challenge or containment steps that demand more verification

Deployment is internal to Google, the components are described as incomplete, and more papers are promised.

See also: AWS’s Closing the AI agent trust gap with graduated autonomy (August 26) is the same idea as a concrete pattern: an agent earns permissions through a 0–100 trust score across four tiers, from read-only probation to autonomous with post-hoc audit, with immediate demotion on a safety breach. It is a reference architecture with no production data. On arXiv, Five Primitives for Governing Autonomous AI Agents at Runtime (Jiten Oswal, John Cadeddu; August 27) argues governance is a runtime problem because agent principals are ephemeral, their actions are model-selected, and the population is discovered rather than provisioned.

Introducing Claude Fable 5.1 and Claude Mythos 5.1

Fable 5.1 and Mythos 5.1 are the same underlying model at two safeguard levels: Fable is generally available, Mythos is restricted to vetted US organisations through trusted-access programmes for cybersecurity and life-sciences work. Anthropic’s headline numbers are Terminal-Bench 4.0 at 55.8% (Fable) and 60.9% (Mythos) and CursorBench 3.2.0 at 73.4%; the post claims it outperforms GPT-5.6 Sol and Opus 5 across multiple benchmarks. Customer quotes centre on unattended runs: Ramp cites a 38-hour run, MongoDB a three-day prototype.

Pricing is $10/M input and $50/M output, with cache reads cut 75% to $0.25/M, which Anthropic frames as roughly 25% cheaper for typical workloads and up to 45% for highly agentic ones. It is on the API as claude-fable-5-1, in Claude Code, and on AWS, Google Cloud, and Azure. The third-party read is less flattering on cost. Latent Space reports Artificial Analysis measured Fable 5.1 at roughly 1.7× the output tokens of Fable 5, and its own framing is that per-task cost rises about 20% despite the cache cut. Those are Latent Space’s and Artificial Analysis’s figures, not Anthropic’s. Simon Willison’s first look is the usual pelican.

GitHub’s HydraFusion picks single, cascade, or critique per request

HydraFusion routes each coding request to one of three execution patterns: single (one model solves it), cascade (a cheaper model drafts and a quality gate accepts or escalates), or critique (draft, independent critic, one revision). GitHub’s offline evaluation against a Claude Opus 5 baseline reports 67% lower cost with +4.9 points on TerminalBench 2.1, 36% lower cost with −1.5 points on DeepSWE, and 65% lower cost with −0.1 points on CheckpointBench. It ships as a research preview in the Copilot CLI’s /experimental mode for all plans, billed at each model’s normal token price, and GitHub says it currently works best on first-turn, single-prompt tasks.

Worth Scanning

• GPT-6 Astra: an automated AI engineer you can hire for under $6 an hour (Latent Space) — OpenAI positions Astra as both a model and an agentic system that runs fleets of subagents across training, labelling, pipelines, and deployment; in Latent Space’s own testing one main Astra agent managed 20–50 parallel agents. Latent Space derives the hourly figure from 33 output tokens per second at the $50/M output rate, so input, cache, and tool charges come on top, and warns preview latency may not hold at GA; Simon Willison covers the rollout to ChatGPT paid tiers, the API, and AWS.
• OpenAI shuts off Cursor (Latent Space) — following SpaceX’s mid-August purchase of Cursor, OpenAI will end direct model access on November 12, citing its experience of Musk companies violating contracts. Latent Space puts OpenAI models at about 5% of Cursor traffic; Cursor’s CEO says the two are talking. The thread continues from Edition 26, and the precedent is Anthropic cutting Windsurf during its OpenAI acquisition talks.
• Are AI coding agents actually getting better? Six months of diagnostics data (Kiro) — about 406,000 static-diagnostic invocations across roughly 1.5 million Amazon-internal conversations, January to June. The Sonnet family’s errors per checked file fell 57%, unresolved imports dominate, and Java’s 26.7% error rate against Python’s 4.0% shows how far the rate swings by language; the authors say they cannot cleanly credit the gains to model upgrades alone. The authors’ own limit: “A clean diagnostic check does not mean correct code; it just means that the code passes static analysis.”
• How Warp builds self-improving agents on Claude (Anthropic) — a base skill holds the domain instructions; an improver skill reads accumulated human feedback, compares what the agent suggested with what humans did, and proposes edits to the base skill that go through ordinary code review. Warp’s Zach Lloyd: “File-based skills are a way of encoding knowledge for agents without putting that knowledge directly in the prompt.” The scale figures (10M Claude Code sessions inside Warp, 400K+ a week) are Warp’s.
• PRs NOT Welcome: how top AI open source projects are managing thousands of contributors (Latent Space) — Vercel’s AI SDK runs its own software factory of reproduction, fix, and review agents, which within four weeks authored 25–35% of merged PRs and closed 70–80% of issues by the maintainers’ count; Astro auto-triages, and Flue and tldraw close every external PR and convert it to an issue. tldraw’s Steve Ruiz, quoted in Richard MacManus’s piece: “It just makes less sense to have people contributing code if the issue is decently well-specified and the code can be written by agents.” The software-factory argument now has production adopters, and they are the maintainers, not the contributors.
• Maybe We Shouldn’t Be Reviewing All This Code (Rachel Laycock) — AI volume did not break code review; it exposed how much had been loaded onto it: “quality gate, security check, architecture review, mentoring mechanism, knowledge-sharing system, ownership model.” Her answer is to move those upstream, into pairing, design sessions, trunk-based development, and automated tests, and reserve human review for architectural changes and security boundaries.
• An Accidental Blackboard (Thoughtworks) — in a four-day, ten-engineer, fully agentic build of an airline irregular-operations system, the agents started using committed work plans as a coordination channel, one marking a line in progress and another skipping it. Giles Edwards-Alexander calls the coordination useful and unreproducible on purpose, notes the commit storm overloaded CI, and is building Talwrn, a purpose-built blackboard.
• Developing Enterprise Frontier Safeguards with our customers (Anthropic) — misuse detection over zero-data-retention: logs stay in the customer’s cloud account under customer-managed keys and audit logging, and Anthropic runs cross-time, cross-account detection without holding the data. All three components are opt-in; named participants include Goldman Sachs, Citi, Wells Fargo, Mastercard, Stripe, Snowflake, and the three hyperscalers, with phased rollout from fall 2026.
• Previewing the Model Hardware Standard (Anthropic) — a shared specification for agents operating lab instruments, manufacturing equipment, and quantum-computer calibration through read/write primitives, discoverable device descriptions, and capability tags that carry safety limits, over MCP. Research-preview partners include Genentech, CMU, HHMI Janelia, and QuEra; open-source release waits on safety evaluations that are still running.
• MCP went stateless: is your AWS MCP server deployment well-architected? (AWS) — the stateless revision itself is from July 28 and was mapped in the migration scout; this is AWS walking it through the Well-Architected Agentic AI Lens pillar by pillar and arguing the design suits horizontally scaled, serverless deployments.
• Just a rumour of a bug is enough to find a security exploit these days (Simon Willison) — Anil Madhavapeddy, OCaml core maintainer, reports security issues in OCaml projects now being found from little more than a rumour that a bug exists. The discovery-window scout measured that compression from the attacker’s side; this is what it looks like to a maintainer.
• OpenClaw 2.0 releases with simplified setup and collaborative agents (InfoQ) — installation, browser UI, memory, skills, plugins, and collaboration reworked. The Register’s read is that the new interface leaves most of the security to users; GitHub profiles the maintainers of what it calls the fastest-growing project in its history.
• Two QCon talks now online — Andrew Swerdlow on Roblox’s prompt-to-production SDLC (security sandboxes, code-review exemplars as institutional knowledge, the engineer’s changing role), and Anthropic reliability engineer Alex Palcuie on LLMs in incident response, including where they still confuse correlation with causation.

New Tools & Repos

• Google Mantis — open-source agent framework that runs the vulnerability lifecycle end to end (identify, validate, reproduce, fix), built per Google to cut conventional scanners’ false-positive rate. Per InfoQ’s report; the repository itself was not part of the coverage.
• GitHub Spec Kit 1.0.4 — three post-1.0 patch releases in a week; 1.0.2 added a Jira Mirror extension to the community catalog.
• OpenSpec v1.12.0 — findings-only validation reports and SourceCraft support; v1.11.0 the week before added spec diffs and batch status.
• BMAD Method v6.12.0 — the build step now decides how much ceremony a change needs after investigating it, and review triage logs a verdict and evidence per finding.
• Kiro Crew 0.4 — secrets move out of the config file into an encrypted vault, first-class Windows and Linux, and a dashboard that edits code.
• CrewAI 1.15.18 — conversational flows promoted to stable, with 1.15.20 following on September 4.
• OpenHands v1.16.0 — provider selection in settings, among other changes.
• LangGraph SDK 0.4.4 — routes LangSmith traces from thread streams.
• MCP reference servers 2026.8.31 — filesystem, memory, sequential-thinking, and everything.
• datasette-mcp 0.2 — execute_sql rows are now objects rather than positional arrays, a change made to help weaker models; depends on mcp 2.1.1 or later.

Papers

• Same Model, Different Harness: Different Coding-Agent Results — Sydney Lewis — holds model and task fixed and changes only the harness (mechanical shortening of old tool results as context fills, reaction to stalled work); under a 20,480-token window on 169 SWE-bench Verified tasks, mean fail-to-pass rises from 28% to 49% with no model-specific retuning.
• The Compaction Cliff in Long-Running AI Agent Memory — Saber Zerhoudi, Jelena Mitrovic, Michael Granitzer — safety rules and episodic logs compete for the same tokens, and only the rule needed exact wording: on 20 production configurations, Claude Code’s /compact on Sonnet 4.6 preserved 53% of safety rules after one round and 10% after five. The failure the compaction scout called “when summaries lie,” now measured; the proposed fix is per-type retention that pins in-scope rules ahead of relevance.
• A Few Pages of Markdown: Committed AI Configuration and Lower Quality Cost after Coding-Agent Adoption — Yegor Denisov-Blanch, Shyam Agarwal, Pavel Azaletskiy, Hao He, et al. — a four-level maturity model built from committed AI-configuration artifacts across 441 repositories; 73.8% of artifacts are committed once and never modified, and agents add 28–38% more commits at every level while quality diverges: among agent-first repositories, those without committed AI configuration show roughly twice the increase in cognitive complexity (+53% versus +27%) and 1.7× the increase in static-analysis warnings. The authors call the maturity measure observational and the findings hypothesis-generating.
• When Context Gets Root: Privilege Escalation in LLM Harnesses — Xingbang He, Yuanwei Chen, Yi Qian, Haiyang Wei, et al. — harnesses assemble each model call’s context and can elevate low-privilege content to instruction level, defeating model-side instruction hierarchy; thirteen attack objectives across six coding-agent harnesses, all thirteen succeeding on all six under unrestricted action execution. The paper-shaped version of the fortnight’s three disclosures.
• How Coding Agents Fail Their Users: A Large-Scale Analysis of Developer-Agent Misalignment in 20,574 Real-World Sessions — Ningzhi Tang, Chaoran Chen, Gelei Xu, Yiyu Shi, et al. — misalignment operationalised as developer pushback across 1,639 repositories; 90.50% of episodes cost effort and trust rather than causing irreversible damage, yet 91.49% of visible resolutions still needed explicit user correction.
• Harmless Yet Harmful: Neutral Prompting Attacks for Stealthy Hallucination Steering in Agent Skills — Chia-Yi Hsu, Chia-Mu Yu, Chun-Ying Huang, Jun Sakuma — benign-sounding skill instructions raise an agent’s package-hallucination rate without naming any package; the attacker then registers whatever gets hallucinated. The llms.txt story from the other direction.
• EVOMAL: Self-Poisoning in Self-Evolving Coding Agents — Xiaodong Wu, Yu Shi, Qi Li, Zhimin Zhao, et al. — agents that author skills by imitating retrieved ones reproduce a planted skill’s payload, and each copy re-enters the library to be imitated again: a worm that outlives removal of the original.
• Can escalation channels redirect reward hacking toward defect disclosure? — Francesca Gomez — a structured reporting tool at the point of conflict with defective test infrastructure, plus an anti-reward-hacking policy, cuts reward hacking from 23.6% to 5.3% across eight frontier models in five families. Directly relevant to Anthropic’s account above of environments that rewarded cheating.
• The reach of a verification tool decides its value: A controlled study of verification surface, artifact quality, and cost in AI coding agents — Achint Mehta — across 1,116 web apps, six models, and blind human grading, roughly one build in seven fails to launch without tools, and a single boot probe removes nearly all of those at about 35% of a full shell’s token cost.
• The Handoff Tax: Continuing Non-Native Trajectories in LLM Agents — Roy Ganz, Mor Shpigel Nacson, Adi Kalyanpur, Ron Litman — escalating a full trajectory from a cheap model to a strong one recovers less than half the quality gap at a substantial cost premium. A separate paper, Handoff Debt (Dipesh KC, Anjila Budathoki), finds context-bearing handoffs cut median agent events 20–59% against a repo-state-only takeover.
• Requirements After the First Edit: Mining Late Requirement Emergence and Rework in Real-World Coding-Agent Sessions — Bowen Jiang, Haowei Cheng, Yuhong Fu, Anne Koziolek, et al. — in 3,553 sessions, a requirement arriving after implementation invalidates roughly twice as many prior agent-authored lines as a matched non-requirement edit. Empirical support for landing requirements before code.
• Anchoring Bias in LLM-as-a-Judge Systems: Prior Scores Compromise Evaluation Independence — Ante Kapetanovic, Kemal Altwlkany, Andro Mercep, Tomislav Duricic, et al. — prior scores passed as metadata anchor judge ratings toward their values in seven of eight models across 185,271 evaluations. Anyone running a review model against a scored draft should read it.

Ecosystem Watch

• Kiro Web and cloud sessions reach GA — the cloud sessions Edition 26 noted in preview are generally available: a session started from CLI or IDE runs the same harness in a cloud sandbox, survives a closed laptop, and resumes from browser, editor, terminal, or phone, on shared plan credits with no separate compute charge. CLI 2.21 adds a session dashboard and cloud sync, and OpenTelemetry usage-metric export landed the same day.
• Nvidia agrees to buy Hugging Face for $13 billion — announced September 3, per Ars; Nvidia hopes to close by 2027 and expects competition-regulator scrutiny, and says Hugging Face stays open. If it closes, the model registry most agent stacks pull from belongs to the GPU vendor.
• Copilot code review reaches Azure Repos, billed per review — Microsoft opened it to all Azure DevOps customers after acknowledging many are not ready to migrate to GitHub; usage bills through the linked Azure subscription, with cost reporting 48 hours behind.
• Cloudflare adds optional OAuth scopes — client owners can mark scopes users may decline at consent time, with MCP servers as the stated motivation: agents request the union of everything they might do, and partial consent lets the user grant less.
• Anthropic’s consumer surfaces, in one week — Claude in Chrome went GA and Cowork got a built-in browser on August 26, and memory now works across surfaces with user control over its contents as of August 25. Announcements only; detail beyond the headlines is thin here.
• Four major AI models suffered overlapping downtime — ChatGPT, Claude, Grok, and Gemini had near-simultaneous interruptions on September 3, which Ars reconstructs from the vendors’ status pages and StatusGator data. For anyone running unattended multi-day agent jobs, the correlated outage is the planning input.
• AWS DevOps Agent, five posts in ten days — with Kiro and Dynatrace Bluebox, EKS MTTR with a Kubernetes operator, planned lifecycle upgrades, the experimentation lifecycle with LaunchDarkly, and DMS migration issues. A vendor putting an operations agent in front of every runbook it can find.
• OpenAI pledges $1 billion to bring frontier AI to critical-infrastructure defenders — the Daybreak programme, per SecurityWeek; read beside Anthropic’s Enterprise Frontier Safeguards above as the two labs’ competing defensive-posture offers.

The Long View

Two weeks ago the argument was whether the harness is a depreciating asset — whether the model absorbs it faster than teams can build it. This fortnight answered a different question: whatever the harness is worth, it is where both the gains and the exploits now live.

On the gains side the evidence is unusually clean. Sydney Lewis held the model and the task fixed, changed only how the harness manages context, and raised the mean fail-to-pass fraction from 28% to 49% and complete solutions from 43 to 72. GitHub’s HydraFusion cut cost by two-thirds on one benchmark by routing between execution patterns rather than by changing any model. The Compaction Cliff paper showed that the harness’s summarisation policy decides whether a safety rule survives five rounds or evaporates. None of that is model capability. All of it is the layer around the model.

On the exploits side, GitSpawn, the auto-mode break, and the llms.txt packages share a structure the When Context Gets Root paper names directly: the harness assembles what the model sees and what the model’s actions touch, and it grants that material a trust level the model never chose. A Git config, a zip archive, and a first-party documentation file were all setup material. Nobody injected an instruction. The harness treated the environment as trusted, and the environment was not.

That is why Beyond Zero reads as the fortnight’s most consequential document even though Google calls it incomplete. Its premise is that the application stopped being the right trust boundary when the accessor stopped being human. The harness stopped being the right trust boundary for the same reason: it is the thing being attacked. Per-action authorization enforced outside the agent, which Google, AWS, and the Five Primitives paper each describe, is the architecture that still holds when the harness itself is compromised.

The harness-absorption scout argued that what survives absorption is the part that governs. Two weeks of disclosures suggest that part is not optional, because it is the part that has to stand outside the blast radius.

The Artificer’s Grimoire — weekly intelligence on harness engineering for agentic systems — a practitioner’s field guide, by Tim Schiller (Artificer Digital).