50
Securing Claude Code: The New Compliance API, Local Visibility, and Identity Governance
Anthropic's new Compliance API endpoints expose Claude Code local session transcripts, highlighting governance gaps for endpoint AI agents.
Anthropic added local session transcript endpoints to its Compliance API on August 11, 2026, giving security teams visibility into prompts, bash commands, file operations, and MCP commands run by Claude Code harnesses on endpoints. The article argues local harnesses break the classic shared-responsibility model, citing Token Security data that 68.6% of discovered AI agents run on endpoints, and a Cloud Security Alliance survey of 418 IT and security professionals in which 82% found an unknown agent within the past year. It outlines three governance layers: Anthropic managed settings as a policy baseline, the Compliance API for cloud-visible transcripts, and endpoint telemetry to connect agent activity to identity, credentials, and permissions.
45
50
The VMs Powering Mobile Agents (Instinct, Claude Code)
A teardown reveals Claude Code runs in Firecracker microVMs with a Rust PID 1 and MITM'd egress, while Instinct rents E2B sandboxes with git-based memory.
The author inspects the virtual machines hosting cloud agents: Claude Code runs in a Firecracker microVM with a custom Rust init (process_api) as PID 1, a 324 MB Bun harness on a read-only disk, and 443-only MITM'd SSE egress to api.anthropic.com with host-rotated OAuth tokens and no inbound access. Instinct rents E2B sandbox-as-a-service Firecracker microVMs (Ubuntu 22.04, 2 vCPU, 1.9 GB RAM) where agent memory is a git repo of Markdown committed by the agent and pushed to S3 as a single bundle, using short-lived STS credentials. Both platforms rely on Firecracker, differing mainly in fleet operator and guest boot configuration.
35
Anthropic Adds Plugin Evals to Claude Code: 6 Grader Types, a No-Plugin Baseline, and a CI Gate for Skills
Anthropic ships a plugin evals workflow for Claude Code with six grader types, a no-plugin baseline arm, and a CI gate via threshold and cost flags.
Anthropic published a plugin evals workflow for Claude Code, exposed via the "claude plugin eval" command on v2.1.269+. Six grader types exist: regex, tool_used, tool_order, and file_exists are free transcript checks, while llm and baseline invoke a billed judge model. Every case runs with and without the plugin, and the delta (Δ) isolates the plugin's contribution; a Δ near zero with a failing tool_used:Skill grader indicates the skill never triggers. CI gating uses --threshold 0.8, --max-cost-usd, --trust-plugin, and --no-publish flags, with results written to a report.html under evals/results/.
42
30
Houthis Used Claude Code to Develop Missile Guidance Software: Anthropic
Anthropic's threat report details a Houthi-linked Yemeni cell using parallel Claude Code sessions to build missile guidance software, evading safeguards by fragmenting tasks.
Anthropic's September threat report describes a Yemen-based cell, assessed as highly likely Houthi-linked, that used Claude Code across multiple parallel instances to develop guidance software for a tactical guided rocket, a ballistic missile with over 2,000 km range, and a hypersonic glide vehicle concept called 'R2000'. The operators integrated open-source autopilot software, built six-degree-of-freedom trajectory simulations, and used reinforcement learning to tune flight-control algorithms, ultimately compiling an offline executable. The group test-fired a guided rocket that failed, then used Claude within hours to analyze launch telemetry. Anthropic blocked numerous requests, but operators evaded safeguards by obscuring intent and dividing work across separate conversations before accounts were banned; the case is one of six conventional-weapons cases (three China-linked, two Russia-linked) in a report covering disrupted operations from December 2025 to August 2026.
75
Agent Harness vs Agent Framework vs MCP: Which Layer Owns the Loop, State, Tools, Permissions, and Recovery
Architecture explainer separates agent harnesses, frameworks, and MCP by which layer owns the loop, state, permissions, and recovery.
The article distinguishes agent harnesses (OpenAI Codex, Claude Agent SDK), which own the execution loop, sandbox, permission model, and recovery; frameworks (LangGraph, OpenAI Agents SDK, Microsoft Agent Framework), which supply composable primitives; and MCP, a stateless JSON-RPC wire protocol governed by the Linux Foundation's Agentic AI Foundation since December 2025. An ownership matrix maps the execution loop, state, tool transport, permissions, recovery, sandboxing, and multi-agent orchestration to each layer. The 2026-07-28 MCP specification made the protocol fully stateless, retiring the initialize handshake and session headers.
35
Context Engineering Inside the Harness: 4 Mechanisms That Beat Context Overflow and Goal Loss on Long-Horizon Tasks
Survey of four harness mechanisms—context budgeting, compaction, todo-state, and memory—that keep long-horizon LLM agents on task across 200+ tool calls.
The article details how agent harnesses, not larger context windows, solve context overflow and goal loss on long-horizon tasks, citing Chroma's Context Rot report showing 18 LLMs (GPT-4.1, Claude 4, Gemini 2.5, Qwen3) degrade on long inputs. Concrete implementations include LangChain Deep Agents offloading tool responses over 20,000 tokens to the filesystem and truncating old tool calls at 85% window usage, and Claude Code capping auto memory at 25KB while re-reading the 5 most recently modified files after compaction. OpenAI's Responses API now offers server-side compaction via context_management with a standalone /responses/compact endpoint, which Codex uses for long-running coding tasks. Manus reports a roughly 100:1 input-to-output token ratio per ~50-tool-call task, motivating todo.md state recitation to prevent goal drift.
52
Coop – Isolated VM Environments for Running Claude Code and Codex
Trail of Bits releases Coop, running Claude Code and OpenAI Codex agents inside isolated virtual machines for safer agentic coding.
Coop, published on GitHub by security firm Trail of Bits, provides isolated VM environments for executing AI coding agents such as Claude Code and Codex. Isolation contains the filesystem and network side effects of autonomous agent actions, reducing risk from unsupervised tool use. The project drew 61 points and 16 comments on Hacker News.
28
Show HN: Self-hosted company OS, Claude Code and Codex agents in departments
OtoDock, a self-hosted company OS that organizes Claude Code and Codex AI agents into departments, was launched on GitHub via Show HN.
OtoDock is a self-hosted 'company OS' shared on GitHub through a Show HN post, presenting Claude Code and Codex AI agents organized into department-style teams. The Hacker News feed entry shows the post reached 20 points with 5 comments; no further technical details are provided in the available text.
18
Researcher shows how Claude Code can be tricked simply by asking it to summarize a website
Researcher wunderwuzzi showed Claude Code can be hijacked via prompt injection simply by asking it to summarize a website.
Security researcher Johann Rehberger (wunderwuzzi) demonstrated that Claude Code can be manipulated through prompt injection by simply asking it to summarize a website. Instructions embedded in fetched web content are executed by the agent, hijacking its behavior. The Register frames the finding as another demonstration of prompt injection risks in agentic coding tools that ingest untrusted web content.
45
30
50
The Evolution of the Agent Harness
Latent Space essay argues late-2025 agent gains came from models and harnesses maturing together, with harness logic absorbed into model weights.
The piece defines the agent harness as everything beyond model weights—tools, context, memory, guardrails—and charts its evolution from ReAct prompting (October 2022) through AutoGPT's premature autonomy, Cursor/Copilot's human-in-the-loop retreat, and Devin's roughly 15% success rate, to o1's capability overhang and Claude Code's February 2025 terminal agent with permission rules. It argues the Christmas 2025 jump cited by Transformer co-inventor Lukasz Kaiser reflected model and harness curves crossing, and that remaining harnesses will serve human attention rather than the model.
32
OpenClaw Power, MacBook Simplicity: Five Days With Grok Bot
Hands-on review finds Grok Bot simplifies agent setup via browser logins and bot abstraction, contrasting with the user-owned OpenClaw platform.
After five days with Grok Bot, the reviewer highlights browser-based sign-in as the key differentiator: connecting X, Freshdesk, and Google Calendar required only logins, no MCP configs or API keys. The piece contrasts Grok Bot's managed 'agent computer' with OpenClaw 2.0's user-owned Gateway, which now supports reusing Claude Code or Codex logins and ships a native Codex runtime. Grok Bot introduces 'Bots' as composable units arranged in 'group chats', exemplified by an Agentic Engineer Bot routing tasks across Claude Code, Codex, and Grok Build CLI. The reviewer used Grok Bot with a Cursor Pro+ account.
38
Video compressor
Simon Willison built a browser-based video compressor using the WebAssembly FFmpeg build, generated by Claude Fable 5.1 in Claude Code for web.
Willison recorded a demo video of his Equal Earth animation and wanted an optimized web-publishable version. He had Claude Fable 5.1 running in Claude Code for web build a compressor around the WebAssembly port of FFmpeg. The post is a short vibe-coding demonstration, not a model release or security event.
15
Real-SWE: Benchmarking AI models on private, real-world, enterprise codebases
Real-SWE benchmark tests coding agents on licensed private enterprise codebases; top model Fable 5.1 resolves only 38.8% of tasks.
Real-SWE is a new benchmark evaluating frontier AI coding agents on tasks drawn from private production codebases licensed from real companies, spanning billing, tax calculation, and cross-service migrations. Fable 5.1 with Claude Code leads at 38.8% resolution rate (pass@1 over eight runs), followed by GPT-6 Astra Codex CLI at 33.8% and Gemini 3.8 Flash Gemini CLI at 31.2%. Tasks use native harnesses and realistic tooling including Docker, Kubernetes, PostgreSQL, Redis, and Linear; median reference solutions edit 11 files versus 6 for DeepSWE and FrontierCode.
48
30
50
Dr. Claw: An AI Scientist Workspace for Vibe Research
Researchers release Dr. Claw, an open-source auditable workspace that wraps coding agents like Claude Code for end-to-end AI-assisted research workflows.
Paper 2609.00365 presents Dr. Claw, an open-source workspace that wraps existing coding-agent executors such as Claude Code and Gemini CLI in a controllable, human-in-the-loop research workflow. It uses persistent state objects, a reusable skill library, and multi-executor coordination to make research decisions auditable and recoverable, rather than adding another autonomous agent. Holding the executor fixed, Dr. Claw scores higher on research completeness than a bare command-line agent while preserving an auditable process trail. The code is released under AGPL-3.0 on GitHub (OpenLAIR/dr-claw).
45
Hazmat: Open-source containment for AI agents
Open-source tool Hazmat runs AI coding agents like Claude Code and Codex in a dedicated account, restricting access to credentials and files.
Hazmat is a free open-source containment tool that launches AI coding agents, including Claude Code, Codex, OpenCode and Cursor Agent, under a separate local account, sharing only a chosen project directory and enforcing per-session sandbox policies, network rules, and optional backups. On macOS it backs up the project, builds a session-specific sandbox policy, and starts the harness behind a firewall rule; Linux runs natively and an Apple-container backend is experimental. About 5.5% of the code is a TLA+ formal specification of its containment model.
22
50
Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro Powers
Mindgard found a prompt injection flaw in Amazon Kiro IDE letting attacker-controlled workspace files exfiltrate sensitive local data; fixed in version 0.8.140.
Mindgard disclosed a prompt injection flaw in Amazon Kiro, an agentic AI IDE, that lets attacker-controlled repository content steer the agent into exfiltrating sensitive workspace data through Kiro Powers, which bundles MCP server configurations, POWER.md steering files, hooks, and contextual knowledge. Exploitation requires the user to open a malicious project via a workspace file and send any message to the agent; difficulty is rated low and it works in both trusted and untrusted workspaces. Amazon fixed the issue in Kiro IDE 0.8.140; the flaw has no CVE identifier and follows earlier Kiro bugs including CVE-2026-10591, plus related prompt-injection and code-execution issues in Codex CLI, Cursor, Gemini CLI, Copilot CLI, and Claude Code.
55
Using AI for Weapons Development
Anthropic report reveals Yemen-based actors used Claude Code to build guidance software for guided rockets and ballistic missiles.
Bruce Schneier highlights Anthropic's misuse disclosure describing a threat actor cell in northern Yemen running three weapons programs: a guided rocket with phone-class homing guidance, a 2,000+ km multi-stage ballistic missile, and the 'R2000' hypersonic glide vehicle set. The actors used Claude Code as a substitute for human engineers to write GNC software, integrate an open-source autopilot, tune controls, and run flight simulations, orchestrating multiple Claude instances in delegated roles. Safeguards blocked many requests but evasion tactics included hiding intent and splitting work across sessions; one guided rocket test-fire failed but no operational device was fielded.
70
Hackers are stealing Claude tokens from subscribers
Infostealer malware is stealing Claude login sessions, letting attackers mint OAuth tokens and burn subscribers' paid usage largely undetected.
Anthropic confirmed a bad actor used common infostealer malware to steal Claude login sessions from users' computers and consume their paid usage. A UK consultant saw idle token usage climb, and Anthropic suspended his account, invalidated sessions and Claude Code tokens, and issued a £44.49 partial refund on his $200-per-month plan. Multiple other users on Reddit and GitHub reported similar theft; Anthropic signed out affected users and issued refunds, but still lacks itemized usage reporting to help users detect misuse.
55
I wrote an AI textbook — how long until AI can do it better?
AI researcher Nathan Lambert argues LLMs remain weak at long-form technical writing, questioning whether models can autonomously organize scientific knowledge for breakthroughs.
Nathan Lambert describes writing a post-training textbook, Reinforcement Learning from Human Feedback, and finds today's LLMs weak at organizing long-form technical content despite becoming superhuman at coding and math. He notes GPT 5.5 Pro found deep typos across a 200-300 page manuscript while Claude models proved more useful as editors. He argues that compressing knowledge through writing is a prerequisite for autonomous scientific insight and tempers expectations for near-term AI-driven open science.
24
35
GeoJSON Map Viewer
Simon Willison built a GeoJSON map viewer with PNG export using GPT-5.6-Sol, Claude Code for web, and Fable 5.1.
Simon Willison describes building a GeoJSON map viewer that displays boundary files and exports maps as PNGs. GPT-5.6-Sol proactively offered to create the tool, and iterations used Claude Code for web and Fable 5.1. He also notes ChatGPT Work will assemble boundary polygons from government data sources when asked.
15
Apple's Siri AI Can Be Swapped Out for Claude, ChatGPT, Code Shows
Code analysis of iOS 27 and macOS Golden Gate frameworks shows Apple engineered Siri to deeply interoperate with third-party AI models like Claude and GPT-5.6.
Code sleuth 'pdfu' uncovered private frameworks in iOS 27 and macOS Golden Gate revealing a 'Model Delegation' mechanism that lets Claude act as a Siri extension like the built-in ChatGPT extension. A second 'Inference Providing' protocol in Model Manager Services can fully replace Siri's server-side model with models such as GPT-5.6, which then receives Apple's Siri planner prompt and tool definitions to perform system actions and process personal data. The EU Digital Markets Act, which requires Apple to give third parties effective access to iOS features, may have shaped this approach. The entitlement is not yet open to third parties and Claude is not yet available in the macOS 27 Golden Gate RC.
58
How hackers used Claude for missiles, drone swarms, and surveillance, while Chinese labs mined it for training data
Anthropic's threat report details eight months of Claude misuse: AI-assisted espionage against 20+ organizations, self-rewriting malware, and Chinese labs distilling Claude via fraudulent accounts.
Anthropic's threat intelligence report covering December 2025 through August 2026 documents Claude misuse across seven categories including cyber operations, surveillance, fraud, and unauthorized model distillation. A Russian-speaking espionage actor tracked as GTG-20006 used AI agents to rewrite and recompile malware evading antivirus detection, targeting more than 20 organizations in Ukraine and Europe and stealing a drone vision system SDK. Alibaba's Qwen lab ran the largest distillation campaign, with over 151 million exchanges between May and July 2026 peaking near 3 million per day to train Qwen 3.5, 3.6, and 3.7. DeepSeek, Moonshot AI, Xiaomi, and Zhipu also relayed customer or replayed traffic to Claude, including PLA-linked users analyzing CCTV footage and users with credentials tied to the Russian Ministry of Defense.
80
30
30
Show HN: Pelican-bicycle alternatives (updated for 2026)
Hobbyist benchmark re-runs the pelican-bicycle SVG test on six 2026 frontier models, comparing generation time and API cost per image.
A Show HN post re-runs the classic pelican-bicycle and similar SVG generation tests across six 2026 models: GPT-6 Astra, Claude Fable 5.1, Gemini 3.8 Flash, DeepSeek V4 Pro, Qwen3.8 Max, and Fugu Ultra v2, recording wall-clock time and cost. It also lists 2025 baseline runs with ten models including Claude Sonnet 4.5, GPT-5.2 Pro, and Qwen3-VL-235B-A22B-Thinking. DeepSeek V4 Pro is consistently cheapest ($0.04-$0.10) while Qwen3.8 Max is slowest, taking up to roughly 17 minutes per generation.
12
How much of F-Droid is LLM generated?
A FOSS maintainer manually graded 102 F-Droid apps from the September 12, 2026 update batch, finding many show signs of LLM-generated code.
A student and FOSS app maintainer reviewed 102 apps pushed to F-Droid on September 12, 2026, assigning each a three-tier rating for likelihood of LLM-authored code (mostly AI >50%, hard to say/mostly human, no signs of AI). The heuristic relies on commit aesthetics, README and branding style, and the presence of agentic infrastructure like Claude Code or Codex, which automatically places an app in the 'mostly AI' tier. Example ratings include Amber (Nostr event signer) as mostly AI, and Aria for Misskey as showing no AI signs. The author stresses reliable detection of LLM-generated code from text alone is impossible, so ratings are approximate.
15
30
35
The Frontier AEO Tracker: What Astra Chooses (and every other frontier model, and what you can do about it)
Latent Space launches an AEO tracker scoring 7 frontier models' product recommendations across 161 categories, revealing generational bias flips.
Latent Space built a tracker measuring Answer Engine Optimization by running 6 prompt variations across 7 frontier models with search enabled over 161 product categories, scoring first choices, alternatives, mentions, and anti-recommendations. It found 28 categories with a universally dominant primary choice and observed soft biases, such as models favoring their own lab's coding agents. Analysis of Anthropic's Sol→Astra and Opus→Fable generations showed newer models consulting fewer sources and being less likely to change answers when questions are paraphrased.
35
[AINews] Andrew Ng gets into AI Engineering
Andrew Ng relaunches DeepLearning.AI around AI Engineering, defining four core skills from an analysis of 10,000+ job postings and expert interviews.
Andrew Ng, cofounder of Google Brain and Coursera, relaunched DeepLearning.AI with a focus on AI Engineering, basing the curriculum direction on an analysis of over 10,000 job postings plus interviews and surveys. He identifies four key skills: building and deploying AI applications, software engineering fundamentals, effective use of coding agents, and shaping the build with product sense. The Latent Space AI News issue also recaps agent ecosystem developments, including NVIDIA's 'Skill Lift' evaluation proposal showing skill scan scores correlate only weakly (Spearman rho = 0.14) with judged quality, and Konwinski's open-source persistent-agent 'microharness' Headlong, which achieved an unattended self-debugging repair in 48 minutes.
35
30