Developer Tools
25 articles
-
Claude CodeClaude Code's Allow Rule Is the Whole Command, Password Included
Apiiro found 2,539 real secrets in 1,994 public GitHub repos, most of them in .claude/settings.local.json, the file Claude Code writes when you pick "Yes, and don't ask again". On 2.1.319 the rule it saves is the full command string, PGPASSWORD= and bearer header included, with no prefix and no redaction. Claude Code keeps the file out of git with one line in the global excludes file in your home directory, not the repo, so a clone elsewhere stages it with git add -A, and once the file is tracked the exclude does nothing. When the file is already committed, Claude Code notices and prints that it is ignoring the file's allow rules until you trust the workspace, then appends the next approved command, token included, to the same tracked file.
-
Claude CodeClaude Code's Auto Mode Check Rides Inside Your Request
Claude Code 2.1.319 (6 November) runs auto mode's safety check inline. I captured the traffic: each agentic turn carries a safeguards block on the normal inference request, and the verdict comes back inside the same response's message_delta, not from a separate classifier call. That block ships the server your working directory, home directory, and the exact launch command. The same release removed the fallback to the built-in classifier when telemetry or feature flags are off or you sit behind an LLM gateway, so a proxy that buffers or rewrites the stream causes a denial, and claude -p now exits 1 where it used to exit 0.
-
CodexTurn On Codex Memories and a Hidden Agent Starts Up
Codex CLI 0.165.0 (27 October 2026) made memory v2 the default for fresh profiles. Hands-on with eleven empty CODEX_HOME directories: 'fresh' means ~/.codex/memories does not exist, an empty folder with that name keeps a new install on v1, memories.version accepts only the strings "v1" and "v2", memories.dual_write = false pins v1, and neither key is in the configuration reference. Memories stay off by default, and the v1 database file is created even then. With memories on, the first start spawns a hidden consolidation agent on GPT-5.6 Terra (medium effort, approvals never, workspace-write sandbox, network off) that runs rg, sed, find and git inside the empty memory folder; when codex exec exits within about 15 seconds the job is recorded as failed_agent with a retry exactly 3,600 seconds later, and with a 90-second turn it finished in 23 seconds and wrote a 241-byte template summary. The external_agent_memory_import flag the release note implies is under development and off.
-
Gemini APIGemini Now Keeps New Paid Projects' Requests for 55 Days
Since 26 October 2026, Gemini API projects created on the paid tier store every generateContent, streamGenerateContent and batchGenerateContent request for 55 days by default, matching the Interactions API; existing projects keep storage off. The per-request opt-out is a top-level store:false, which the REST API accepts on v1beta, v1 and streaming and rejects inside generationConfig, on countTokens and on the OpenAI-compatible chat/completions endpoint (400 in both states). Captured on a local server: @google/genai 2.30.0 accepts config.store and sends the request without it; 2.31.0 sends it. google-genai 2.32.0 raises a pydantic ValidationError; 2.33.0 sends it. The SDK versions that can send the field shipped on 23 October, three days before the default flipped. An interaction created with store:false comes back with no id. Nothing in a generateContent response says whether it was stored. The new gemini-api CLI runs on the Interactions API, stored by default.
-
Claude CodeClaude Code's New Write Block Misses a printf Redirect
Claude Code 2.1.314 (30 Oct 2026) adds permissions.blockWritesOutsideWorkingDirectories. In 24 headless runs the Write and Edit tools refused every path outside the project, including through a symlink, in /tmp, and with Write(*) and Edit(*) allow rules that let the same write through when the setting was off. A printf redirect in Bash to the same folder went through, because the shell redirect check consults Edit rules and working directories, not this block. Side effects: settings.json in any .claude folder becomes a hard refusal, EnterWorktree and ExitWorktree disappear from the tool list, repository-supplied additionalDirectories don't count, 2.1.312 ignores the key silently. Auto-memory and the session's plan file still save. The settings reference has no entry yet.
-
Claude CodeClaude Code Reroutes Your Pinned Sonnet ARN to Opus 4.8
Claude Code 2.1.312 (27 Oct 2026) extends its post-refusal model switch to model names it doesn't recognise, so a flagged session on a Bedrock application inference profile ARN now moves to a region-prefixed Opus 4.8 ID (Opus 5 for bio and frontier_llm) for the rest of the session, at 2.5x Sonnet's list price if the profile fronted Sonnet 5.5. On 2.1.311 the refusal stood. The same release cuts the ARN's first request from 27,204 to 5,917 characters of system prompt and 46,609 to 30,326 characters of tool definitions. Tested with 34 headless runs against a local fake Bedrock and Anthropic endpoint; modelOverrides, availableModels, ANTHROPIC_DEFAULT_OPUS_MODEL, switchModelsOnFlag and the two CLAUDE_CODE_DISABLE_REFUSAL_* variables are the controls that worked, ANTHROPIC_DEFAULT_SONNET_MODEL is not.
-
OpenAIOpenAI's 12-Hour Cache Can Make You Pay Twice
On 20 October OpenAI added a 12-hour minimum prompt-cache lifetime to the Responses API at 2.5x the input price per write, against 1.25x for the default 30 minutes, with reads priced the same under both. Every read extends a 30-minute entry for free, so the longer lifetime pays off only when the prefix would have gone cold at least twice in 12 hours. On a 7,131-token prefix on gpt-6-luna, re-requesting a 30-minute-cached prefix six seconds later with ttl 12h billed the full 12-hour write with zero cached tokens, 3.75x in total, as the guide documents. The Responses reference still calls 30m the only supported value, a bad value's error lists only 30m, Chat Completions accepts the option but rejects 12h and the per-block ttl its own reference documents, prewarm writes the 12-hour entry with no output, and LiteLLM prices 12-hour writes at the 30-minute rate until PR #47800 merges.
-
AnthropicAnthropic's New SDKs Can Drop Your API Key Behind a Gateway
On 21 October Anthropic released API version 2026-10-21, the first since 2023-06-01, with new SDK majors (Python 2.0.0, TypeScript 1.0.0, Go 2.0.0, Java 3.0.0, C# 13.0.0, PHP 1.0.0, Ruby 2.0.0, ant CLI 2.0.0) that send it by default and on which temperature, top_p and top_k return a 400 even at default values. The SDKs also move the API key from X-Api-Key into Authorization: Bearer. On a local capture server, a gateway token set in that header through default_headers replaced the key outright with no error; the guide's fix (auth_token plus X-Api-Key in default_headers, with the gateway stripping its own Authorization) and the undocumented version pin (default_headers anthropic-version 2023-06-01 plus extra_body temperature) both produced the expected request. LiteLLM reads Authorization before x-api-key, so its virtual keys still arrive.
-
Agent SandboxesPerplexity's Open-Source Sandbox Leaves Half the Fix Off
Perplexity's 23 September red-team report on its SPACE agent sandbox found 0 of 108 VM escapes but 11 of 54 network-policy bypasses by four models, through forged DNS replies and CDN IPs PyPI shares on Fastly, and fixed both by validating source addresses and checking SNI and the HTTP Host against the allowlist. In the code Perplexity open-sourced on 15 October, the plain-HTTP half of that fix always runs, but the HTTPS half only runs when a policy sets tls_interception to on; an unset value and the E2B wrapper both default to off, where the gateway checks SNI and DNS attribution and relays the encrypted stream opaquely, the same check the report showed failing on seven other sandbox platforms through domain fronting.
-
Claude CodeClaude Code Compacts Idle Chats, and Has Since September
On 14 October the Claude Code 2.1.299 changelog documented idle compaction: a 200K+ token terminal conversation left idle for about 54 minutes is summarized before its one-hour prompt cache expires. The behavior had been live since 2.1.286 on 30 September through a server-side flag, the idleCompaction opt-out shipped in 2.1.290 on 5 October without a changelog line and was documented by a user reading the binary, and the /config row came in 2.1.302 on 16 October. At Opus 5.5 list prices it trades a $1.60 cold rebuild of a 200,000-token prefix for a $0.04 cache read and a roughly $0.40 summary, runs only on the one-hour TTL that subscribers get within plan usage, summarizes away path-scoped rules, nested CLAUDE.md files and hook-injected context, and records itself as trigger auto, so a PreCompact hook can only tell it from a context-limit compaction by checking the transcript's age.
-
OpencodeOpenCode's Exposed Keys Ignore the Budgets You Set
On 17 October OpenCode told 1.4% of its hosted Console users that the Anthropic, OpenAI and Google keys saved in their workspaces may have been exposed through unauthorized access to a legacy system being decommissioned, and called it a large scale distillation attack; the keys were there by design, because Console stores the credential and serves it through its gateway so members never see it, and the monthly budget Console offers is enforced by that gateway, so a lifted key used directly against the provider answers only to the provider's own limit: Anthropic caps spend per workspace but not on the Default Workspace, OpenAI's hard limit is per organization or project and not instantaneous, and Google offers billing alerts and no cap. Revoke at the provider, not in Console, and give every third-party gateway a capped workspace or project of its own.
-
GitHub ActionsGitHub's Actions Lockfile Skips the Docker Image
On 14 October GitHub put workflow dependency lockfiles into public preview: gh actions-lock writes .github/workflows/actions.lock, every action in an onboarded workflow runs at the recorded commit, and a Require lockfile policy can block anything else. The lock stops at the container: a Docker action's image is named in its own manifest and pulled by tag at job start, the extension warns only for a docker:// step written directly in your workflow and only on an online run, and a launch-day scan of 1,802 repositories found a silently floating image behind a locked action in 9.8% of them, 21.2% counting unpinned Dockerfile base images. By Friday the tracker also held unlocked reusable workflow calls, actions inside parallel: groups left out, and a fork-only commit that passed --verify and ran under the policy; my own offline run of the documented pre-commit check reported complete coverage over all of it.
-
OpenAIOpenAI Retires GPT-4o Early. Its Replacement Rejects Temperature.
On 14 October OpenAI told developers that GPT-4o, GPT-4o mini, GPT-4.1 and GPT-4.1 mini leave the API on 14 January 2027, 92 days later, while the same deprecations page promises generally available models at least six months of notice and gives no reason for the shorter window. The replacement named for all four is gpt-6-luna at $0.10 and $0.50 per million tokens, a reasoning model that defaults to medium effort: swapping the model ID into a GPT-4o-style Chat Completions call returns a 400 for temperature, a 400 for a function tool and a 400 for max_tokens until reasoning_effort is set to none, and at its default it costs more per call than GPT-4o mini on a one-word classifier. Fine-tuned versions die the same day, new fine-tuning jobs end on 6 January, Luna cannot be fine-tuned, Predicted Outputs is left with no model, and Azure runs the same snapshots until 14 April 2027.
-
MetaMuse Wonder Full Isn't the Model You Get on the API
Meta released Muse Wonder and Muse Wonder Full on 12 October. Artificial Analysis scored Full at 56 on its Intelligence Index, two points behind Claude Opus 5.5, and Wonder at 52, but only Wonder is in the Meta Model API, at $4 per million input and $20 per million output, the same as Opus 5.5. Full is 'Not available' on the API and sold only on the $50 and $200 Muse Code plans, and Meta's models page says that setting reasoning effort to max on Wonder doesn't select it. At the Opus price Wonder costs $4.52 per index task, 76% of it input from 7.69 million input tokens per task, and the subscription that carries Full defaults to Contributor mode, where your prompts, code and files train future Meta models.
-
GoogleGemini 4 Argon Is Cheap Per Token, Not Per Task
Google made Gemini 4 Argon generally available on 13 October at an introductory $2 per million input tokens and $10 per million output, a fifth of GPT-6 Astra and half of Claude Opus 5.5, with the price doubling to $4 and $20 on 1 December. Artificial Analysis scored it level with Astra on its Intelligence Index but found it costs 60% of Astra per task, not 20%, because Argon averages 62,000 output tokens per task against Astra's 27,000; at the standard price that becomes $3.98 per task against Astra's $3.26. The migration guide also makes max_output_tokens a hard cap on thinking plus output and tells you to raise it to at least 32,768, silently ignores temperature, top_p and top_k, and drops explicit caching entirely.
-
OpenAICodex Now Leaves a Server Running After You Quit
Codex CLI 0.157.0, released 25 September, enabled daemon_auto_start by default: a plain `codex` launch now starts `codex app-server --managed-daemon`, a process that outlives every Codex window, copies a 374 MB package into ~/.codex/packages/app-server-daemon/, and spawns a detached updater that checks chatgpt.com five minutes after start and hourly after that. An update restarts the shared server with a 60-second grace period before force-kill, across every attached session. The config reference, developer command list and changelog do not mention daemon_auto_start or --no-daemon; the updater can only be disabled by editing a settings.json documented in a README inside the source tree. The GitHub issue filed on release day reached 540 points on Hacker News on 12 October with no reply from an OpenAI account.
-
InterpretabilityA New Tool Reads What the Model Didn't Say
Anthropic open-sourced the Jacobian lens, a technique that reads the words a model is leaning toward before it writes them, and DeepMind reproduced it on a different model. The practical part is not the consciousness headline. It is that a model can hold a thought, including that it is being tested, without saying it.
-
AgentsGPT-5.6 Stops Running Your Tools Through the Model
GPT-5.6 shipped programmatic tool calling: the model writes code that runs your tools in a sandbox instead of calling them one at a time. OpenAI, Anthropic, and Cloudflare all reached the same conclusion, that the model was never a good place to run the tool loop.
-
AgentsThe Agent Failed for Weeks and 4,286 Tests Stayed Green
A June 2026 study tracked 22 production incidents in a live LLM agent runtime. In most of them the system was already broken while all 4,286 tests and 827 governance audits stayed green. Agents fail in the seams your tests never watch.
-
Developer ToolsGitHub Wasn't Built for Billions of Agents Hammering One Server
Entire, from former GitHub CEO Thomas Dohmke, mirrors your repo into regional nodes so agents stop hammering one central Git server. The real signal is the bottleneck moving from the model to the plumbing built for human-paced work.
-
Developer ToolsZ.ai's ZCode Puts the Agent in the Center and the Editor on the Edge
Z.ai shipped ZCode, an agent-first coding tool where the chat is the main window and the editor is one panel around it, running on the cheap open-weight GLM-5.2. The shift to watch is not the benchmark, it is where the cursor lives.
-
AgentsAWS Built a Backend Framework That Expects an Agent to Write the Code
AWS Blocks, an open-source TypeScript framework now in public preview, assumes an AI agent writes the backend, so it bakes the correct patterns into the framework instead of the docs. The real shift is the audience: the fastest way to make agent-written code reliable is to remove the decisions, not write better instructions about them.
-
OpenAIOpenAI Kills Sora to Chase Enterprise Code
OpenAI scrapped Sora and scaled back its Jony Ive hardware partnership to concentrate on coding tools and enterprise customers. Consumer AI gets the headlines. Enterprise code writes the checks.
-
AI CodingThe AI Coding Tools Landscape in 2026: Nobody Picks Just One Anymore
Developers now run an average of 2.3 AI coding tools simultaneously. The question shifted from 'which one?' to 'which ones, and for what?' Here's how the tool stack concept reshapes how we write code.
-
Developer ToolsThe CLAUDE.md File Is Your Actual Product Now
The file that tells your AI agent how to behave has become the highest-leverage artifact in your entire workflow. Not the code. The configuration.