For builders operationalizing agentic work.
Fail closed: the week three major harnesses decided a guardrail that cannot decide should block
Week 41 of 2026 · October 10, 2026
Big read
The technique to adopt this week is older than agents and newer to them: when a guardrail cannot reach a decision, the action does not proceed. Three harness vendors shipped it at four points inside five days (Cursor had a failClosed setting before this week, as developersdigest.tech's cross-harness comparison of October 9 records, so the week is a convergence, not a first). Claude Code 2.1.295 added onFailure: 'block', so a command or HTTP hook that fails to start, times out or exits unexpectedly now blocks the tool call instead of letting it through, and 2.1.294 fixed hooks written as natural-language instructions that had been allowing what they were meant to block. Codex CLI 0.161 made enterprise MCP (Model Context Protocol, the standard agents use to call tools) authentication fail closed on config refresh and bound every permission grant to the turn that made it; Codex's own pre-tool hooks still have no fail-closed switch in the docs, so the example is scoped to connector auth. Claude Managed Agents restricted web_fetch to URLs that already appeared in the session, returning url_not_in_prior_context for anything the model, the system prompt or a tool output introduced on its own. GitHub's local sandboxing went GA with a managed setting developers cannot weaken, and Copilot CLI added permissions.limitTo for network boundaries, a sandbox that withholds the ambient GITHUB_TOKEN unless configured, and a policy that can force manual approval. Across the frame this publication uses, from Chat to Cowork to Build to Automate, these are all Build and Automate controls, and they share one design decision: the default on uncertainty is no.
The counter-evidence from the same week shows what fail-open costs, and adds the week's non-obvious lesson. Adversa's Cryptographic Context Injection had Copilot CLI in autopilot mode fetch a web page, decrypt ciphertext instructions in its own shell, read a local .env.prod and post it to an attacker in 28 seconds; the chain succeeded on about half of runs when the harness routed to mai-code-1.1-flash and not at all when it routed to GPT-5.6 models, so the only thing standing between the fetch and the exfiltration was which model happened to answer. GitHub validated the chain and ruled it not a vulnerability because the user granted autonomy; the control that addresses the exfiltration step is an outbound network boundary (permissions.limitTo), not the OS sandbox that went GA (generally available) the same week. Adversa's own phrase for the half-the-time result is 'model lottery', and it is the right one. Zenity's AgentCorruption chained an IMDS (cloud instance metadata service, the endpoint that hands out a machine's credentials) request through any HTTP-capable tool with an AgentCore default execution role scoped to every agent in the account-region, a fail-open default at the IAM (cloud identity and access) layer; AWS had already narrowed the role. The practitioner data points the same way: a 97-engineer organization that tripled its merged-PR volume with the same approvers responded with central quality walls that fail anything but a clear pass, and Zest's review data says PR size, not which agent wrote the PR, drives review flag rates; the figures and their caveats are in the proof-of-value table. If you operate agents, the work this week is to find every guardrail in your stack, break it on purpose, pin the model that answers for it, and see whether the action still happens.
Technique of the week
Automate
Fail-closed guardrails: every hook, auth check, fetch gate and quality check blocks when it cannot decide
Last week's technique was to put per-action review in a separate, cheap layer. This week's evidence is that a separate layer is worth nothing if it fails open: a hook that times out and lets the command run, an MCP token that expires and leaves the connector live, a fetch gate that only inspects URLs the user typed, a check run that reports pass when the reviewer crashed. Adversa's 'model lottery' finding adds the second rule: a refusal that held on GPT-5.6 and failed half the time on mai-code-1.1-flash is not a guardrail, so pin the reviewer model and put the control outside it; generalising that pin to every guardrail's reviewer is this issue's extension. The cost of fail-closed is friction; the cost of fail-open is the Adversa chain, which GitHub classified as working as designed. For anyone evaluating an agent vendor the question is now specific: what happens when your reviewer cannot answer, and which model is your reviewer.
- Trigger
- Every point where a guardrail is consulted before a side effect: PreToolUse and HTTP hooks before a shell command or file write, connector authentication before an MCP call, the URL gate before an outbound fetch, the check run before a merge. Enumerate them; the Adversa chain worked because autopilot mode had none between the fetch and the exfiltration.
- Context
- What the guardrail needs to decide, and where it comes from. Fail-closed designs restrict the context to trusted provenance: Managed Agents' web_fetch accepts only URLs already in the user message, a web_search result or a prior fetch, and refuses URLs the model, system prompt, attachments or tool outputs introduced; Donchev's quality walls read rules from the merge base, not the PR branch, so the change under review cannot rewrite its own policy.
- Tools
- The configuration that makes the default no: Claude Code hooks with onFailure: 'block' (2.1.295); Codex enterprise MCP auth that fails closed on refresh and permissions bound to the originating turn (0.161); Copilot CLI permissions.limitTo for network domains, GITHUB_TOKEN withheld from sandboxed shells, and the managed policy that disables Assisted Permissions and forces Manual Approval; AgentCore execution roles scoped per agent rather than per account-region; a check-run mapping where any verdict other than a clear pass is a failure.
- Verifier
- Prove the guardrail fails closed by breaking it: kill the hook process, let the MCP token expire, inject a URL through tool output, crash the quality-wall agent mid-review, and record whether the action proceeded. Then measure the reviewer itself: Codex 0.162's opt-in Decisions-comparison telemetry for Guardian V2 records agreement and latency between the approval reviewer and a decision-model verdict, which is the first vendor harness instrumenting the question of whether a cheap reviewer can hold the gate.
- Escalation
- When the block fires, the action needs an owner. Claude Code's mod tool.check verdict now carries a ceiling field naming the organization-required approval; Copilot CLI's 1.0.96 timeline records whether a human, Assisted Permissions, policy or unattended fallback made each decision; Elastic's AlertZero emits Proposed Actions for approve, modify, escalate or dismiss with a manual, assisted or supervised autonomy level per agent. Blocked actions should route to a named approver with the provenance attached, and the rate of blocks that were later approved is the friction metric to publish internally.
- Claude Code 2.1.295: hooks with onFailure: 'block' stop the tool call when the hook cannot start, times out or exits unexpectedly; 2.1.294 fixed instruction-style prompt and agent hooks that were allowing what they should block; 2.1.292 closed a bypass where PreToolUse approvals and auto mode skipped the permission prompt for UNC network-path reads.
- Codex CLI 0.161.0: enterprise MCP authentication fails closed on config refresh; an approved filesystem escalation can widen writes but preserves denied reads and network restrictions; background tasks keep the permissions of the turn that started them. Codex's pre-tool hooks have no documented fail-closed switch (documented failure paths continue the tool call, per developersdigest.tech), so the example is connector auth, not hooks.
- Claude Managed Agents (Oct 7): web_fetch returns url_not_in_prior_context for any URL not already in the session, and session creation fails with a 400 if a web tool's allowed_domains falls outside the environment's allowed_hosts.
- GitHub local sandboxing GA (Oct 7): one sandbox policy mapped to native OS controls on Windows, macOS and Linux, enterprise-managed so developers cannot weaken it; Copilot CLI 1.0.92-1.0.95 add permissions.limitTo, GITHUB_TOKEN withholding and a forced-manual-approval policy.
- Donchev's quality walls (Oct 8): 222 rules evaluated as investigation leads, a verdict-to-check-run mapping where anything but a clear pass fails, rules read from the merge base, required checks across ~100 repos generated from one fleet file. The fail-closed layer is the CI check run; the Claude Code PreToolUse hook that prompts for a local precheck before git push and gh pr create is advisory shift-left by design ('deliberately easy to skip' with a reason; local records are editable and CI remains authoritative).
- Negative examples: Adversa's CCI (Copilot CLI autopilot, .env exfiltration in 28 seconds; the only barrier was the routed model's refusal, which held on GPT-5.6 and failed about half the time on mai-code-1.1-flash) and Zenity's AgentCorruption (AgentCore default role scoped to every agent in the account-region, since narrowed by AWS).
New agent capabilities
2026-10-09 · Anthropic · Build
Claude Code 2.1.290-2.1.296
Operators running subagent teams get three cost controls (effort per subagent; a single pinned model for workflow agents, where Haiku 5.5 is the obvious candidate; and autoCompactWindow, which on a Haiku-pinned subagent should sit below the 100K-token price step, which the new tokenizer reaches 20-23% sooner, at about 77K of old-tokenizer text, though one practitioner report (wmedia.es, October 9) finds 100K thrashes and 130K is the working setting in Claude Code, so measure) and two safety controls (fail-closed hooks, the ceiling field that names the required approval). Upgrade past 2.1.294 before relying on any natural-language hook, because earlier versions were silently allowing what those hooks described blocking.
2026-10-08 · OpenAI · Build
Codex CLI 0.161.0-0.162.1
The default-model change moves every Codex user to the $2 / $10 tier with $0.10 cache reads without a config change, which is a cost event teams should notice on their next invoice. The Guardian telemetry is the one to enable if you want data on whether a cheap reviewer can take the approval path; it records agreement and latency, not verdict overrides, so it is measurement rather than enforcement.
2026-10-07 · GitHub and Microsoft · Build
Local sandboxing GA; VS Code 1.141; Copilot CLI 1.0.92-1.0.96
This is the first mainstream coding agent where an enterprise can require the sandbox and the developer cannot turn it off, which changes the control conversation from policy to configuration. The permission-provenance timeline is the audit artefact security teams have been asking for; pair it with the Adversa disclosure, which shows what autopilot mode does without a network boundary, and set permissions.limitTo before enabling autonomy.
Sources GitHub Changelog
2026-10-09 · Anthropic · Automate
Claude Managed Agents (beta)
Dynamic workflows are the Automate pattern with the orchestration written by the agent itself, which raises the stakes on the fetch gate shipped two days earlier: a program that spawns phases of subagents needs a hard boundary on what any of them can reach. Operators should treat the prior-context URL rule as the model for every outbound tool, and should scaffold with /claude-api managed-agents-onboard rather than hand-building the pattern.
Sources Claude Platform release notes
2026-10-08 · Elastic · Automate
AlertZero (Technical Preview)
Per-agent autonomy levels with mandatory approval for consequential actions are the right control surface for a SOC, and the first from a major security vendor. The read is conditional: PromptArmor's August injection chain against Elastic's Agentic SOC is still listed as unaddressed and the AlertZero release does not reference it, so buyers should apply PromptArmor's interim mitigations (remove execute_esql and execute_workflow, restrict egress) and ask Elastic in writing whether AlertZero's approval gate sits outside the acting model.
Sources Elastic Security Labs
2026-10-05 · Google · Chat
Gemini skills in Workspace (Rapid Release)
Claude- and Codex-authored skills now run in Gemini without translation, which makes the skill library a portable asset across three vendors. The operational cost arrived the same day: Workspace Studio automations built on Gem steps cannot be extended, skills do not sync between the Gemini app and Workspace, and Gems retire for business accounts no earlier than March 1, 2027, so the migration clock is running.
Sources Google Workspace Updates; Simon Carter (practitioner write-up)
2026-10-06 · Cursor · Cowork
Remote Control for local agents (iOS)
A new mobile control surface for local agents that is on by default for Business and individual users, which means most organizations have it already. Security teams should decide the Enterprise setting deliberately and should treat the pairing approval as the only gate, because a paired phone can send instructions to an agent with the developer's local permissions.
Sources Cursor changelog
2026-10-08 · Google Cloud · Automate
Gemini agent (private preview)
An agent with a directory entry is an identity your IAM team must govern like a contractor, and one that reaches ServiceNow and Salesforce through MCP is traffic those vendors are now metering. The permission model and the metering unit are both unpublished before GA; The Application Layer carries the pricing, and the control question here is whether the coworker agent's data access can be scoped per objective or only per identity.
Sources Google (The Keyword)
New skills and connectors
2026-10-09 · Claude Code and MCP · Connector
MCP protocol 2026-07-28 negotiated by default; claude plugin install --marketplace
Longer tool descriptions mean richer schemas reach the model, which improves tool selection and enlarges the injection surface in the same move; operators who curate MCP servers should re-review descriptions at the new limit. The marketplace flag makes plugin provenance a configuration, which is what an enterprise allow-list needs.
2026-10-08 · Codex · Connector
/mcp login, managed Git worktree tools, Decisions-comparison classifier for Guardian V2
The worktree tools are the practical fix for the isolation problem practitioners describe for long autonomous tasks; the Guardian telemetry is the first harness-level instrument for the question Agent Techniques has tracked since W39, whether the approve/flag/block call can move to a cheap decision tier. Turn it on in a staging org and keep the agreement numbers.
2026-10-06 · Atlassian · Connector
Atlassian MCP (rebuilt): 220+ tools, 15M+ calls a day
The first disclosed traffic figure for a major system-of-record MCP server, and the datapoint that makes MCP a measurable distribution channel rather than an integration pattern. For connector designers it is the scale at which rate limits, tool-description curation and per-call metering become product decisions; The Application Layer covers the tolling that follows.
Sources Atlassian (Inside Atlassian)
2026-10-08 · Claude Code (community) · Plugin
Quality-wall plugin: advisory PreToolUse precheck before git push and gh pr create, with CI as the authoritative gate
This is the transferable template: a shift-left prompt at the agent (the hook) and the fail-closed gate at the repository (the required check), with the rule catalogue owned centrally and read from the merge base. Teams whose agent PR volume has outrun their approvers can copy the structure in a week; the 222 rules are the organization's, the pattern is not.
Sources Bobby Donchev, 'Quality walls: the bottleneck is verification'
2026-10-06 · Pi · Harness
Codemode: harness-side QuickJS/WASM sandbox with progressive MCP discovery
A sandbox whose only capability is tool invocation is the natural place for a fail-closed review layer, because the orchestration code can be inspected before any side effect occurs. If Codex runs a codemode layer, as Ronacher reads it (his post is the only source for that; OpenAI has not described it), the question for OpenAI is concrete: does Guardian V2 see the orchestration code before it executes, or only the individual tool calls after? Ronacher names in-flight durability as unsolved, which is the gap to watch before using Codemode for long-running automation.
2026-10-08 · Local serving · Connector
LM Studio 0.4.26 /v1/decisions endpoint; Copilot CLI local Ollama discovery
A local typed-verdict endpoint means the approval reviewer can run on the developer's machine with no network dependency and no per-call cost, which removes the two usual objections to a separate review layer. The Model Pulse carries the hosted decision-model price table; this is the on-device end of the same pattern.
Sources LM Studio changelog
Proof of value
Evidence · Confirmed
Adversa AI (against GitHub Copilot CLI autopilot) · Autonomous web fetch with shell access, opt-in autopilot mode
Confirmed by the vendor as reproducible, disputed only on classification. The useful lesson is the one GitHub's ruling concedes: once autonomy is granted, the only layer between a fetch and an exfiltration was the model's own refusal, so the controls have to be outside the model. Which control addresses which step matters: the exfiltration was an outbound HTTP post, which permissions.limitTo (a network boundary) addresses; the .env read is what GITHUB_TOKEN withholding and the OS sandbox narrow; neither the sandbox GA nor the ruling claims the sandbox alone stops the chain. The model-routing dependence is Adversa's own headline ('It is a model lottery'), and the generalisation here is to pin the reviewer model behind every guardrail, not only Copilot's. Treat tool-side code execution as a decryption oracle for any text filter.
Sources Adversa AI; The Register
Evidence · Confirmed
Zenity Labs (against AWS AgentCore) · Hosted agents with HTTP-capable tools under a default execution role
Confirmed and remediated at the platform level, which makes it a reference case rather than an open risk. The transferable finding is that a default role is a fail-open guardrail: it grants until someone narrows it. Scope execution roles per agent, block IMDS from tool egress, and audit any AgentCore deployment created before the role change. Agents deployed under the old default keep its scope until redeployed.
Sources Zenity Labs
Evidence · Practitioner Report
Bobby Donchev (97-engineer organization) · Agent-authored pull requests through a central quality-wall review and required checks
A single organization's self-report, with two outcome numbers (reverts at or below about 0.5% of merged PRs in every window; median time to first human review 25-48 minutes, both from Donchev's post at donchev.is and not in the graded packet's summary) and the author's own caveat that a flat revert rate 'isn't proof that quality held'; no defect-escape measure is published. It is the most complete public description of fail-closed verification at scale, and the merge-base rule is the detail to copy first: it closes the path where an agent-written PR edits the policy that would have blocked it. Donchev's framing, that the bottleneck has moved from writing code to verifying it, is the phrasing this issue's pattern borrows. Ask for a defect-escape number before treating the 3.3x as sustainable.
Sources Bobby Donchev, 'Quality walls: the bottleneck is verification'
Evidence · Practitioner Report
Zest (Ilya Volodarsky) · Agent-written pull requests across two repositories, August 12 to October 4
Two repositories and self-reported session blocks, so a sample rather than a benchmark, and the 95% Claude Code share describes one team's tooling. The durable finding is the size effect: the lever that controls review flag rates is PR size, not agent choice, which argues for harness rules that cap diff size before the quality wall ever runs. The 1.6% human handoff rate is the number to compare against your own review queue.
Sources Zest
Evidence · Vendor Claim
SAP (internal deployment) · Joule Work across finance, HR and procurement for 110,000 employees
An internal deployment figure from the vendor with no method, baseline or definition of productivity published, announced in the same keynote that priced the product. Treat it as a scale claim and not as an efficiency result. The number a customer can verify is actions per task, which SAP has not published and which The Application Layer tracks.
Sources SAP News Center
Evidence · Vendor Claim
OpenAI (mathematics release) · Unreleased frontier model posed ~4,000 research problems; 722 manuscripts published with citation and revision protocols
Relevant here as a verification case, not a mathematics one: a large unverified output set with a 22% machine-checked fraction and an early withdrawal rate is the Automate failure mode in another domain, and the citation and revision protocols are the fail-closed layer arriving after publication rather than before it. The label is vendor_claim with a partial independent check, because the output set is the vendor's and only the Lean coverage has been audited. The metric that would settle its value is the error rate on the unverified majority, which nobody has measured.
Enterprise readiness
Permissioning
Codex binds grants to the turn that made them and lets an approved filesystem escalation widen writes while preserving denied reads and network limits; GitHub makes the sandbox enterprise-enforceable; Zenity's case shows the opposite default at the IAM (cloud identity and access) layer. Scope agent execution roles per agent, and audit anything created under a platform default.
Verification
Donchev's merge-base rule and strict check-run mapping, Codex's Guardian-versus-Decisions telemetry and the OpenAI mathematics corpus (22% machine-checked) are the week's three verification datapoints. The design rule they share is that an absent or ambiguous verdict is a failure; the measurement gap is that no vendor yet publishes reviewer agreement rates.
Auditability
Copilot CLI 1.0.96's permission-decision timeline (human, Assisted Permissions, policy or unattended fallback) and Claude Code's ceiling field on mod verdicts are the first harness artefacts that record who authorized each action and what approval was required. Cursor's remote-control pairing is a new control surface that needs the same record and does not yet have one.
Cost
Three cost levers landed: Haiku 5.5 as a pinned subagent or reviewer model (set autoCompactWindow below the 100K-token price step, which the new tokenizer reaches 20-23% sooner), Sonnet 5.5 cache reads halved (about 20% off typical agentic bills on Anthropic's estimate), and Codex defaulting to GPT-6.1 Sol. Against them, Sol Ultrafast and SAP's per-action meter make the cost of an agent depend on configuration choices rather than on list price; The Model Pulse has the rate cards.
Data Access
Managed Agents' prior-context URL rule and allowed_hosts enforcement, Copilot CLI's domain limits and GITHUB_TOKEN withholding, and the Adversa .env exfiltration are the same control seen from three sides. The rule to adopt: an agent may fetch only destinations with trusted provenance, and ambient credentials are not visible to sandboxed shells unless configured.
Human Approval
Elastic's per-agent autonomy levels with mandatory approval of consequential actions, Copilot's forced-manual-approval policy and Claude Code's organization-required ceiling all put a named human in the loop by configuration. The open question is reviewer load: Donchev's busiest approver handled 263 approvals in two weeks, which is where approvals become rubber stamps unless a cheap reviewer screens first.
Reliability
Two shipped guardrails were found allowing what they should block (Claude Code's instruction-style hooks before 2.1.294, the UNC-path bypass before 2.1.292), and one platform default granted far more than intended (AgentCore). Guardrail regressions are now a release-notes category; pin harness versions, read the security lines on every upgrade, and re-run the break-your-guardrail test after each one.
Scorecard
As of 2026-10-10
| Mode | Leading pattern | Representative tools | Control gap |
|---|---|---|---|
| Chat | Portable skills across three vendors, with the first migration breakage: SKILL.md live in Workspace, 'Ask a Gem' steps frozen | Gemini skills in Workspace (Rapid Release from Oct 5), Claude skills, Codex skills | Skills do not sync between the Gemini app and Workspace, and Workspace Studio flows built on Gem steps cannot be extended; there is no cross-vendor skill provenance or signing yet. |
| Cowork | Agents that follow the user across surfaces: a phone that messages a local agent, a coworker agent with its own directory entry, dashboards that query the warehouse on the user's credentials | Cursor Remote Control (iOS), Google Gemini agent (@agents identity, private preview), Claude Dashboards (beta) | Cursor's pairing approval is the only gate on a new mobile control surface; the Gemini agent's permission model and metering are unpublished; Dashboards runs SQL on production data under whatever warehouse scope the user holds. |
| Build | Fail-closed hooks, turn-bound permissions and enterprise-enforced sandboxes, with the first instrument for measuring the reviewer itself | Claude Code 2.1.295 onFailure: 'block', Codex CLI 0.161-0.162 (fail-closed MCP auth, Guardian V2 Decisions telemetry), GitHub local sandboxing GA; Copilot CLI permissions.limitTo, Donchev quality-wall plugin | The Adversa chain shows autopilot mode's only barrier after autonomy was granted was the routed model's refusal, which held on GPT-5.6 and failed about half the time on mai-code-1.1-flash, and GitHub classifies that as intended; in Copilot CLI autopilot the model that answers for that refusal is routed, not pinned, and no harness yet discloses the reviewer model behind its approval path; guardrail regressions shipped in two Claude Code versions before being fixed; no vendor publishes reviewer agreement rates. |
| Automate | Server-side multi-agent workflows with provenance-restricted egress, and SOC agents with per-agent autonomy levels and mandatory approval | Claude Managed Agents dynamic workflows + prior-context web_fetch, Elastic AlertZero (Technical Preview), AWS AgentCore (post-role-narrowing) | Elastic's August injection disclosure remains publicly unaddressed; AgentCore deployments created under the old default role keep its scope until redeployed; dynamic workflows multiply the number of agents behind one approval. |
Try this
Break your own guardrails: a one-week fail-closed audit of one agent
Expected outcome: A written inventory of the agent's guardrails, a before-and-after record showing which ones failed open and now fail closed, a one-week friction ratio (blocks later approved over total blocks) to set expectations with the team, and, where telemetry was enabled, a first agreement rate between the approval reviewer and a cheap decision model. Expect to find at least one fail-open gate; both Claude Code and AgentCore shipped one this quarter.
- Pick one agent in production or staging and list every point where a guardrail is consulted before a side effect: pre-action hooks, connector authentication, outbound fetch rules, and merge or deploy checks. Write each one down with the configuration that controls it.
- For each guardrail, induce the failure it was not designed for and record whether the action proceeded: kill the hook process mid-evaluation and let one time out; expire or revoke the MCP credential and refresh; introduce a URL only through a tool output or the model's own text and ask the agent to fetch it; crash or stall the quality-check agent during a review.
- Convert every fail-open result to fail-closed using the harness's own controls: onFailure: 'block' on Claude Code hooks (2.1.295 or later), enterprise MCP auth and turn-bound permissions on Codex 0.161 or later, permissions.limitTo and token withholding on Copilot CLI, allowed_hosts and the prior-context fetch rule on Managed Agents, a check-run mapping that fails anything but a clear pass, and an execution role scoped to that one agent.
- Pin the model that answers for each guardrail. Where the harness routes across models (Copilot CLI autopilot, the Gemini agent, any gateway that picks on capability or cost), fix the reviewer or classifier model explicitly (CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL for Claude Code workflow agents is the current example) and re-run step 2 against each model the harness could have routed to; a guardrail that blocks on one model and passes on another is recorded as fail-open.
- Re-run the same failures and confirm each one now blocks. Then measure the friction: count blocked actions over the week and how many a human later approved; that ratio is the cost you are paying for the control.
- If the harness supports it, enable reviewer telemetry (Codex 0.162's Guardian-versus-Decisions comparison, or a shadow call to a local /v1/decisions endpoint in LM Studio) and keep the agreement and latency numbers; they are the evidence for whether a cheaper reviewer can take the gate next quarter.
Watchlist
Oct 12-15
Gemini skills complete Rapid Release rollout (Oct 12) and reach the Gemini app (Oct 13); Scheduled Release domains from Oct 19
The first week of the three-vendor skill library in general use, and the week the 'Ask a Gem' freeze starts hitting Scheduled Release admins who have not migrated Workspace Studio flows.
October
First published agreement and latency figures from Codex's Guardian V2 Decisions-comparison telemetry
Resolves whether a decision-model verdict matches the approval reviewer often enough to take the approve/flag/block call; it is also the evidence the weekly's small-reviewer prediction (a named sub-10B reviewer in a major platform's approval path by March 31, 2027) is waiting for, and Microsoft's disclosure that Decision-1 is a post-trained 9B Qwen (per Microsoft's post, outside the graded set) gives that prediction a second candidate.
Open
GitHub's position on Cryptographic Context Injection after sandboxing GA; whether autopilot mode gains a default network boundary
GitHub ruled the chain not a vulnerability the week before shipping controls that address its exfiltration step; a default permissions.limitTo in autopilot would be the fail-closed answer.
Open
Elastic's response to PromptArmor's Agentic SOC disclosure and whether AlertZero's approval gate runs outside the acting model
The disclosure is seven weeks old and unaddressed; AlertZero's autonomy levels are the right design only if the gate is not itself injectable.
Q4 2026
Claude Managed Agents dynamic workflows and Gemini agent GA, with their permission models
Both multiply agents behind one approval; the control to look for is per-phase or per-objective scoping of data access rather than per-identity.
Q4 2026
Post-wall outcome metrics from Donchev's organization and a second practitioner dataset on agent PR review
The 3.3x throughput figure has a flat revert rate and a 25-48 minute first-review median behind it but no defect-escape number, which is what would make it a result rather than a design; Zest's size effect needs replication outside two repositories.
Changelog
- 2026-10-10: Issue 25 published. Technique: fail-closed guardrails, with the four harness implementations of the week (three vendors) as examples and the Adversa and Zenity disclosures as negative cases. Scorecard: the build row moves from in-harness review hooks to fail-closed hooks and enforced sandboxes with Guardian V2 telemetry as the measuring instrument; the automate row adds Managed Agents dynamic workflows and Elastic AlertZero; the cowork row moves from per-app approvals to cross-surface agents (Cursor Remote Control, Gemini agent, Claude Dashboards); the chat row records the first skill-migration breakage.
- Evidence labels: Adversa and Zenity are 'confirmed' because the vendors validated the chains; Donchev and Zest are 'practitioner_report' with sample caveats stated; SAP's internal deployment figure is 'vendor_claim'; the OpenAI mathematics corpus is 'vendor_claim' with a partial independent check and is carried as a verification case. Vendor speed and productivity figures are labelled at every use.
- Fact homes: Haiku 5.5 and Sol Ultrafast rate cards live in The Model Pulse; SAP, Workday and Atlassian pricing live in The Application Layer; the Lean-verification dispute lives in the AI Stack Weekly. This issue carries the headline numbers from each and points to the home for the rest.
- 2026-10-10 (corrections, cycle 1): Vendor count is three (Anthropic, OpenAI, GitHub) at four points, with Cursor's prior failClosed setting acknowledged per developersdigest.tech; the Codex example is scoped to enterprise MCP auth; the routed-model dependence of the Adversa chain is promoted to the technique with a pin-the-reviewer audit step; Donchev's PreToolUse hook is described as advisory with CI authoritative; Zest's size figures are scoped to all 1,232 reviewed PRs with the agent-only matched result stated separately; the OpenAI mathematics evidence label changes from 'benchmark' to 'vendor_claim'.
- 2026-10-10 (corrections, cycle 2): Adversa's 'model lottery' phrasing is credited where the routed-model lesson is introduced, with the generalisation to every guardrail's reviewer kept as this issue's; Ronacher's reading that Codex relies on a codemode layer is marked as resting on his post alone; the tokenizer effect on the compaction window is stated as 20-23% sooner (about 77K old-tokenizer tokens); OpenAI's Code Mode and Pi's Codemode are distinguished at first use; GA is glossed. Figures used without a graded citation, labelled at point of use: Donchev's revert rate (at or below about 0.5%) and 25-48 minute first-review median (donchev.is); Microsoft-Decision-1's post-trained Qwen3.5-9B base (Microsoft's post); the wmedia.es 130K autocompact finding.