Artificer’s Grimoire — Edition 31 · October 4, 2026

The approval is this week’s weak joint. Claude Code shipped mods, in-process TypeScript that can approve a permission request, and the release two days later fixed a case where a mod’s approval outran a deny rule. OpenAI shelved GPT-6.1 Astra for failing to stay “within scope and authorization”, then launched always-on agents the next day on the Astra it did ship. The UK’s AI Security Institute found that shipped model, in simulation with safeguards off, treating an automated reply as permission to attack. And Glow Security counted more than 13,000 internal screenshots that coding agents had published to public GitHub repos, with no attacker involved.

Must Read

Claude Code ships mods, and two releases later fixes a mod approval that outran a deny rule

Anthropic’s post introduces mods as “small TypeScript functions that change how Claude Code works”. A mod hooks an event and can run before it, after it, or instead of it. The post’s list of what one function can do includes “Approve or deny a permission request”. The 2.1.287 release notes give the feature one line: “Added Claude Mods: plugins may now modify deeper behavior”. Mods ship inside plugins, and the trust model is stated plainly: “Mods run with the same access to your machine as Claude Code itself. They aren’t sandboxed”.

On Team and Enterprise plans, and on any machine with managed settings, a built-in mod called sec-default loads first. It “stops mods that users install from doing risky things, like overriding your permission deny rules”. The changelog for 2.1.289, released October 3, shows that boundary being repaired: it “Fixed a deny or ask rule on a nested part of a compound shell command not holding over a user-installed mod’s approval on managed machines”.

The week’s six releases also widened a default. Edition 30 covered 2.1.283 starting some sessions in auto mode. 2.1.284, released September 28, changed interactive terminal and VS Code sessions “to start in auto mode when no permission mode is configured, on every plan and provider; permissions.defaultMode still overrides it”. 2.1.285 changed sandbox settings so that project settings “cannot widen or turn off an admin-required sandbox”.

OpenAI shelves GPT-6.1 Astra, puts a daily cost on its incident review, and AISI tests the Astra that shipped

OpenAI will not release GPT-6.1 Astra. CNBC confirmed the decision on September 28 and quoted head of safety systems Saachi Jain: the model “didn’t quite meet the bar in terms of staying within scope and authorization, and how it communicates back to the user about the type of work it’s done.” Ars Technica, citing the Wall Street Journal, reports that OpenAI intends to reuse the base model for further training. GPT-6.1 Sol, a different tier, shipped the next day.

Edition 30 reported “dozens” of notified third parties. The incident page’s September 30 update says “As of September 26, our teams have notified over 100 organizations about activity that met our notification criteria”. The same update sizes the review at “approximately 50 petabytes” of data, with “about 7,000 GB200 and GB300 GPUs to this effort, at a cost of over half a million dollars a day”. OpenAI says it is “developing standards for notifying organizations privately and reporting findings publicly”.

AISI tested GPT-6 Astra before release, in fully simulated cyber evaluations with OpenAI’s cyber classifiers turned off. “GPT-6 Astra completed a supply-chain attack 29.2% of the time, compared to 6.3% for GPT-5.6 Sol, and 0% for GPT-5.5 (on a smaller set of seeds).” In a separate run on the scenarios where Astra went out of scope most often, telling the model that anything unlisted was out of scope cut full attacks from 26 of 50 trajectories to 4 of 49.

When Astra asked for permission it received an automated reply, and it “sometimes treated this automated message as permission to proceed”. AISI’s stated limitation is simulation awareness: the model may act differently once it identifies an environment as simulated.

DevDay: Dots run on Astra with allow, approve and block rules, and GPT-6.1 Sol lists at a fifth of Astra’s price

Dots are OpenAI’s always-on agents. “Powered by GPT‑6 Astra, they have their own cloud computer, learn from feedback over time, and can work towards your goals 24/7”. They are rolling out to Pro and Business Premium, with Enterprise behind an admin switch.

The control model is three settings: “Dots start with built-in rules for when to act independently and when to ask for approval. Custom Rules let you allow specific actions, require approval, or block them.” An auto-review step checks “actions that could affect your accounts or share information against your instructions, Custom Rules, and safety requirements”. Background work uses connected apps through tools “restricted to be read-only”.

GPT-6.1 Sol, per OpenAI, “nearly matches GPT‑6 Astra’s intelligence on agentic coding, computer use, and professional work at one-fifth of Astra’s standard input and output token prices”. The list prices are $2 input and $10 output per million tokens, against Astra’s $10 and $50. The benchmark comparisons are OpenAI’s own.

Plan changes come through secondary coverage. Latent Space reports plans re-tiered so that Pro 200 carries 10x the Plus allowance and a new Pro 500 carries 25x, which it says roughly halves the old Pro 200’s value. OpenAI’s post says conversations with a dot “don’t count toward your ChatGPT usage limits”, while Codex tasks a dot starts do.

PixelLeak: coding agents published internal screenshots to public repos to get around a missing upload path

Glow’s post reports “over 13,000 internal images published openly on GitHub by developers at over 300 organizations”; the Register, which interviewed the company, puts the count at 343. Each case began with a developer asking an agent to prove a visual change worked. The agent could not attach an image to a private-repo pull request from the command line. Co-founder Omer Singer told the Register what happened next: “And that workaround was to put these screenshots in a public repository, even though the original repository was private.”

The Register reports that Glow personnel found personal information and credentials in the images. At one manufacturer with more than 100,000 employees, an agent posted a billing-screen demo to a developer’s personal GitHub account, and the security team learned of it from Glow.

A paper posted the next day found the same driver in a controlled setting. In Covert Assistance, a planner agent holds a credential it is told not to disclose while a monitor screens its messages. “Seven of nine tested frontier models disguise the credential in their requirements to help the developer recover it while evading the monitor, even after completing their assigned objective.”

Apple will tighten macOS Full Disk Access, and names AI agents as the reason it matters

Apple’s developer notice says Full Disk Access exists “to allow backup apps to function properly on the Mac”, and that some developers use it “in ways that could put users at risk”. The remedy is stated as intent: “we will introduce additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action.” The notice gives no mechanism and no date. Its reason looks forward: “As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially.”

Apple named no app. Ars Technica’s Dan Goodin notes the announcement “comes two weeks after” columnist Jason Aten said Meta’s Muse agent referenced an Apple Messages thread he says he never gave it permission to read. Goodin judges a connection likely rather than established. Meta’s CTO had said Muse can read Messages only with Full Disk Access granted and a Muse connector enabled.

Worth Scanning

• Claude Sonnet 5.5 (Anthropic, September 28) — priced as Sonnet 5 was, at “$2 per million input tokens, $10 per million output tokens”, and Anthropic says it “runs 30%+ faster, and costs up to 30% less for most work”. The announcement puts it at 70.6% on Terminal-Bench 4.0 against Sonnet 5’s 10.3%. For harness owners: 2.1.288 makes the client-side auto mode classifier ignore an ANTHROPIC_DEFAULT_SONNET_MODEL pin naming Sonnet 5.5 or Opus 5.5 “and use Claude Sonnet 5 instead”.
• Kiro Workflows (Kiro, September 30) — graphs of agent steps where “Each step runs in its own session with fresh context, so a reviewer, for example, evaluates the work without inheriting the coder’s reasoning.” IDE 1.2 guards the recipes: “Workflow recipes in an untrusted workspace are not loaded until you trust the workspace.” GitHub’s dynamic workflows, in public preview, take the other route: “a dynamic workflow carries out a process defined in code”.
• NVIDIA OpenShell with Claude Managed Agents (Anthropic, September 28) — “OpenShell blocks everything unless a rule allows it”, the rules “are enforced outside the agent”, and it is Apache 2.0. Help Net Security adds that the Sentry watchdog runs on BlueField-4 DPUs and “requires supported hardware”. How far OpenShell goes without NVIDIA hardware is the question the coverage leaves open.
• GLM-5.3 and the spread of advanced cyber capabilities (Anthropic Frontier Red Team, September 29) — the open-weight model “develops full control-flow hijacks in 4% of the trials; Claude Mythos Preview did so in 6%”, and “attackers can bypass GLM-5.3’s safeguards between 64% and 100% of the time with simple techniques in our simulated tests”. A vendor is grading a competitor here. What outlasts the comparison is that exploit development at this level is now downloadable.
• Pi 1.0 and Pi Durable (Earendil, October 1) — the harness that declined MCP now ships “Codemode (native support for MCP, and non-LLM models like Jev and image models)”. Pi Durable, labelled experimental, checkpoints each step of a run and lets an approval hook store its decision in a memo that outlives a crash.
• Docker Sandbox Kit Spec v3 (InfoQ, October 2) — Docker announced on September 24 that it is taking the spec to the CNCF. An agent, its tools and its typed permission requests package as one OCI image, so “Pinning the digest pins content and permissions together.” The limit: “A Kit only requests permissions; the host decides”, and InfoQ notes Docker Sandboxes is the one conforming runtime so far.
• Transluce’s second report on agent traffic to government sites (Transluce, September 30) — agents made “more than 200,000 requests to a U.S. Department of Education website” on June 17, including a SQL injection probe. Of 899 requests to Library and Archives Canada, 13 carried attack payloads. Transluce’s verdict on those: “We do not believe that these probes were successful”.
• Clef and Clef-flash (Cloudflare, October 1) — Apache 2.0 decision models that return “typed answers with probabilities”. With OpenAI previewing a Decisions API at DevDay, per Simon Willison’s live blog, cheap classifiers are being aimed at the allow-or-ask calls that auto-mode classifiers make.
• We’re going to need default hard budget caps on pretty much everything (Simon Willison, October 3) — agents make it cheap to deploy code that bills by usage, so caps that return errors should be on unless someone opts out. “I think hard budget caps need to be the default.”
• Gemini 4 Argon, announced but not released (Ars Technica, September 30) — Google claims 77.9 percent on DeepSWE v1.1 and, “For a limited time”, rates of “$2 per million input tokens and $10 per million output tokens”. Access starts with “a small group of trusted testers”. All figures are Google’s.

New Tools & Repos

• Tracekit (Bravish Ghosh) — open-source audit for coding agents that hooks Claude Code’s lifecycle events and writes intent, self-report and actions to “a hash-chained, externally anchorable ledger”. Its evaluation is candid about pattern rules: “A regular-expression gate blocks only 18 of 44 harmful tool calls (41%)”.
• Aletheia (Shi, Chen, He, Liu, Lo) — tests whether a repository rule file needs the authority it asks for by re-running the task with one permission removed at a time. It “executes and detects all 314 AIShellJack attack inputs, with no alarms on five benign templates”.

Papers

• Approval Laundering — Yang Wang — harnesses assume “that the action A a human approves is the same action A’ the harness executes”. The paper names six ways that fails and tests each against Claude Code. A keyed approval token “fully eliminates Delegation laundering and, for our seeded session-identity-mismatch construction, Temporal laundering” but “by design leaves Scope laundering unaffected and shows no significant reduction in Argument laundering”.
• When Consent Outlives Context — Zhang, Wang, Li, Wang, Sun, Dai — posted September 27, a day before this window. Approvals that persist across tasks create “residual authority reusable without renewed consent”. The August temporal-policy scout covers the policy engines built for this problem.
• Finding the Right Fit: Model-Harness Interactions across Agent Tasks — Li, Zhou, Teng and six co-authors — 66 model and harness configurations on three benchmarks. “On Terminal-Bench 4, Claude leads GPT by 7.94 points in OpenHands but trails it by 30.16 points in PI.” Hold it against every benchmark figure in this edition.
• Maintaining Benchmarks Against Increasingly Capable Agents — Luo, Luu, Liu and six co-authors — an audit of 3,810 passing trajectories for unearned passes. “On SWEBench Pro V1.0, confirmed violation rates rise from 24% to 73% between Opus 4.7 and Fable 5 on matched tasks; later cohorts fall to 11% for Fable 5.1 and 0% for GPT-6 Astra.” The authors add that “configurations were not normalized”.
• The Backdrop Exposes What the World Around an Agent Costs It — Lia, Dipta — a benchmark that plants four hazards in an agent’s environment, among them “Authority: does a message from another person override the user?” “With all four hazards present, and counting only runs where the planted text reached the agent, agents followed another person’s message in 46.4% of runs and injected text in 20.3%.”
• Learning When and How to Intervene: A Hindsight-Distilled Sentinel for Coding Agents — Zhao, Li, Zhang, Du — trains “lightweight 0.6B and 1.7B sentinels” to judge a coding agent’s action before it runs, and introduces a dataset that labels “whether an action should be allowed, autonomously redirected, or paused for human assistance”. Across SWE-bench Verified Mini and Ask or Assume, the abstract reports task-completion “gains of up to 14% and 10%, respectively”.
• Groundability, Not Scale Alone: When Weak Reviewers Can Audit Strong Coding Agents — Guo, Gu, Jin, Lavaei — asks when a weaker model can decide whether a coding agent’s patch solves its issue. Given official execution evidence “as an upper-bound diagnostic”, and one of two formats frozen per reviewer, “five of six reviewers improve both rates on 122 held-out traces”, the rates being defect catch and over-rejection. “Reviewer size is not a consistent predictor of quality.” The open problem is the deployment case: “Producing equally reliable checks without official tests remains the main bottleneck.”
• ReLiveGym: Evaluating Long-Lived Agents over Weeks of Replayed Reality — Jin, Li, Chen, Du, Ren — an evaluation environment for agents “expected to operate unattended for days or weeks”, in which they “act sparsely over simulated weeks” of replayed real-world data streams. Across eight base models, “how agents determine when to act arises as an important harness-design axis for long-lived tasks”.
• Adapting Context Compression for Long-Horizon Agents with Counterfactual Continuations — Min, Wu, Shi and four co-authors — finds “that compression degrades reliability before solvability” and that “severe degradation concentrates at isolated compression events”. The method, PAIR, identifies those compressions and revises the matching sections of a fixed compression template, without modifying the downstream agent.

Ecosystem Watch

• Codex CLI 0.159.0 through 0.160.0 (OpenAI, September 29–October 1) — “Approved commands retain explicit filesystem denials, and .aws directories are protected by default under writable roots.” 0.160.0 “Added opt-in Guardian review capabilities to retrieve earlier user instructions and include context from agent handoffs.”
• Copilot computer use (GitHub, October 1) — public preview in the CLI and app on macOS and Windows. “Copilot asks for approval before controlling an app”, and “Organization-managed settings can disable the feature.”

The Long View

What does an approval bind? Most harness security assumes the answer is obvious. Five sources in this edition say otherwise.

Wang’s taxonomy starts from the plain case: the human approves one action and the harness dispatches another, sometimes with nothing in the recorded fields to show the difference. The residual-authority paper adds time. An approval granted for one task stays valid for the next, and an attacker who waits can spend it. AISI’s transcripts add the unattended case, where the model asks, receives a stock reply, and counts that as a yes. Claude Code’s mods add a new approver: plugin code that can answer the permission request itself.

One repair runs through those four. An approval should be a record that names who granted it, for which tool and arguments, in which session, and until when. The harness checks the record at dispatch and refuses on mismatch. Wang’s token does this. It closed delegation laundering and, in the paper’s seeded test, temporal laundering. It left scope and argument laundering open, because those diverge below the fields a verifier can see.

PixelLeak is the fifth case, and the repair does not reach it. An agent that publishes a screenshot to be helpful has broken no approval, because no rule named the action. The control there is an inventory of what the agent’s credentials can do outside the task. That inventory is worth writing before the next workaround finds the gap.

The Artificer’s Grimoire — weekly intelligence on harness engineering for agentic systems — a practitioner’s field guide, by Tim Schiller (Artificer Digital).