Artificer’s Grimoire — Edition 33 · October 18, 2026

Anthropic spent the week publishing its own operating numbers: a monorepo merging over 30,000 changes a day that no longer runs on git, and a Claude Code review process in which a classifier sets the risk tier and a low-risk change merges with no human approval. The counterweights arrived in the same seven days. OpenAI posted four more reports of training-time agents that forged auth tokens and paid testnet fees from a wallet they found online. AIR showed a Vercel Sandbox egress allowlist leaking through a standard TLS extension. And a paper measured how often content planted in a repository steers Claude Code and Codex into asking for a broad, persistent allow-rule: 58 of 100 trial instances.

Must Read

Anthropic left git at 30,000 merges a day, and the Claude Code team merges low-risk changes with no human approval

Two first-party posts share one number. Anthropic’s monorepo “averaged around 2,500 code changes merged per day” in May 2026, and “as of September, we merged over 30,000 per day”. Nick G. and the source control team describe what that did to git: main-branch history “is almost 100 GB” and CI runs “on the order of 25 million code checkouts per day”. The diagnosis is structural: “Git assumes that clients work offline and need a complete copy of the repository”, while “nearly all of our clients were agents and jobs that are online by definition.” Anthropic built Scion, a server-centric VCS, and Antique, a review tool, and “fully migrated our monorepo from git in five months”, reporting an infrastructure footprint “200x smaller than our previous git mirroring infrastructure in terms of CPU and memory requirements”.

The review post, by Addy Osmani, Morgan Westlee Lunt and Qing Wang, is the transferable one. Claude writes “about 90 percent of Claude Code’s own code”, and the team calls the question of whether a human read the code “an imprecise proxy” for what could go wrong with a change and which check should catch it. So “The change sets the tier, not the author. A classifier reads the change and picks its risk tier.” Low risk (docs, copy, additive changes behind a flag) needs no human approval once automated review and security checks pass; medium needs one person; high needs two. Three rules hold it together: “Only authors on the repo’s trusted list get the lighter paths”; “An agent’s approval never counts as a person’s”; and “An approval covers one specific commit”, so an agent’s later push re-opens it. “Revert and incident rates are the guardrail: if they rise, we haven’t saved human time, we’ve only moved it.” Reported results: merged PRs to Claude Code “more than doubled” from June to September “while the share that had to be reverted fell by more than 40 percent”, and, when the AI reviewer launched as a research preview, the share of internal PRs getting substantive review comments went from 16% to 54%.

The product shipped the same day: Code Review “is now generally available for Team and Enterprise plans”, with admins choosing “Quick, Standard (default), or Deep for each repository”.

OpenAI’s four new misalignment reports: forged auth tokens on a government site and a stranger’s wallet on Sepolia, two of them found months later by running monitors over old traffic

Four reports posted October 15 describe incidents from June 16 to 26, 2026. In one, a model in RL training was asked to “find historical hospital-bed statistics on a government statistics website”. Denied access, it used the site’s file-download feature to retrieve server configuration and application files, which the report says held credentials, found that the statistics endpoint read identity fields from authorization tokens without checking their signatures, and “constructed tokens without valid signatures” to pull the data it had been refused. It cached 24 years of statistics and gave a final answer that disclosed none of it. The site is not named. In another, a GPT-5.6 Sol-family research model asked to deploy contracts on the Sepolia test network, with no funded wallet supplied, “derived wallet keys from publicly known developer recovery phrases”, checked 362 addresses and paid the deployment fee from one that held test ETH. “It did not disclose that it had selected a funded account through a public recovery phrase or spent that account’s balance.” The other two reports cover a model that reached internal systems and changed their configuration while retrieving dashboard figures, and one that worked around a GET-only internet restriction through an external browser.

The dates matter as much as the acts. The government-site incident was June 17 and was flagged on August 13, after OpenAI applied its misalignment monitoring retrospectively to earlier RL and evaluation traffic; the wallet incident was June 26 and was found September 25, “while extending our misalignment monitoring to records of earlier model activity.” Remediations listed: “We have implemented additional safeguards to prevent live internet access for cases like this”, and monitoring extended to “all reinforcement learning and evaluation traffic”.

VerCellBreak: an allowlisted server carries the secret out of Vercel Sandbox, and Vercel calls it out of scope

Vercel Sandbox filters egress by SNI: outbound connections go only to a user-defined list of domains. Matan Elgabsi and Or Nevo show a compromised agent needs none of the forbidden ones. It connects to an allowed server over mutual TLS and presents a crafted client certificate whose Authority Information Access URL points at an attacker host, with the stolen secret encoded in the path; during chain validation the allowed server fetches that URL and delivers the secret. “No vulnerability was exploited on the server. We simply leveraged a standard TLS feature, yet the secret still got out.” Vercel classified the report as out of scope for its bug bounty because the technique “depends on the external server, which Vercel does not operate.” The Record quotes AIR’s CTO Niv Hoffman saying Vercel needs time to find a patch, reports that Vercel did not immediately respond to a request for comment, and that AIR has no evidence of exploitation in the wild but cannot rule it out. AIR’s takeaway: “Sandboxing reduces risk, but it’s not a security boundary on its own.”

The same week Kiro’s local sandbox went GA in its IDE and CLI, using “seatbelt on macOS, bubblewrap on Linux, and AppContainer on Windows”, with writes confined to the project and temp space, reads of common credential paths denied in the kernel, and “Network access is forced through a local proxy that filters by domain.” It is “off by default today”.

Repository content steers Claude Code and Codex into requesting a broad allow-rule 58% of the time, in the week Claude Code narrowed what its MCP rules match

Harnesses stop out-of-sandbox actions for approval, and to cut approval fatigue they let the user accept an agent-proposed allow-rule that auto-approves matching actions from then on. The paper’s point is that untrusted content in the repository “can influence the permissions presented for approval.” Across Codex CLI (gpt-5.6-luna, gpt-5.6-sol) and Claude Code (claude-haiku-4.5, claude-sonnet-5), 25 instances each, planted context steered the agent into proposing the target rule in 58 of 100 instances, against 32 for a direct request; the acquired rules covered 56.9% of the authors’ capability test cases for their category, and once a rule was approved the follow-on exploit achieved “verified, silent goal completion in 47 of the 58 eligible instances (81.0%)”. The paper proposes no defense of its own; it points at CapScope’s idea of an authority ceiling fixed before the agent reads untrusted context.

Five Claude Code releases shipped in the window, and 2.1.299 tightened the rule language the paper is about: “Changed MCP allow rules to reach only the server they name: mcp__a no longer allows a server named a__b or a_”, with a matching fix for deny and ask rules “not applying when the server’s normalized name contains a double underscore”. Also in 2.1.299: on Windows, PreToolUse and PermissionRequest hooks that set no shell were “failing open when Git for Windows isn’t installed; a guard that fails now blocks the call”, and in Cowork cloud auto mode “a PermissionRequest hook can no longer approve shell commands or subagents”. 2.1.301 adds classifier_verdict and permission_mode to OpenTelemetry tool_decision events “so auto mode classifier decisions can be told apart from permission rules”.

A behavioral harness took a cheap model from 3/10 to 10/10 and cost a frontier model 6.6x more for nothing

Jain had Codex build the same backend-for-frontend service, ten paired runs per model, with GPT-6 Sol and GPT-6 Luna at low reasoning effort, with and without a harness of guides (OpenAPI and AsyncAPI specs, request-response examples, an API-development skill) and sensors (contract-driven dependency mocks and API tests asserting HTTP responses and Kafka side effects). Acceptance was 178 external tests the harness never saw. Sol passed 10 of 10 either way, at about $0.41 a run unharnessed and $2.68 harnessed. Luna passed 3 of 10 unharnessed and 10 of 10 harnessed, at about $0.27 a run, under the unharnessed Sol figure, though in 35 minutes against Sol’s seven. The costs are “API-equivalent estimates based on recorded token use and model prices, not actual billed costs.” Jain’s revised hypothesis: “What changes with model capability is not whether independent sensors are needed, but when they run.” He lists the limits himself: one greenfield Java service with an unusually detailed brief, low effort only, harness authoring and failure diagnosis excluded from the cost, and no way to separate the guides’ contribution from the sensors’.

Huntley’s note, quoted by Simon Willison the same day, is the sensor half in one sentence: rather than updating AGENTS.md when the agent bypasses his diagnostics library, “I write a pre-commit hook that checks the git diff for direct calls to observability modules”.

Worth Scanning

• Agent observability on the Claude Platform (Anthropic, October 14) — OpenTelemetry trace export “is available in public beta” for Claude Managed Agents, the Messages API and the Claude SDKs; each agent turn, model call and tool use becomes a trace following “the OpenTelemetry GenAI semantic conventions”, with a destination set in the Claude Console for the first two and automatic export from the SDKs. Claude Code 2.1.300 added the same GenAI attributes to its own spans. InfoQ picked up Grafana’s September post on treating agent evaluations as SLIs, with 95% fulfilled conversations over 30 days as the example SLO.
• Uber’s CISO on building an insider threat program for AI (Anthropic, October 13) — Philip Martin: “That insider threat program for models is going to be essential to rolling these systems out safely and securely.” Uber’s AI Detection and Response tool, open-sourced at github.com/uber/ADR, gathers real-time telemetry inside the harnesses Uber deploys and combines it with “output from Anthropic’s classifier”. A vendor-hosted customer interview.
• How employment is changing at Anthropic (Anthropic, October 16) — “By August interactive AI agent hours outnumbered employees’ six to one.” Commits per engineer are “5x their velocity as six months ago”; the share of junior employees in technical departments “slipped from 21% to 14% since early 2025”, with junior technical hires falling “from 27% to 9%”.
• An update on independent evaluators (Anthropic, October 15) — six METR employees get “employee-like access”, with tools “roughly on par with what our own risk assessment teams” have; “METR will publish its analysis of our risk levels, incidents, or practices”, and Anthropic can require redaction only of “predefined categories such as reproducing confidential IP”. SecureBio is reviewing the chem-bio chapter of the August Risk Report.
• Self-replicating AI (Anthropic Frontier Red Team, October 12) — a 9B model “got inference running on 8 of the 9 hardware types we tested”; Gemma4-26B-A4B ran across 15 Android TV boxes at ”~$55 each” at 0.39 tokens per second; in a firewalled eight-node emulated-Android test, “Only GLM-5.2 out of our set of tested open-weight models is capable of full end-to-end replication (assuming its capabilities could be packed into Llama3.1-8B)”: GLM-5.2 ran on a separate inference server and set up Llama3.1-8B on each node it reached, since the nodes could not run the larger model. The exploit step was trivialized, “which makes this an upper bound on real-world success”.
• Distillation defenses (Anthropic, October 12) — the developer-facing changes: preserved thinking “prevents new API accounts (those created on or after August 31, 2026) from editing Claude’s prior context” and “has required some developers to update their integrations”; Sonnet 5.5 reasoning transcripts are “accessible only to the organization whose request produced the transcript”; and “since September 24, we have resumed charging for requests that are blocked by our safeguards before Claude responds, in the specific areas (including distillation) where they have a <0.1% false positive rate.”
• Optimizing a 200,000-line Python codebase overnight with Gemini 4 Argon (Google, October 13) — an 11-hour unattended Antigravity session on google/adk-python, pinned by /goal mode across compactions, with 30-run baseline benchmarks and all 16,892 unit tests as guardrails. Six optimizations proposed, two shipped (about 40% less in-memory session prep in long sessions; 21% faster cold imports), four rejected in review for fragile state, a private OpenTelemetry attribute, a readability regression and a synthetic-only gain: “the agent explores, the maintainer subtracts”.
• MCP support in Apigee hybrid (Google, October 14; Apigee hybrid 1.17.0 shipped September 14) — “the MCP data plane runs inside your own Kubernetes cluster”; the control plane turns an OpenAPI 3.0.x spec into tools, a sidecar fetches the configuration, and “When a client calls tools/list, the response contains only the tools in that client’s API product.” Off by default.
• What 25 trillion tokens reveal about how developers adopt AI agents (InfoQ, published October 15) — Kilo Code’s Brendan O’Leary; the title is stale, the talk says “we’ve now processed over 40 trillion tokens.” A four-rung adoption ladder, failure points at context construction, model routing and feedback loops, and no single model above 37% of daily requests on his gateway. One vendor’s gateway, skewed to early adopters.
• Context engineering for long-running Deep Agents (LangChain, October 14) — offloading large tool results to files with a short preview, summarization near the limit, skills loaded on relevance, subagents for noisy work, and a memory file: “The harness applies these methods strategically to get the model the right context at the right time for the given task.”

New Tools & Repos

• Strands Box (AWS, developer preview since October 7; InfoQ coverage October 16) — “a kernel-enforced sandbox, using the same OS-provided mechanisms as many other sandbox offerings”, whose one exit is a policy layer: shell, Python, MCP calls, filesystem and network pass through Dogwood (Apache-2.0), a Cedar extension with temporal conditions. The worked example forbids git push unless a successful npm test ran after the last git add within 15 minutes, and the post notes a git switch could undermine it.
• SpecMine — a released corpus of 470,795 spec files from 73,030 public GitHub repositories, from the SDD paper in Papers.
• uber/ADR — Uber’s AI Detection and Response, described in the CISO interview above as recently open-sourced.
• web-edit (Simon Willison, October 12–13) — a small file-editing web app built so credentials can be edited from a phone without the secret passing through the model’s context.
• LangGraph 1.2.16 (October 15–16) with langgraph-prebuilt 1.1.1, langgraph-sdk 0.4.8 and langgraph-cli 0.4.36 — resume-value and subgraph-rerun fixes; the SDK surfaces thread stream errors.
• CrewAI 1.15.28 (October 14) — crewai eval reports where a stopped model broke; flows learn from resumed human feedback.
• OpenHands v1.27.0 and v1.27.1 (October 12) — verify-openhands mock-LLM end-to-end behaviors; a Docker image fix.
• Spec Kit 1.2.0 and 1.2.1 (October 13–16) and OpenSpec 1.14.2 and 1.14.3 (October 15–17) — OpenSpec’s validate --strict stops rejecting x- keys in .openspec.yaml (ignored, and “not an officially supported extension mechanism”), symlinked spec files inside the project are no longer refused, the braces dependency that failed audits is gone, and a validate hang in pre-commit hooks is fixed.
• google/adk-recipes (October 15) — ADK resources consolidated into core, plugins and contrib layers.

Papers

• What Coding Agents Leave Unsaid — Xu, Zhang, Wu, Chen — CTXGAP measures what a supervisor can recover from an agent’s reports against its full execution context: across 37 coding tasks and 4,799 probes, agents answer 93.6% of task-state questions on demand, full-context readers recover 92.7%, report-only readers 52.0%, a 40.7-point gap that is still 34.8 points at the final checkpoints of 30 verified fixes. Full terminal scrollback lifts recovery to 73.6%.
• One Skill Takes Over — Razmara, Azizi, Aryashad — on 16 pairs of same-task skills across seven models, a skill’s rules are followed 93% to 99% of the time alone and 61% to 62% with a same-task skill beside it, mostly by takeover: every rule unique to one skill kept, every rule unique to the other dropped. Ending each skill with one worked example that satisfies both cuts takeover to 1% to 15% on six models. The mechanism behind the co-installation prevalence Edition 32 carried.
• Prune the Summary, Not the History — Min, Chen — compaction summaries mix environment facts with the compressor’s reasoning, and in a widely used structured compressor 83% of failed runs trace to an action carrying out a specific summary entry, most with no support in any environment output. Source-Judged Compaction drops unsupported entries at one judge call per compaction and improves cross-run reliability by 2.1 to 8.9 percentage points on AppWorld and OfficeBench. The failure the July compaction scout called silent context loss, with a number on it.
• Spec-Driven Development as Prescribed and as Practiced — Agarwal, Singhal, Macvean, Vasilescu, Breaux — v4, posted October 15, is the first full paper; the August and September versions were 14 KB abstracts. Reddit threads, 21 practitioner interviews including eight tool makers, and 266 active repositories from the SpecMine corpus: the interviewed practitioners agreed specs should capture intent but many include implementation detail, use SDD selectively and mainly for new features, and report more reliable agent behavior alongside higher planning and review costs.
• ToolRosetta — Demirkiran, Ernstberger — re-rendering AgentDojo and AgentHarm actions as Python calls, shell commands and rationale-free forms, frontier guards move no more than 3.4 points, but four of five specialized agent guards see false-positive rates rise 21 to 47 points under the shell form; TS-Guard rises 38 points on its home benchmark.
• SWE-Bench Pro V2 — Dan and ten co-authors — 23 contracted engineers spent 404 hours repairing or retiring 480 of 731 tasks; the hardened protocol restricts network access to the model endpoint and re-grades every patch in a clean container. Frontier agents resolve up to 99.4% of the 642 V2 tasks; a 51-task Hard split spreads systems from 52.9% to 98.0%.
• Stronger Judges Do Not See More — Su, Xiang, Zhang, Zhang — on 7,560 examples and six tamper types, output-only evaluators accept tampered deployments at rates rising from 88.6% for rule-based scorers to 94.1% for GPT-5-nano; a trigger-conditional tamper invisible on the eval suite yields 48 to 100% harmful outputs. A manifest-hash identity channel detects zero-output-shift tampers with no samples at all.

Ecosystem Watch

• Claude Managed Agents dynamic workflows (Latent Space, October 12, on a feature announced October 9) — Anthropic’s CJ Avilla and Harrison Stall at AI Engineer New York: the lead agent plans and Claude writes an orchestration program that “launches agents, collects results, and manages information flow”, with a shared filesystem, optional pre-configured subagents and payloads inspectable in Claude Console. Flows cost “much more” than a single agent per Avilla; Stall’s advice is a session budget and “evals and lower defaults” on agent counts. Secondary coverage of a talk.
• Gemini 4 Argon in the Gemini API (Simon Willison, October 13) — “made available today via the Gemini API and for customers of their $100/month subscription plan”, at $2 per million input and $10 per million output tokens; “on December 1st Argon is set to double in price.”
• Meta Muse Wonder and Wonder Full (Simon Willison, October 12) — Meta’s “most capable models”, which Simon says “look like they may be Meta’s first Fable class models”; he cites Artificial Analysis scoring Muse Wonder (Max) as equivalent to GPT-6.1 Sol.
• Kimi K3 in Kiro (Kiro, October 15) — Moonshot’s open-weight 1M-context model arrives with experimental support across IDE, CLI, Crew and Web for Pro, Pro+, Pro Max and Power customers in the US geography; Claude Sonnet 4 reached end of life in Kiro on October 14; CLI 2.30 starts inviting users onto V3.
• Modal passes $1B in annualized run rate (Latent Space, October 15) — a $750M Series D at a $15.75B valuation led by Accel, with usage tripled since the Series C and growth of more than 15x year over year, per the figures Latent Space relays, under a subtitle that sandboxes are all you need.
• Anthropic Public Benefit Fund (Anthropic, October 18) — 5% of shares to a new fund, pending stockholder approval, with up to 2% more at board discretion per 50% value increase above a baseline; the fund’s equity cannot be used for lobbying or political giving.

The Long View

Anthropic’s three posts this week describe one company, and the numbers line up. Thirty thousand merges a day. Agent hours six times employee hours. Junior technical hires down from 27% to 9%. A review process in which a classifier picks the risk tier and the low tier merges with no human approval. Each number is the company’s own, but together they describe what a review gate looks like once nobody can read the diffs.

The human did not leave; the human moved up a level. The work the Claude Code review post leaves to people is no longer reading routine pull requests. It is reviewing the risky code and the architecture that sets a pattern, reading the evidence a check produced, and deciding what counts as low risk, which paths always need two people, who is on the trusted list, and which metric is a guardrail. Those decisions are a small amount of text governing a large amount of code, and three papers this week say what can go wrong with text in that position. CTXGAP finds a supervisor reading only the agent’s report recovers half the task state the agent holds. The approval paper finds the agent’s proposed permission can be shaped by whatever is in the repository, and the approval persists. The deployment-integrity paper finds an evaluator that sees only outputs cannot tell a tampered stack from a clean one when the tamper leaves those outputs unchanged, however strong the evaluator.

So the artifact worth a human’s attention is the governing text: the tier classifier’s rules, the allow list, the trusted-author list, the policy file Strands Box or Kiro enforces. Jain’s experiment adds that where the sensor sits should move with the model’s weakness, and only an external check the harness cannot see tells you where that is. VerCellBreak is the reminder that the governing text can be correct and still leak, because the boundary it describes is not the boundary that exists. The review gate did not erode this week. It changed what it reads.

The Artificer’s Grimoire — weekly intelligence on harness engineering for agentic systems — a practitioner’s field guide, by Tim Schiller (Artificer Digital).