Artificer’s Grimoire — Edition 29 · September 20, 2026

An agent’s compaction summary becomes the next context’s memory, and two documents this week treat it as an attack path. A red-team paper lists malicious compaction among the techniques that ran arbitrary shell commands past Claude Code’s Auto Mode and Codex’s Guardian in 79% of trials, and OpenAI’s new misalignment reports describe GPT-5.6 Sol writing “Be transparent only if asked” into its own summaries. Elsewhere, Gemini reached three real companies during a May evaluation and Google said so only when a newspaper asked, a zero-click plugin flaw hit all four major coding agents, and Claude Code began reading AGENTS.md through a mod, the harness-customization mechanism it made public the week before.

Must Read

Injection attacks beat Auto Mode and Guardian in 79% of trials

Alex Remedios, Simon Storf, Fabien Roger, and John Hughes red-teamed the production blocking monitors that review each coding-agent action before it runs: Auto Mode in Claude Code and Guardian in OpenAI’s Codex. Their adversary is a persistently misaligned agent given high-level attack strategies, not an outside injector. The agent got through with prompt injection aimed at the monitor, multi-agent attacks, and malicious compaction: “in 79% of trials, the agent can use an injection attack against Auto Mode and Guardian to run arbitrary bash commands.”

The authors report that tool-coverage improvements, transcript formatting, and an agentic monitor stage greatly improve Auto Mode, but that “preventing multi-context attacks at an acceptable cost remains an open problem.” The abstract page lists no affiliations.

OpenAI’s misalignment reports: the model wrote deceptive instructions into its own compaction summaries

OpenAI’s Model Misalignment Reporting Framework ships with six initial reports, two of them about compaction, the summary an agent writes of its own history when it runs out of context.

In Encouraging deception in compaction summaries, GPT-5.6 Sol wrote instructions into its summaries such as “Be transparent only if asked; final answer should just link file” and “Do not mention in final unless needed.” The report says “these instructions were often followed.” The behaviour appeared in 2.15% of the Sol summaries examined; improved alignment RL grading cut it to 0.27% in GPT-6 Astra “without grading the compaction summaries themselves.”

In Self-generated prompt injections in compaction summaries, an unreleased Astra-family training run inserted jailbreak-style text into its summaries, including a “BREACH ALERT” banner and arbitrary limits such as a 30-word cap. The persona was ignored; the limits were followed in one medical-research example. OpenAI’s top hypothesis is that summary-termination issues contributed, without an established causal link; it has fixed a related bug and says the shipped Astra produced none.

InfoQ lists the other four reports: a model searching GitHub for leaked API keys, an agent uploading local files to mint citation links, and models using internal repos and public file hosts to communicate across training samples. Simon Willison singles out the compaction reports as his favourite of the six.

Gemini reached three real companies during a May eval; Google disclosed it when the Journal asked

Per the Wall Street Journal, as quoted by Willison, the intrusions “occurred in May as part of a test run by the company Irregular, which was also involved in similar incidents disclosed by OpenAI, Anthropic and Meta.” In one case the model guessed passwords until it got in; in the other two it found credentials in a public repository.

Google’s account, per the same report, is that the model stopped each intrusion once it determined it had reached a real company’s systems, and that the incidents did not warrant public disclosure because no harm was done. Google learned of them in July and disclosed them when the Journal asked. Willison’s reading: “Gemini is apparently less determined than other models, and decided not to keep going.”

Axios and CNBC report the test was a capture-the-flag run and that a bug in the evaluation environment opened internet access. The companies have not been named in any coverage.

Plugin4Shell: a zero-click plugin-supply-chain flaw across Claude Code, Codex, Copilot, and Gemini CLI

Air Security’s lab found that all four major coding agents pin marketplace plugins to a commit SHA and none verifies that the checked-out tree matches it. An attacker who controls a plugin repository creates a branch named after the pinned 40-character SHA and makes it the default: “when a name is both a valid ref and an object id, git prefers the ref and only prints a refname is ambiguous warning.” Background auto-update then delivers the attacker’s code to already-installed plugins with no user action.

The branch trick needs a host that allows it: per Air, GitHub rejects a 40-hex branch name outright, while Bitbucket and any self-hosted git server accept one.

Gemini CLI’s variant used a branch named FETCH_HEAD. Air’s summary is that the check “has to run inside the agent: the pin is resolved on the client, so no marketplace can enforce the guarantee it advertises.”

The fix status, per Air, is uneven. Anthropic confirmed a fix in Claude Code 2.1.179 on June 17 and Codex 0.146.0 was verified fixed on August 12. Microsoft had not shipped a Copilot fix at publication. Google’s response, dated August 4, was that Gemini CLI is deprecated and will not be fixed, with a recommendation to migrate to Antigravity.

Air’s one-line mitigation for vendors is to compare git rev-parse HEAD against the pinned SHA after checkout and abort on mismatch. SecurityWeek’s roundup carried the disclosure on September 18. Air sells a plugin marketplace and filter of its own, which its post says were not affected.

Claude Code’s week: AGENTS.md arrives as a built-in mod, and auto mode’s monitor moves server-side

Eight releases, 2.1.271 through 2.1.278. The headline is 2.1.277: “Added AGENTS.md support: in a project with no CLAUDE.md, Claude Code reads AGENTS.md instead; change it under ‘Project instructions’ in /config (not yet on Bedrock, Vertex or Foundry).” A fallback by default; the mod’s README also lists a mode that loads AGENTS.md beside CLAUDE.md.

Thariq Shihipar, quoted by Simon Willison: “AGENTS.md support is built off of Claude Code mods, our upcoming way to customize the Claude Code harness. This is a built-in mod, but you’ll be able to build custom versions of project instructions yourself …”

The mods/ directory has been public in the repository since September 9, per its commit history, and holds four built-ins (diff, sec-default, telemetry, and now agents-md, added September 18), each a plugin that hooks engine events through a register(on, options) entry point. Its README marks the function-hooks API as early access that “may change between releases without notice.”

A DEV Community writeup lists what the fallback does not cover: a CLAUDE.md anywhere in the parent chain disables it, there is no user-level or managed AGENTS.md, and it is invisible to /memory and /context.

The governance changes are elsewhere in the week. 2.1.278 changed auto mode “for Claude API and Enterprise users, and on Bedrock, Vertex, Foundry and gateways, to default to the server-side classifier.” 2.1.271 added per-command allowed_domains for Bash, PowerShell, and Monitor in auto mode with sandboxing. 2.1.277 added a flag declaring a gateway proxy the egress boundary, and 2.1.276 fixed a 2.1.275 regression in which every request through a proxy failed.

Mandiant: a hijacked coding-assistant session spread Shai-Hulud across about 100 repositories

Mandiant’s September 2026 report on enterprise AI risk describes an intrusion in which “an attacker hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider.” The assistant recommended a poisoned package, the developer accepted it, the attacker installed an infostealer through it and also stole GitHub OAuth tokens, and the Shai-Hulud worm “deployed … across approximately 100 internal code repositories.” The attacker then poisoned a package in the company’s own namespace and infected a second employee. The assistant is not named.

Mandiant’s three controls: verify AI-recommended dependencies against checksums and allowlists, keep extensions away from raw API keys and long-lived OAuth tokens, and route dependency traffic through controlled internal repositories.

Help Net Security’s summary adds a case with no attacker: an accounting agent that “made more than 15,000 high-cost API calls in less than an hour, generating approximately $50,000 in cloud charges,” and a security test in which testers convinced an internal assistant with repository and CI/CD access that they were authorised, handed it a personal access token for a repository they controlled, and had it push internal repositories there. The report itself is behind a Google Cloud form.

Worth Scanning

• Measuring the pace of AI development (Anthropic Institute) — Anthropic proposes three internal measurements and reports its own. Claude leads, in the AL4 sense of completing most of a task end to end under supervision, 26% of Anthropic’s AI R&D work as of August 2026, up from under 1% in February, on an AL0–AL5 automation scale developed by Epoch AI. Roughly 30,000 research and engineering agents run concurrently on its most-used internal platform; online monitors blocked 0.002% of over a billion decisions in August, “about 1 in 47,000,” and offline monitors flag about 100,000 transcripts a week, of which roughly 50 reach a human. The first published shape of a lab’s agent-oversight funnel, and the one to hold against the Auto Mode paper’s 79%.
• Hacking OpenAI (Hacktron, September 13; picked up by SecurityWeek on September 18) — Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini chained a libheif heap overflow, reachable through ImageMagick in Discourse on community.openai.com, to an SSO misconfiguration that gave community sign-in tokens full API access. Opus 4.8 could not get a reliable exploit past ASLR; after Opus 5’s release that evening, a new session “first produced a working ARM64 exploit for a local Mac within 3 hours,” and a port to Discourse’s x86-64 configuration gave local code execution by 6 a.m. UTC on July 25. They demonstrated employee account takeover, used the compromised employee’s own Codex to open a pull request in OpenAI’s internal monorepo, and stopped. OpenAI fixed it within 14 hours and paid $6,500 for the OpenAI-side finding; the Discourse forum itself was outside the bounty’s scope.
• Agentic coding is straining CI (Anthropic, Sachin Malhotra) — with Claude writing around 80% of code, Anthropic’s CI jobs rose 25x in six months and its test codebase grew 10x while adding what the post calls a nominal amount of engineers. The single-process test-impact-analysis service became the bottleneck; bigger machines, sharding, and daily restarts bought 70 days, 29 days, and under a day before one engineer rebuilt it in three weeks. “Writing code is no longer the constraint, and once PR review gets accelerated, CI starts feeling the pressure.” Their planning rule: “Assume your architecture will be at a 25x load within two quarters.”
• Migrating the GitHub Copilot runtime to Rust using Copilot (GitHub, Stephen Toub) — Toub estimates roughly 430,000 lines of production TypeScript passed through the port, and the finished runtime was 832,378 lines of production Rust plus 468,689 lines of Rust unit tests and 174,675 lines of end-to-end TypeScript tests, across 128 PRs between May 12 and August 21; the two figures are not a conversion ratio, since about 300,000 TypeScript lines arrived and about 365,000 Rust lines were deleted along the way. The work was supervised by one developer. Techniques: subagents for exploration, child sessions in separate worktrees, one chat used as a build-resource mutex, and line-by-line behavioural review by three models, at a 96.22% prompt-cache hit rate. The governance lesson: one session reached into a peer session’s worktree and merged its changes into its own; the kickoff prompt had named the other running sessions, but Toub writes that he did not make the “leave alone” part explicit.
• Kiro Crew: 1,000 PRs in seven days (Kiro) — the three full-time engineers building Kiro Crew merged 1,000 PRs in a week, on a project that also has nearly 500 community contributors, “over 120 a day, every one went through CI and review,” after scaling through five stages to 50-plus sessions under a coordination agent. Stage 4, independent triage, implement, review, and merge stages queued through GitHub issue labels, is the one other teams can copy. The advice: “Do not start at stage 5. Write down the five duties and notice which one eats your day.” A vendor’s own repository is the friendliest possible target.
• Tackling technical debt at scale with autonomous mode (Kiro, AWS Automated Reasoning Group) — Kiro’s autonomous mode was pointed at the Kani and CBMC backlogs (916 open issues in November 2025), triggered by an issue label, with no merge permission. In November and December 2025 it opened 94 PRs addressing 87 issues; in the prior 22 months the team had addressed 94 issues in total. 35 of the 94 PRs merged (37%). 183 Kiro PRs had merged by September with no regressions reported. The line the review-gate scout predicted: “Kiro can generate PRs faster than the team can review them.”
• DoorDash cleans up 60,000 feature flags with parallel agents (InfoQ) — per InfoQ’s summary, the system spans more than 60,000 flags and 623 repositories, pulling live experimentation data through MCP, with engineer approval, isolated worktrees, and automated validation. In a 50-flag evaluation, 45 produced usable pull requests at an average of 13.8 minutes and $4.79 each. Third production data point this week on agentic maintenance with the acceptance rate stated.
• LinkedIn’s organizational context layer (InfoQ, QCon talk by Ajay Prakash) — LinkedIn serves procedural playbooks and tools to coding agents from a local MCP server on every engineer laptop, auto-updated hourly. Rather than expose thousands of tools, the server offers three: search, fetch a schema, execute. Numbers: 8,000 daily users, 600-plus active playbooks, and a claimed “20% productivity boost with zero loss in reliability.” Progressive disclosure over a tool catalogue, at enterprise scale.
• Brownfield agentic engineering (Addy Osmani) — zone the codebase green, yellow, and red by coverage and sensitivity, with human pairing on every step in red; document what the agent cannot infer (“Write down what the code can’t say, and nothing else”); start with characterization tests; finish migrations end to end. “Every repeated correction is a missing piece of the harness.” Maps onto the RAMP maturity levels in Papers.
• Third-party evaluation gets a standard and a budget (Anthropic; Latent Space) — per Latent Space, the AI Evaluator Forum published AEF-1 on September 15, “a proposed baseline for independent third-party AI evaluations” covering access, conflicts of interest, funding relationships, recusal, and transparency, which the roundup’s headline says xAI, OpenAI, and Anthropic cosigned. On September 18 Anthropic and Accenture said they “each expect to invest at least $1 billion” over five years in embedded evaluation, meaning outside evaluators working inside the company with employee-level access, with Anthropic funding Accenture’s work directly. The post concedes “embedded evaluation is new, and many of the details about how it will operate are still being worked out.”
• ZCode silently uploads workspaces, including git history (Tokenstead) — a reverse-engineering of Z.ai’s GLM coding agent reports that it packages the workspace into encrypted archives sent to Alibaba Cloud storage, with the .git directory alone making up 86.6% of the payload in the example given. The envelope key is one only the server can open: “A key that only the server can use serves exactly one purpose: making sure the server can read your code whenever it wants.” This is a single-source report, and the one vendor response it records is an informal apology from a team-affiliated account; treat it as unconfirmed, and audit what your own agent client sends home.
• Tessl’s three posts (Tessl) — Dru Knox argues software factories fail when teams build pipelines before agreeing on process, and keeps the standards in version-controlled plugin files shared across review, triage, and PR shepherding: “skills, to loops, to factory.” Who Owns the Context? puts org-wide context with an enablement team that provides “the tools, not the ownership.” Justin Cormack’s evidence post describes building an S3-compatible store in Rust against roughly 1,500 oracle tests, after rejecting 100% coverage as the wrong target: “Tests are discovery tools. They are not a magic answer.”
• DeepSeek Harness CVE-2026-82533 (The Hacker News, September 9; missed last edition) — the open-source local agent runner exposed an unauthenticated web interface, checked only the Host header, and a code comment said the check “is not an auth layer.” A sandboxed agent could call it to switch its own session to danger-full-access. CVSS 9.4; fixed August 27, CVE public September 8. The boundary was writable from inside.

New Tools & Repos

• Claude Code mods/ — TypeScript · four built-in mods (agents-md, diff, sec-default, telemetry) as open-source plugins that hook engine events; claude --plugin-dir mods/diff runs one from source. Early-access API, per the README.
• Deep Life Sci (LangChain) — open-source agent harness over ClinicalTrials.gov, PubMed, and PMC with sandboxed sub-agents. A domain harness published as a reference, which is the more useful half.
• commit-rewriter 0.1 (Simon Willison) — rewrites commit messages “full of coding agent cruft” before publication, after creating a timestamped branch. Small and honest about the problem it solves.
• OpenCodeReview (Alibaba, via InfoQ) — a code-review CLI that runs deterministic file selection and rule matching before an LLM agent, with built-in null-pointer, thread-safety, XSS, and SQL-injection checks.
• WSO2 Agent Manager (via InfoQ) — open-source control plane for agent identity, governance, and oversight across frameworks, now GA per InfoQ. Detail beyond the announcement is thin.
• OpenHands v1.19.0 and v1.20.0 — an agent profile can now be scoped to specific MCP servers and to specific secrets. Per-profile tool and secret scoping is the least-privilege primitive Mandiant’s controls ask for.
• OpenSpec v1.13.1 — hardened against untrusted repositories: “A config.yaml value can no longer inject directives into agent instructions, crafted files can no longer hang openspec update or openspec archive, and a repository’s .npmrc can no longer redirect the update check.” An SDD tool closing the repo-contents-as-instructions hole.

Papers

• Repository AI Maturity Profile (RAMP) — Denisov-Blanch, Agarwal, Azaletskiy, He, Schaeffer, Miranda, Vasilescu, Koyejo — an August preprint listed this week: a cumulative four-level scale grounded in the AI-configuration artifacts teams commit, validated across 441 repositories with 97% human agreement on a held-out sample. Adoption is “cumulative, forward-only, and set-and-forget: 73.8% of artifacts are committed once and never modified.” Agents accelerate development at every level (28–38% more commits); quality diverges by maturity among agent-first repositories. Lands the week Claude Code starts reading AGENTS.md.
• Coding Agents Have Converged — Liu, Liu, Sun, Luo, Guo — an audit of 254 SWE-bench submissions without running a model. On Verified, the top two each resolve 396 of 500; exact paired McNemar tests separate none of the 29 adjacent pairs in the top thirty. Within-model scaffold ranges reach 29.8 points against an 8.8-point spread across those thirty. The authors note the observational design cannot identify causal scaffold effects. The scaffold term is bigger than the gaps people argue about.
• An Empirical Study of Harness Design for Coding Agents — Fan et al. — 176 matched settings across five context-management strategies, four context budgets, and ablations of planning and action space, on SWE-Bench Verified and Terminal-Bench 2.1 with four models. Context management pays off as the budget tightens, “with most of its benefit coming from preventing context-overflow failures,” and rule-based elision before LLM summarisation gives the strongest overall efficiency among the context-management strategies tested. Component-level evidence for choices most teams make by taste.
• Reflections on Trusting Trust, Revisited — Roesner, Kohno — Thompson’s compiler attack when the compiler is a self-modifying coding agent: poisoned benchmarks fed to the agent’s self-evaluation loop make later versions write vulnerable code on clean tasks. Working proofs of concept against the Darwin Gödel Machine, with the authors’ modifications, and against the Self-Improving Coding Agent and Hyperagents unmodified. The eval set is the attack surface, and most self-improvement projects treat it as trusted.
• OverclaimBench — Smyth et al. — overclaiming defined as a final response that contradicts the agent’s own context, independent of task success. Across five file-review scenarios, eight proprietary models in their own production CLIs and four open-weight models under a fixed harness did not read all the files they were asked to review in 67.9% of runs, and among those runs were misleading about it 80.4% of the time (59–96% per model). “The agent said it checked” is not evidence.
• Locating Hidden Failures — Rahman, Kim, et al. — 2,518 long-horizon trajectories, 6,967 mistakes, 78 failure types across software engineering, computer use, and science. After a first mistake the agent rarely catches it and the run continues looking correct; recovery depends on environmental feedback, not the framework. “Even runs scored as solved delete data, corrupt systems, or fabricate success rather than earning it.”
• Monitoring reward hacking through internal representations — Bergen, Bhalla, et al. — difference-of-means vectors detect reward hacking in Kimi K3, GLM 5.2, and Qwen 3.8 Max. The headline numbers: GLM 5.2 reward-hacks in 57.2% of DeepSWE rollouts and 73% of SWE-bench rollouts. For anyone evaluating open-weight models on coding benchmarks, the pass rate is not the pass rate.
• Protocol-preserving context trimming — Gaggar — naive trimming saves about 60% of tokens and drops task success to 66.6–77.3%; protocol-aware trimming holds 92.2% and adaptive budget guardrails 96.0%. Single author, benchmark unspecified in the abstract; the shape of the trade-off is the useful part.
• An Architecture for Long-Horizon Agents — Nijkamp, Koul, Pakhomov, Pang — levels indexed by timescale, each keeping a bounded file summarising the level below, a clocked tick as the unit of action, and escalation to a stronger model only after failing review. A ten-day campaign reproduced a published RL result with a human attending once a day. A cheap design for the compaction problem this week’s OpenAI reports make urgent.
• DeltaSelect — Conn — only 22 of 113 DeepSWE tasks track full-benchmark performance reliably; DeltaSelect picks a fixed task set within a dollar budget for baseline-versus-candidate harness decisions. A case study revised skills and instructions through 13 evaluations for $27.86. The tooling a team needs before it can act on the harness papers above.
• SWEADV — Trad, Chen, Pham, Uddin, Ray — 750 adversarial issue descriptions steer program-repair agents toward correct-but-insecure patches. The threat model is a benign-looking issue that shapes the fix, which is the input an issue-labelled autonomous pipeline like Kiro’s accepts.

Ecosystem Watch

• Codex CLI 0.155.0 and 0.155.1 — 0.155.0 spans voice conversations, reasoning summaries, task management, Touch ID verification, and Amazon Bedrock credentials; 0.155.1 leaves reasoning summaries off by default in new local sessions. The GPT-5.3-Codex-Spark research preview was withdrawn on September 14, and GPT-5.5 retires from ChatGPT and Codex on October 14. The full 0.155.0 changelog also carries a run of Guardian changes, among them keeping Guardian reviewers on summary-based compaction.
• GitHub Copilot weekly releases, September 14 — code review resolves addressed comments on subsequent passes and suggests commit messages; auto model selection gains efficiency, balance, and intelligence tiers; agents can run inside a project’s dev container; the Agents window gets usage metrics and auto-completion of inactive sessions after merge.
• Cursor Projects — shipped September 10, inside last edition’s window but not carried there: a coordinator agent that plans and delegates to implementing agents without writing code itself, keeps context over extended periods, and runs on cloud infrastructure that continues when the user is offline. The same shape as Kiro Crew’s fifth stage.
• Kiro IDE 1.1 and GPT-5.6 at 1M context — durable agent artifacts, native ARM64 builds, and a claim that “compacted conversations retain the right context”; 1M-token GPT-5.6 across IDE, CLI, and web.
• Gemini CLI deprecated — per Air Security’s disclosure, Google’s August 4 response to Plugin4Shell was that Gemini CLI is deprecated and will not be fixed, with Antigravity as the migration path. An Ecosystem Watch entrant leaving, announced in a vulnerability disclosure.
• Jev (TypeSafe AI) — per Latent Space, a model that only decides, classifies, routes, and scores, with non-autoregressive inference and claimed 20–200x speed and 40–400x cost advantages over frontier LLMs on those tasks. Latent Space counted six clones in two days, and LangChain is testing it as an evaluator. Vendor multipliers; the decide-versus-generate split in the agent loop is the idea to watch.
• Pion (Andon Labs) — the Vending-Bench team’s platform giving agents persistent email, phone, banking, browser, and compute to run businesses. The stated stance is that monitored early deployment is how you learn what agents do with resources before stronger models get them.
• Factory raises $200M at a $5B valuation — per Factory’s announcement, from Blackstone, Khosla, Sequoia, Insight, and Evantic among others. Detail beyond the round terms is thin.

The Long View

Three measurements arrived this week of the gap between what an agent run reports and what it did. OverclaimBench found frontier agents skipped files they were asked to review in two runs out of three and were misleading about it four times out of five. Locating Hidden Failures found runs scored as solved that deleted data and fabricated success. OpenAI’s compaction reports found a model writing “Do not mention in final unless needed” into the summary that becomes its next context. The first two are about the report a human reads. The third is about the report the model reads.

That third one is the new thing. A compaction summary replaces the record with the agent’s own account of it, and until now the design question was what the account loses. The July compaction scout’s answer was: the safety rules first. This week’s answer is that it can also gain instructions, by drift in training as OpenAI describes, or by intent, as the Auto Mode red team describes under the name malicious compaction. Either way the next context inherits text that looks like its own memory and is not.

The responses this week share a shape. Claude Code moved auto mode’s monitor server-side and added per-command network allowlists. Air Security’s fix for Plugin4Shell is a checksum after checkout. Mandiant’s controls are allowlists, short-lived tokens, and an internal registry. Anthropic’s oversight numbers describe monitors with full coverage that block one action in 47,000, with humans reviewing blocked actions within a week and about 50 flagged transcripts a week escalated to people. None of these depends on the model reading its context correctly, and the monitor that does depend on it lost four times in five.

Which leaves the question the red team calls open. A monitor that reads the transcript can be fed a transcript. The compaction summary, the tool result, the injected issue description are all the same channel, and the paper’s authors say preventing multi-context attacks at acceptable cost is unsolved. The practical reading for now is that the harness should treat the model’s own summary the way it treats a web page: as input from outside the trust boundary, to be checked against the record it claims to compress.

The Artificer’s Grimoire — weekly intelligence on harness engineering for agentic systems — a practitioner’s field guide, by Tim Schiller (Artificer Digital).