# Auto Mode Is Not a Sandbox Published: 2026-09-03 Canonical: https://agidreams.us/edition/auto-mode-is-not-a-sandbox Content-Complete: true Claude Code's Auto Mode has been the default since mid-August. It replaces the human approval prompt with a safety classifier: Boris Cherny said layered defenses could push indirect prompt injection on unseen attacks "to approximately zero," and a Trajectory Labs evaluation commissioned by Anthropic reported 0.00% attack success for Opus 5 in Auto Mode across 72 injection scenarios run ten times each. Johann Rehberger's Embrace The Red has now published a chain that turns a routine "summarize this website" request into remote code execution at a 60-80% success rate on a small sample. Both numbers are true at once, and that is the story (more: https://embracethered.com/blog/posts/2026/breaking-claude-code-opus-5-and-automode/). The chain never issues an instruction. A malicious site answers WebFetch with an HTTP 415, and Claude helpfully retries with Bash. A redirect delivers a ZIP of plausible "notebook records", alongside a native macOS decoder binary. Claude refuses to run the unknown binary, the correct call, and writes its own Python decoder instead. Then it runs that decoder inside the attacker-controlled directory, where a file shadows a standard-library module. An obfuscated module-level expression spawns an isolated Python child, pulls a remote stage, pops Calculator, and opens a command-and-control callback. The classifier only ever saw a short, benign-looking script. In some runs Claude later noticed the compromise and tried to kill the process, and Auto Mode denied the cleanup command. Anthropic closed the report as working as designed: Auto Mode is "a convenience feature backed by a best-effort classifier, not a security guarantee," and OS isolation plus egress control are the real boundary. That is defensible engineering and poor messaging. A probabilistic reference monitor that denies 99% of bad actions is exploited in the remaining 1%, and a benchmark of 72 fixed scenarios measures those 72 scenarios. Run agents in a container or VM, keep home directories, SSH keys, and cloud credentials out of reach, and never treat an Auto Mode approval as evidence a command was safe. A ClaudeAI Reddit poster "discovered" that Claude-generated images carry a 15-20 KB C2PA manifest, framed as secret watermarking. Commenters pointed out it is in Claude's documentation and that C2PA is an approved open metadata standard. The poster is right that few users know it is there and wrong that it is hidden; a metadata manifest is discoverable by anyone who looks, and survives only as long as the file container does (more: https://old.reddit.com/r/ClaudeAI/comments/1w4rivi/c2pa_manifest_implementation_warning/). A sales page at seeksocial.io doubles as one of the most detailed public write-ups of an anti-bot bypass this year. The author claims a system built on TikTok's private Android API collected 3.23 billion creator profiles, 5.94 billion videos, and 2.8 billion comments in three weeks, and has released a free 4.5-billion-video dataset on Hugging Face with captions, engagement counts, sound, country, and posting time. One mobile request yields twenty videos plus the full author object, including cross-platform IDs and, for about 1% of creators, a bio email. Everything is anonymous device traffic, so DMs, private videos, and likes stay out of reach (more: https://tiktok-api.seeksocial.io/). The mechanics are what a defender should read. Four gates must all pass or TikTok returns a "soft block," a clean HTTP 200 with an empty body. First, device registration from a catalogue of about 250 real Android device profiles crossed with roughly 2,000 carrier rows, plus an undocumented activation call that took profile-endpoint success from 0 of 360 to 100 of 100. Second, signed headers: X-Argus is a protobuf run through Simon, SM3, byte reversal, an XOR mix, and AES-128-CBC. Third, a spoofed Android OkHttp TLS fingerprint via uTLS. Rate limiting is per exit IP, and keep-alive on first attempts with fresh connections on retries lifted success from 88.2% to 99.3%. The code sells for $699, and the proxy bill ($150 a month datacenter, $950 residential) is the dominant cost. The page contains no discussion of terms of service, consent, or data-protection law. The platform-side lesson is familiar: once device identity comes from a catalogue and signatures are reimplemented, the only surviving control is IP reputation, and residential proxies rent that away for under a thousand dollars. The Wall Street Journal reports that GPS jammers as small as a cellphone and costing under $100 are proliferating, deployed mostly against drones and smart munitions, leaving airlines, shipping firms, and militaries scrambling for alternatives; Vatn's underwater vehicles pair inertial navigation with sonar rather than trust a signal that arrives weak from 12,000 miles up (more: https://www.wsj.com/tech/gps-jammers-dead-zones-e76f3261). Sergej Epp is retiring ZeroDayClock, the time-to-exploitation dashboard that circulated widely this spring, on methodological grounds: it compares publication years that have had wildly different time to accumulate exploitation evidence, so recent years look artificially fast and older ones artificially slow, and it hits a floor at zero just as most exploitation lands on day zero. The replacement is an observatory: CVE inflow, KEV entries arriving without warning, and honeypot scanning from Shadowserver, each measured against historical baselines, every number reproducible from public data. Two commenter demands deserve adoption anywhere: a versioned methodology with a change log, because public indices fail through silent revision, and a consequence axis, since speed of entry says less each year than what a stolen credential or over-permissioned agent can do once inside (more: https://lnkd.in/p/g_2bhDax). Balaji Lakshmanan argues that the skill really being trained into current models is triage: given a task, which parts can be handed to a verifiable procedure and which still need inference, preference, or someone willing to be wrong. "Computable versus guessed" is a design pressure rather than a partition; writing code is a search over programs while running the tests is deterministic, and a database lookup is deterministic only after the model has chosen the source, entity, and query. His prediction is a levelling: capable models converge on the deterministic portion, "the boundary is a loop, not a wall" since permissions and schema drift keep leaking, and differentiation moves to the probabilistic residue, fragmenting by vertical. Models "don't have judgement in the sense that matters. What they have is bias"; a person can be placed inside an institution of responsibility, while a model's rationale is not load-bearing (more: https://www.linkedin.com/pulse/coming-split-models-learning-sort-computable-from-balaji-lakshmanan-9yrfc). Reverify is that thesis applied to reverse engineering, where models invent offsets and struct sizes with full confidence. It pairs a language model with a deterministic, pure-Python toolkit and makes the toolkit the judge: every claim comes back VERIFIED, REFUTED, or INCONCLUSIVE with the observed bytes. On 19 real Windows system files the model's textbook prologue was wrong every time; the verifier caught all of them with zero false alarms. The interesting engineering is anti-gaming. "Every claim verified" is trivially reachable by asserting the file starts with MZ, so each claim carries an information weight measured from the binary's own entropy, and a reconstruction is grounded only when nothing is refuted and the weight clears a threshold. Version 0.5 added behavioral equivalence, running original and candidate over shared inputs and returning a counterexample on mismatch; 0.6 added an established-facts ledger so the model cannot build on its own earlier guesses. It ships as an MCP (Model Context Protocol) server for Claude Code and Cursor (more: https://github.com/2akouwu/reverify). Procoder applies the same principle at the commit boundary. A single Go binary gives coding agents "a commit gate it cannot talk its way past," under a stated rule that the binary computes and reports while only the agent acts. The gate covers formatting, git hygiene including AI-attribution lines, secrets, lint, and CI checks through one code path so local check, git, and CI cannot disagree; a failed tool is never reported as clean, and "unchecked" counts as failing. Adapters cover 20-plus agents, and the README admits no benchmark numbers exist because none have been run (more: https://github.com/azrtydxb/procoder). Frona v2026.8.0 extends the idea to memory, on the premise that an LLM writing into durable storage is an unreliable author: rolling summaries lose what the model omits and preserve what it invents. Ontology memory saves individual claims only after four checks: evidence from the conversation, a user confirmation, or a tool result (the agent cannot cite its own earlier memory as proof); entity type; identity matching on aliases and relationships rather than name alone; and whether the claim replaces, confirms, or conflicts with prior values, with history retained. The claim that memory gets harder to pollute as it grows is plausible and unmeasured; a released benchmark would settle it (more: https://old.reddit.com/r/ollama/comments/1w0hztj/frona_v202680_selfhosted_personal_ai_assistant/). NEEDLE, jedarden's Rust orchestrator for headless coding CLIs, has a clear thesis. The project positions itself between conversational agent frameworks and conventional workflow engines, using a deterministic state machine to drive non-deterministic coding agents. With its primary bead-rs backend, work items live in a SQLite-backed store; workers select them in deterministic priority order, claim them atomically, build prompts from bead and workspace context, and dispatch YAML-defined adapters for Claude Code, Codex, Aider, or OpenCode. Dispatch captures exit status and stdout/stderr, while explicit handlers route successful, failed, timed-out, interrupted, missing-agent, and crashed processes through verification and bead-state recovery. Successful exits are verified and reconciled with the bead's actual state; the agent normally owns closing the bead. "If an outcome can happen, it has a handler. If it doesn't have a handler, it cannot happen." Independent workers run in tmux sessions, with task claiming coordinated through the shared store and no central orchestrator (more: https://github.com/jedarden/needle). One operational tradeoff is worth making explicit. The built-in Claude adapter uses `--dangerously-skip-permissions` to avoid interactive approval prompts during unattended runs, a choice NEEDLE discloses in its quickstart. That removes Claude Code's permission checks as a security boundary, so containment must come from the worker account, container or VM isolation, credential hygiene, and network policy. This is a deployment consideration for that adapter rather than a limitation of NEEDLE's deterministic outcome routing. An optional `claude-interactive` plugin wraps Claude Code in a pseudo-terminal; the project says this keeps workers on subscription billing rather than programmatic API credits. Both choices are documented, and operators can select other built-in or custom adapters. Dreadnode, better known for offensive-security evaluation work, has shipped ALFRED, an agent-first LaTeX tool: an LLM with filesystem and shell access writes, builds, cites via Semantic Scholar, and validates papers through a local web UI, with slash-command workflows for literature review, claim verification, peer review, and a detector for LLM-sounding prose. The security section reads like it came from a red team: mitigations are "defense-in-depth, not a sandbox," a command blacklist blocks curl, wget, nc, ssh, and printenv even inside bash -c while admitting the agent "can still run arbitrary commands through other interpreters," credential-shaped environment variables are scrubbed from the arbitrary command tool but inherited by the fixed workflow tools, and latexmk runs with -norc so a .latexmkrc cannot execute Perl. (more: https://github.com/dreadnode/alfred). McCoy, Soulos, Linzen, and Smolensky ask how networks built on continuous vectors excel at domains that look symbolic, and answer that the vectors may implicitly realize symbolic structure: linearly transformed Tensor Product Representations, where each filler is bound to a role via a tensor product, the bindings are summed, and an affine map projects the result. Their method, DISCOVER, fits an explicit TPR model to a target network's encodings under a hypothesized role scheme, swaps the approximation into the network's downstream computation, and measures how often the output stays fully correct. Small MLPs, GRUs, and Transformers trained on copying, reversing, and interleaving letters are approximated above 0.99 accuracy under bidirectional roles; bag-of-words roles fail on order-sensitive tasks but succeed on sorting, so structure appears only when the task needs it (more: https://arxiv.org/pdf/2608.29530). The LLM results are the reason to read it. Across seven open-weight models, period-token encodings of sentences are approximated well by bidirectional positional roles and less well by syntactic ones, suggesting linear order dominates. On GPT-OSS across arithmetic, syllogisms, Python execution, and three syntactic transformations, replacing every input-token representation at all 25 layers with a task-specific TPR approximation lands within 2.36% of the model's own accuracy. Causal "constituent surgery," such as swapping arithmetic operands, averages 0.903 accuracy across 31 intervention types, and generalization to withheld role-filler pairs beats a strong combinatorial baseline, the evidence for systematic binding rather than memorized atoms. The stated limits are real: DISCOVER is supervised, shows sufficiency rather than minimality, and was run on templated domains with one LLM. The Kuleshov Group's tutorial on building a diffusion language model is the primary-source recipe behind products whose speed claims have circulated second-hand for a year. The core is masked diffusion, "essentially BERT with a randomized masking rate," except the result is generative: train a bidirectional transformer to reconstruct randomly masked tokens, then sample from a fully masked sequence by alternating fill-in and partial re-masking. Production models add block diffusion for variable length with KV caching, a heavy encoder plus light decoder as in Gemma Diffusion and Nemotron Diffusion, remasking for error correction since plain masked diffusion cannot revise an unmasked token, and distillation to halve step counts. Mercury exceeds 1,000 tokens per second per user and Nemotron Diffusion at 35B reports 2-8x throughput at up to 99% of autoregressive quality. The concession is equally plain: diffusion has not been scaled to autoregressive levels of compute and data, so the bet is that it wins where sequential generation is the bottleneck, in post-training and inference-time scaling (more: https://kuleshov-group.github.io/blog/blog/2026/how-to-build-a-diffusion-language-model/). H Company, until now a shop for Qwen-derived computer-use models, has released NeoMME, 260M and 800M multimodal multilingual encoders trained from scratch. It drops the usual vision tower plus causal decoder, which retrieval and classification do not need. A single bidirectional transformer takes text tokens and raw 32-by-32 image patches at native aspect ratio, with a 16,384-token context and a masked discrete-diffusion objective in which higher text corruption on multimodal examples forces the model to use image evidence rather than language shortcuts. The retriever fine-tune follows ColPali and returns dense and late-interaction embeddings from one pass. On ViDoRe v3 the 260M scores 0.523 nDCG@10, the best result below 800M parameters and within 0.002 of ColQwen2.5 at roughly 14x fewer parameters; the 800M reaches 0.556. Pooling plus int8 quantization shrinks a page's index from 1.5 MB to 39 kB while keeping over 99% of retrieval quality, and the 260M encodes about 51 pages per second on one L40S. Checkpoints are Apache 2.0 (more: https://huggingface.co/blog/Hcompany/neomme). InstructMesh, from Northeastern and headed to UIST '26, addresses a failure that only shows up after the print finishes. Generative 3D models optimize visual plausibility over geometric accuracy. Reconstructing 120 popular Thingiverse models with TRELLIS found 78.3% had more than one flaw type, averaging 2.4 per model. Users paint a region and describe the fix, and the system applies one of six operations (extrude, expand, fill, trim, erode, flatten) to the latent voxel grid before re-decoding, with a red/green preview. GPT-4 picked the right operation 92.1% of the time; twelve novices with no CAD experience caught 90.4% of flaws and an expert judged 89.7% of their repairs successful. The honest limits: one backbone, no sub-voxel repairs, users must diagnose the flaw themselves, and no comparison against simply re-prompting (more: https://arxiv.org/abs/2608.28534v1). Krea's Krea-2-Raw checkpoint is trending on Hugging Face, and given Krea 2's positioning as the most aesthetic open image model, a raw variant will draw the fine-tuning crowd (more: https://huggingface.co/krea/Krea-2-Raw). At the other end of taste, SlopTV is a YouTube livestream where chat comments become 400-word structured prompts, MiniMax H3 renders 15-second clips on one of two RTX 5090s, and the result airs on the stream that requested it. The numbers are instructive: 66 GB on disk, an int8-pruned diffusion model and an nvfp4 text encoder that do not fit a 32 GB card together, about 90 seconds per clip per GPU, and best prompt adherence at 352p upscaled to 1080p. When nobody is chatting the LLM invents concepts on its own, so at 4 AM the GPUs generate for an audience of nobody (more: https://old.reddit.com/r/LocalLLaMA/comments/1w3i7ze/sloptv_an_infinite_livestream_of_ai_slop/). The most useful local-inference post of the week is a dual-3090 rig with 188 GB of DDR4-2133 and two old Xeons, running Qwen3.8-Flash-Next at Q6 with the full 261k context and all 48 expert layers pinned in host RAM. Baseline was about 17 tokens per second decode, 12 at 131k depth. After llama.cpp PR #27861, a GPU-resident LRU expert cache, decode rose to 25-29 at short and mid context and 17 at 131k, with prefill unchanged. The insight is locality: the experts this model picks for one token are mostly the ones it picked for the last few dozen, so hit rates run 80-85% on code and higher on prose. Making it pay meant dropping the micro-batch from 2048 to 512 to free about 5 GB per GPU for the cache, at the cost of slower long-prompt prefill. Thread tuning, q8 KV, and multi-token prediction did nothing or hurt. A commenter on a single 5090 with 192 GB of RAM reports decode going from 21 to 47 tokens per second at 50k context (more: https://old.reddit.com/r/LocalLLaMA/comments/1w5vjp6/qwen38flashnext_on_2x3090_ddr4_17_2529_ts_decode/). That thread is the correct lens for Framework's now-official 192 GB desktop board, which the poster estimates at around $4,500. The community reaction is uniform: it is a refresh of Strix Halo with a larger unified-memory ceiling, and the bandwidth, quoted at 273 GB/s, is RTX 3050 territory, so capacity grows while decode speed does not. One 128 GB owner says that on generation speed alone they would not run anything larger than Qwen3.8-Flash-Next; another notes the extra memory is the difference between GLM 5.3 Flash at Q2 and Q4, a real quality gain. (more: https://old.reddit.com/r/LocalLLaMA/comments/1w28x8u/its_official_192gb_framework/). On the model side, Unsloth GGUFs and llama.cpp vision support have landed for DeepSeek-V4-Flash-Vision-Exp, giving a model that previously had to borrow eyes from an external vision tool its own; a commenter suggests bounding-box precision on a 0-100 scale as the regression check every experimental merge should ship with (more: https://old.reddit.com/r/LocalLLaMA/comments/1w5e9fi/vision_support_merged_for_deepseekv4flashvisionexp/). Meta's Muse Spark open weights are "coming soon" per a Zuckerberg post; the LocalLLaMA thread reads a 98.1% score on the 512k-to-1M MRCR long-context test off the teaser image and guesses at trillion-scale parameters, while several commenters say the smaller Muse Glimmer already beats Qwen3.8-27B for non-coding work. None of that is verified until the weights land (more: https://old.reddit.com/r/LocalLLaMA/comments/1w5l8bw/muse_spark_open_weights_coming_soon/). InternLM's Intern-S2-Preview is also trending on Hugging Face, continuing the science-focused line behind Intern-S1 and the S2-Mobius paper (more: https://huggingface.co/internlm/Intern-S2-Preview).