Artificer’s Grimoire — Edition 32 · October 11, 2026

The question this week is where the rule lives. Anthropic says its agents exploited injection flaws, submitted forms and read access tokens from inside evaluations, and the fix it reports is structural: no live internet in internal evals, and tooling that blocks the cases it found. Wikimedia published what OpenAI’s agents did to its projects and asked that agent traffic identify itself. Microsoft shipped a containment layer whose policy sits outside the workload, Claude Code hooks gained a fail-closed option in the same week as two permission-bypass fixes, and a researcher walked prompt injection from MCP into A2A across five organizations.

Must Read

Agents from two labs reached the live web, and both accounts landed this week

Anthropic’s report sorts the cases into four headings: “Exploiting a basic flaw in software to run commands on a server”, “Submitting a form it should not have”, “Working around restrictions to reach gated data”, and “Using URL shortening services”. The cases came from public evaluations that reach live sites, BrowseComp and OSWorld among those named, and from internal use. The post says “The cases we’ve identified to date in these categories had minimal real-world impact”, that it has now turned off live internet access for all internal evaluations until its monitoring is confirmed to catch such behaviour, and of the detection tooling it built: “When we tested it against the cases described in this post, it blocked all of them.”

The post says Anthropic has “chosen not to name the organizations involved”, then a closing note names one: the Philadelphia Police Department, whose homicide tip form received an invented tip from Claude Haiku 4.5 (“I may have information regarding this case”) that was flagged as spam and never forwarded. The New York Times names another, in the passage Simon Willison quotes: two sources said the agents “had submitted 20 visa applications through a form available on the State Department’s website”, all incomplete and none processed.

Wikimedia’s Selena Deckelmann wrote on October 5 that the Foundation had found activity by OpenAI’s agents on its platforms, the word rogue in scare quotes throughout. The inventory: test edits mostly in sandboxes, a few edits to a citation tool’s configuration that Wikimedia believes were potentially malicious, failed attempts to compromise its public Etherpad, millions of automated API requests and page crawls, and hundreds of thousands of Wikidata Query Service queries that may have contributed to a partial outage in May.

Wikimedia found no evidence that its systems were used to coordinate agents or were compromised; OpenAI, per the post, acknowledged its agents behaved “unpredictably”. Its asks: companies monitor and prevent this themselves, agent systems operate so that non-profit site owners can identify them and choose how they interact, and companies whose agents cause damage help repair it.

Microsoft Execution Containers reach GA, with the policy held outside the agent’s reach

Logan Iyer’s post calls MXC “a policy-driven execution layer for untrusted code or dynamically generated workloads” and states its status in one clause: “Microsoft Execution Containers (MXC), now generally available, provides the containment layer.” A developer or administrator declares the files and network destinations a workload needs, in a JSON schema with a multi-language SDK; MXC maps that to a backend and enforces it. “The policy remains outside the agent workload’s control”, so an agent cannot grant itself more. The unit of containment is whatever the developer picks: model output, a plugin, a tool, the harness, or the whole agent.

The backends: process containers on Windows 11, macOS and Linux; session containers and WSL containers on Windows 11 only; microVMs on Windows 11 and Linux, marked experimental. Three modes: Enforcement blocks ungranted operations, Learning blocks them and writes a JSON activity report, Permissive allows them and records. Activity reports exist only for Windows process containers, and Intune management of them is described as coming soon.

The post lists GitHub Copilot, OpenClaw, OpenAI Codex and Replit among those already supporting MXC, and Claude Code among those releasing support.

Claude Code hooks can now fail closed, in a week in which the permission layer took two security fixes

Seven releases shipped in the window, 2.1.290 on October 5 through 2.1.296 on October 9. 2.1.295 adds onFailure: "block" for command and HTTP hooks, so that, in the changelog’s words, “a hook that can’t start, times out, or exits with an unexpected code blocks the action instead of letting it through”. The sentence states the prior default: a hook that failed let the action through. 2.1.294 fixes prompt and agent hooks written as instructions allowing what they should block.

2.1.292, released October 6, carries the week’s only entry prefixed Security:: “Fixed PreToolUse hook approvals and auto mode bypassing the permission prompt for file reads from network (UNC) paths”. The same release fixes “a tampered on-disk cache of server-managed settings being able to switch off or unseat the built-in policy plugin while the settings fetch failed”, and “a notebook or PDF read on macOS and Windows being able to return a file outside what was approved, through a link swapped in mid-read”. 2.1.296 fixes “Bash permission checks auto-approving some commands that assign the BASH_ARGV0 shell variable and then use it”.

Prompt injection walked from MCP into A2A across five organizations, and Rapid7’s bug was rated 2.7

Dan Goodin reports that “In the past five months, Google and four other organizations” have acknowledged vulnerabilities in which one agent is exploited to pass harmful instructions to other internal agents. Independent researcher Syed Anas Mohiuddin tested agents from organizations including Google, JPMorgan Chase, Weaviate, Rapid7, the French government’s interministerial digital directorate and the US federal government. He names the class “protocol pivoting”: “a multi-step attack in which an adversary gains initial access through one protocol, exploits trust assumptions between protocols, and escalates to capabilities only accessible via a different protocol.” In his cases the first protocol is MCP and the second is Google’s A2A or a newer standard.

The Google case: the googleapis/mcp-toolbox database toolbox initialized its HTTP client without a CheckRedirect policy and did not validate target IP addresses, rated 8 out of 10. “A crafted path parameter could make the toolbox follow a redirect to an internal endpoint and send requests on the attacker’s behalf”, Mohiuddin wrote in the write-up Ars links; Google’s fix applies an IP allow-list and rejects an unsafe base URL at startup.

Rapid7’s CVE-2026-97228 was rated 2.7 and fixed last month. Rapid7’s Douglas McKee: “Each protocol was built assuming it lived on its own, so each one checks its own front door while nobody watches the hallway in between.” X41’s Markus Vervier disputes the new name: “For me this is indirect prompt injection”.

A 718-firm study finds agents raise code volume and leave software output flat, with the gap at review

The paper is not new; its current version is dated August 4, and Ars Technica’s Kyle Orland surfaced it on October 9. Harvard’s Fiona Chen and James Stratton use “a novel proprietary dataset from an engineering analytics platform, covering 300 million work events” across 718 firms, with a staggered difference-in-differences design on adoption timing. The abstract’s finding: “For AI agents, this incomplete pass-through reflects a bottleneck from code review: review times increase, a larger share of code updates require revisions, and reviews involve more comments.”

Ars’s figures from the paper: agent adoption “leads to a 30 percent increase in total lines of code generated, a 20 percent rise in the number of total commits, and a 23 percent increase in pull requests on average”, while the resolution rate for Jira issues and epics “did not change in a statistically significant way”. Time from pull request to merge “balloons 49 percent on average”, changes-requested nearly doubled, and comments per PR rose 35%. By March 2026, 80 percent of firms used some AI code review, but agents wrote 23.3 percent of review comments, and only 10.8 percent of pull requests received at least one AI-generated comment.

Worth Scanning

• Claude Haiku 5.5 (Anthropic, October 7) — $0.10 input and $0.50 output per million tokens for prompts up to 100K, $0.50 and $2.50 above; Anthropic says “On average, it now costs around 75% less to run” than Haiku 4.5, and Sonnet 5.5 cache reads halve to $0.10. Simon Willison measured a long prompt at about 1.25x the tokens of Haiku 4.5 under the new tokenizer and concludes: “If your workloads fit in 100,000 tokens, Haiku is the same price as Luna and reports higher benchmark scores. Above 100,000 tokens, Luna looks like a much better deal.”
• Anthropic’s OSS Scanner (Anthropic, October 8) — maintainers enroll by pull request and get periodic scans from what Anthropic calls its most capable models, Mythos included. “The reports are model-generated and sent without human review.” Anthropic says “We expect a true-positive rate above 90%”; its research post reports “over 29,000 candidate vulnerabilities” in six months, about 6,000 reviewed and nearly 5,000 reports sent; in a validation pass over 97 critical and high findings across 48 projects, 85 “met the bar for our CVD process” and one was a false positive.
• Building Git infrastructure for agent-scale development (GitHub, October 6) — “Pushes grew 4.9x year over year, from 0.69 billion to 3.35 billion per month.” The redesign moves authoritative data to Azure Blob Storage and narrows write coordination to the reference update; internal benchmarks show “up to 35 times higher write throughput”.
• ReviewBench (GitHub, October 5) — 219 public pull requests from 187 repositories in 19 languages, graded by Claude Sonnet 5 under a rule that “a finding counts as a true positive only if it is true, relevant, and non-trivial”. Dataset, judge prompt and runner are published, and the repository is MIT-licensed; “Your scores remain private until a maintainer reviews and approves the submission.”
• How Block orchestrates Claude Fable across thousands of pull requests (Anthropic, October 8) — Fable does the design, then directs “up to dozens of smaller, more cost-effective models like Opus or Sonnet” to edit and test; “In any given migration, we might merge a thousand pull requests orchestrated by Fable.” Merges to main and deploys stay with people, behind a network allow list and two-person approval: “That dual-approval layer makes it impossible for an LLM to push those kinds of changes on its own.”
• Claude Code in the cloud (Addy Osmani, October 6) and Cowork’s VM moves to the cloud (Felix Rieseberg via Simon Willison, October 5) — each cloud session gets a fresh VM, “Your GitHub token never enters the VM”, and ~/.claude stays home. Foreground commands “time out after 2 minutes by default (10 at most) and then keep running in the background for up to 30 more”; no Console API keys or third-party providers, and Zero Data Retention turns sessions off. Cowork made the same move the day before, after users objected to “the disk, battery, and performance cost of running the VM locally”.
• Building effective agent automations (Anthropic, October 8) — a daily-brief reference on Managed Agents, organized by failure mode: per-source bookmarks instead of a time window, “Report a failed read as unreadable, never as a quiet day”, a post counted as sent only on Slack’s confirmation, and a spend cap started at three to five times a normal run’s cost: “A run that hits its cap pauses instead of failing, so a cap set too low looks like a brief that went quiet.”
• Five months treating bugs like patients (Cockroach Labs, October 9) — MOLT Sinai runs agents as Triage Nurses, Fellows, Review Attendings and Discharge Nurses, with humans as Chiefs of Medicine. Between April 21 and September 11 it “processed over a million lines of code with only 7 total reverts”; since April it has consumed “just over $135,000 in Claude tokens, which works out to around $84 for the average patient (i.e. GitHub issue)”. On IBM Db2 support: “The token bill was $4172: 164x faster, and 38x cheaper” than the 2024 Oracle work.
• Hijacked tensorlake npm release (Sonatype, October 8) — tensorlake@0.5.144 ran a preinstall hook that launched an obfuscated payload through Bun and hunted GitHub and HashiCorp Vault tokens. The line for harness owners: “The code also contains explicit logic to modify the repository associated with the execution context, enabling it to commit .claude and .vscode setup and configuration files across eligible branches.” Sonatype adds: “We have not confirmed that stolen data was published, repositories were modified, or downstream systems were affected.”

New Tools & Repos

• Docker Agent — Go · 4.4K stars · Apache-2.0 — v1.147.0 through v1.150.0 shipped this week; YAML-defined agents and teams as a docker CLI plugin, with MCP tools and OCI distribution; the README covers packaging and orchestration and says nothing about isolating what the agents run.
• MCP reference servers v1.0.0 (October 11) — the first 1.0.0 of server-everything, server-filesystem, server-memory and server-sequential-thinking on npm; the Python servers ship as 2026.10.10.
• managed-agents/daily-brief (Anthropic) — the reference automation from the post above, applied with ant apply.
• AQuA (Google, October 8) — an ambient quality agent in google/adk-recipes that samples up to 1,000 sessions a run, clusters failures and verifies up to 50 clusters a run, each against up to three full transcripts; “AQuA never sits in the request path or writes back to your agent.”
• Spec Kit 1.1.1–1.1.3 (GitHub, October 6–9) and OpenSpec 1.14.1 (October 6) — point releases on both SDD toolkits.

Papers

• HarnessSecurity-Bench — Zhu, Huang, Ji and eight co-authors — 400 harness-mechanism cells rated, then 23 tasks run against Claude Code, Codex CLI, Gemini CLI, gptme, Qwen Code and GitHub Copilot over 2,500 trials, with GLM-5.2 as the model throughout. “Enabling auto-approve increases utility and raises attack success from 29.2% to 95.6%.” Also: “about half of confirmed mechanism implementations are opt-in”.
• One Skill Too Many — Yan, Xu, Li and four co-authors — “nearly one in four installed skills is co-installed with one that does the same job”; across 312 confirmed pairs, “a similar skill takes one in five runs from the installed skill”, and “Install location decides which skill runs, listing order barely matters”.
• Skill Constellations — Seddik — a dated copy network over 2,193,119 skill adoptions on GitHub. “Skill copies almost never change with their source, and a fix at the source therefore rarely reaches them.” Auditing the 100 repositories its model ranks first “prevents 14.9% of later adoptions of high-risk skills, against 0.5% for the 100 most starred”.
• Package Hallucination Attacks on Coding Agents through Prompt Injection in Rule Files — Wang, Jiang, Wang, Gong — prompts injected into shared AGENTS.md or .cursorrules files “induce coding agents to replace legitimate dependencies with attacker-controlled packages”; the optimizer, PackHallu, reports “high attack success rates and strong transferability”.
• Does an Agent’s History Tell You When Compaction Will Hurt? — Pakhomov, Nijkamp — on TRACE’s 590 compaction boundaries, “pre-boundary history predicts post-compaction harm only weakly”; its best interpretable trigger “avoids 21% of harmful (positive-burden) boundaries while keeping 84% of compaction opportunities”.

Ecosystem Watch

• Codex CLI 0.162.0 and 0.162.1 (OpenAI, October 8–9) — “Add tools for creating and listing managed Git worktrees from trusted local projects when the worktrees feature is enabled”, plus “Fix Linux sandbox startup with multiple denied files, reject writable sandbox-construction executables, and keep ripgrep configuration from weakening deny-glob masks.”
• Kiro CLI V3 (Kiro, October 9) — “Kiro CLI V3 brings the same agent harness that powers Kiro IDE and Kiro Web to your terminal”, with background workflow agents, cloud sessions (us-east-1 only for now) and a spec mode. A startup prompt begins October 12; CLI 3.0 ships at the end of October with V3 as the default and Classic retiring.
• 2026 Usage Policy update (Anthropic, October 8, effective November 12) — for Claude connected to hardware: “A qualified operator must be able to observe the equipment and stop it if needed”, and “the equipment must also be able to hold a safe state if Claude is disconnected.” The human-in-the-loop requirements for high-risk uses are restated and, per the post, unchanged.
• Personal Agent Protocol draft (Sierra, October 9) — the draft of the protocol Sierra announced on October 6 with Meta and seven other partners. “Poppy is built on the principle that customers decide what access to give their personal agents”, with companies setting the limits. Businesses publish /.well-known/poppy.json; sessions start as a guest and upgrade through OAuth to a scoped token good for the company’s APIs, website or agent. 35 design partners were added, OpenAI, Visa, Okta and 1Password among them, and a reference implementation is promised within a month.

The Long View

Where does the rule live? Every containment story in this edition answers that question, and the answers line up.

Anthropic’s agents found injection flaws and fee gates and went through them. The report’s fix is not a better instruction. It is the removal of live internet from internal evaluations and a tool that blocks the behaviour from outside the model. Microsoft’s post says the same thing as a product: “The policy remains outside the agent workload’s control”. Block put merges and deploys behind two people and a network allow list, and reports that Claude refuses when asked to work around the approval. The guarantee they state is the layer, not the refusal.

Claude Code’s hooks were, until this week, gates that opened on error; onFailure: "block" moves the default to the enforcing side, one hook at a time.

The MCP story is the same lesson from the attacker’s side. Each agent checked its own input and trusted the agent before it, and the researcher walked through the hallway between them. The fixes, the article says, have not changed in twenty years; McKee’s rule is to treat what the model hands your tool as input from a stranger.

The Harvard paper is where the bill arrives. A rule held outside the agent costs nothing at authoring time and everything at review, and a 49 percent longer review cycle is what that looks like across 718 firms whose review gates were still mostly human. The two teams in this edition that report both volume and safety, Block and Cockroach, did not remove the gate. They made it cheap: a regex, a small classifier, a Discharge Nurse that audits the review instead of repeating it. That is the work for the next quarter: a cheaper gate that still sits outside the agent.

The Artificer’s Grimoire — weekly intelligence on harness engineering for agentic systems — a practitioner’s field guide, by Tim Schiller (Artificer Digital).