A coding agent's policy gate can disappear mid-session. How much trust do you have left after that? Here's how we got here: Coding-agent security now comes down to whether the harness makes bad behavior executable, not just whether someone can talk a model into it. Novee Security showed default harnesses around Claude Code, Gemini CLI, and Codex could be abused from low-privilege GitHub issue input, with two patched CVEs affecting Gemini CLI and Claude Code. This is AI Coding Daily. Today: the hook that stops enforcing, the memory system that refuses to forget, and a CI check for context waste. Start with Claude Code. Here's NewReleases:
Hardened skills synced from claude.ai: they no longer shadow local commands or MCP prompts, their descriptions are sanitized and labeled, and on your machine their bodies don't run! commands or expand@ files
Claude Code 2.1.228 closes a few very real escape hatches in synced skills: no shadowing local commands or MCP prompts, no bang commands, no at-file expansion. A remote skill arriving with the ability to impersonate local tooling was a remarkably ambitious default. Here's the important detail: synced skill descriptions are now sanitized and labeled, and their bodies can't run local commands or expand files on your machine. That gives imported instructions a usable boundary before they get local authority. This release also fixes project-memory cleanup deleting contents, self-hosted runners ending a session between a background task and its follow-up turn, plus a Remote Control resume leak. Those are production-state bugs, not cosmetic papercuts. Also: /tui could revert a session to an earlier model after /model changed it. If you care which model touched a diff, model selection has to survive the interface layer too. DEV Community writes:
The hook log contained not a single row for the local summary tool. But the tool was being called. Once a PreToolUse hook returns a deny, hooks stop firing for the rest of that session's MCP tool calls (built-in tools are unaffected). Confirmed on Claude Code 2.1.227 / Windows 11 Home, 2026-08-12.
Here's another harness-security problem: a five-minute repro says Claude Code's MCP hooks stop firing after one deny. On 2.1.227, your policy gate can keep working for built-in tools while every later MCP call slips past it. That is an awful split-brain failure. The DEV author logged every PreToolUse call before branching, then denied only Read. The local MCP summary tool still ran, but produced zero hook-log rows. That leaves an observable missing event in the log. And the use case was token control: deny Read, route to a local summary. The author found the summary could invent facts, so Claude either re-reads the source and burns the tokens anyway, or trusts a bad summary. Then the guardrail itself disappears after the first denial. Great. We just covered 2.1.228 hardening synced skills—useful fixes, different surface. Its release notes don't name this MCP hook-silence regression, so teams using hooks for policy need to test this exact deny-then-MCP sequence, not assume the hardening release covers it. From Don Karter at Octomind:
0.43.0 makes it a fold instead. Drained messages are archived verbatim, the summary cites them by content-addressed ID, and the agent gets a recall tool that pulls the originals back on demand. Context narrows under pressure and re-expands exactly where the work needs it.
Octomind 0.43.0 archives drained context verbatim in per-session JSONL, then lets the agent recall a block by content-addressed ID. That helps with the exact-error problem: the summary can stay short without pretending to be the source of truth. I like the architecture. But that archive just became persistent state with receipts—so I want retention rules, access controls, and a very clear answer on what recall can surface from an old session. Right. The compression engine also computes depth from measured session dynamics instead of stepping through a fixed pressure ladder. That's useful if it preserves the raw material before it starts making increasingly aggressive guesses. We just heard what happens when an enforcement mechanism silently stops firing. Octomind's recall tool gives the agent a way back to evidence; now stress-test whether it reaches for that evidence before confidently inventing an import from forty minutes ago. DEV Community writes:
ctxlens treats an agent session the way a CPU profiler treats a program. A profiler does not judge whether your code is good; it tells you where the time went so you know where to look. ctxlens does the same for tokens. It parses a session transcript, attributes every message to a segment, counts tokens per segment and per turn, and then runs rule-based checks to flag the parts that are genuinely wasted.
ctxlens has the right target: the Claude Code JSONL, not another cheerful token dashboard. If a session rereads the same file six times, show me that before it turns into a quarterly budget line. It breaks tokens out by segment, so you can see whether the spike came from system prompts, tool definitions, thinking, tool calls, or tool results. A 12,000-token tool result used for one turn is an engineering problem you can actually act on. And it can fail CI on a waste threshold. Good. We just heard hooks stop enforcing after the first MCP deny; a post-session check won't replace a gate, but at least it leaves evidence when the gate misbehaves. The practical catch: teams need to retain those transcripts long enough to inspect them. But parsing Claude Code JSONL, Codex rollouts, and generic OpenAI chat arrays gives this a real path into the build pipeline, instead of leaving somebody to stare at a bill after the fact. DEV Community writes:
This entry fixes a silent regression in that instrumentation: chat calls were dropping the configuration they ran with, so the trace no longer told you how the model was set up. The fix is one focused change in @sentry/server-utils. It ships with unit tests. I verified it end to end against the live Gemini API.
Sentry removed a span for chats.create() because it wasn't a model call. Fair cleanup—except that span held Gemini's temperature, token cap, tools, and system instruction, so every later sendMessage() trace lost the setup that produced the answer. A trace that says Gemini answered, but forgets the system instruction and max-output-tokens, is very decorative evidence. In a review, you can't reproduce a behavior from the prompt alone if the runtime config fell through a floorboard. The repair in @sentry/server-utils carries the create-time config onto the actual chat and streaming spans, with unit tests and a live Gemini API check. Same lesson as the hook failure: policy and trace data both have to survive the handoff to the tool call. And the refactor itself flagged this as a follow-up risk. Good catch, now ship the follow-up before somebody is debugging a production agent from a span that has amnesia. Have feedback, story ideas, or a correction for AI Coding Daily? Email us at aicodingdaily at lantern podcasts dot com. We'd love to hear what you're working on and what you want us to cover.
Links to every story we covered today are in the show notes. Take a look at the ones that caught your attention, and follow up at your own pace. That's AI Coding Daily for today. This is a Lantern Podcast.