Top story
Claude Code Auto Mode was bypassed; a classifier is not a sandbox
https://embracethered.com/blog/posts/2026/breaking-claude-code-opus-5-and-automode/
Claude Code has started in Auto Mode since mid-August, replacing approval prompts with a safety classifier. In a small targeted test, a malicious page nudged the agent from WebFetch to curl. The downloaded archive baited the model into refusing a supplied binary, then writing a Python decoder inside an attacker-controlled directory; a poisoned struct.py shadowed the standard library and reached C2. That chain worked 3 of 5 times, while a claude -p variant succeeded 4 of 5. Those rates do not invalidate Anthropic’s 0.00% result over 72 different scenarios; they expose the limit of presenting a finite benchmark as a safety boundary. The classifier sometimes allowed compromise and later blocked cleanup. Anthropic marked the disclosure Informative, describing Auto Mode as best-effort rather than a guarantee. kevsim identified the practical failure: Auto Mode can create false confidence outside a sandbox. I would treat it as convenience UX and put controls beneath it—an isolated container or VM, restricted egress, and no mounted SSH keys or cloud credentials.
Infrastructure signal
AI demand pulled Mac mini and Mac Studio off Apple’s consumer cadence. MacRumors reports an early launch as enterprises pursue local models and linked Mac Studios; some configurations have been unavailable for months amid the memory shortage. Aurornis names the real trade-off: local models trail a $20 cloud subscription, but sensitive data stays on-network. I see a privacy purchase, not bargain compute.
An audit map
ChatGPT Work exposes 232 tool interfaces and 44 complete skills. The inventory shows that actual capability is composed from tools, skills, permissions, and plugins. simonw highlights that control-browser even asks the runtime to call browser.documentation() for further instructions. This is useful for auditing why two sessions differ, but it is a snapshot rather than a stable API contract.
All three stories point to the same rule: an agent’s power lives at its boundaries, not in the mode’s name.
— Tin