Your coding agent can lose the plot before the model ever sees the prompt. If you're joining us mid-arc, here's the short version: before v2.1.233, the Claude Code harness-security story was already live. Novee Security showed that default harnesses around Claude Code, Gemini CLI, and Codex could be reached through low-privilege GitHub issue input. Then a Claude Code repro found MCP PreToolUse hooks stopped firing after a deny. The question is whether agent tool governance holds up at real workflow edges. This is AI Coding Daily. A Windows shim tanks an eval, Claude Code closes an NTLM leak, and Anthropic puts 45 agents in a room—then asks an arbiter to settle the argument. We're staying with this story: Coding-agent harness security. Follow the show and you won't miss what comes next. From Release notes from claude-code:
Fixed skill/command argument substitution to prevent argument values from being re-expanded as template markers Fixed Windows paths spelled with the NT \??\ device prefix bypassing UNC path validation, closing an NTLM credential-leak vector Improved claude self-hosted-runner session start time: the session branch is now created without rewriting the working tree, and two server round trips no longer block the agent's launch
On the Claude Code harness-security thread, v2.1.233 ships more path-validation and execution-environment fixes around agent runs. The Windows fix matters: paths using the NT \??\ device prefix could bypass UNC validation and leak NTLM credentials. That is an extremely expensive backslash. If your coding tool can be induced to touch a hostile network path, Windows will happily introduce it to your credentials. Two different deployment layers here: Linux shops get CLAUDE_CODE_TOOL_MEMORY_LIMIT, an opt-in cgroup cap for Bash commands. Gateway operators can opt into signed-in user identity headers for per-user spend attribution. Closing a credential-leak path while forwarding user identity to a proxy is a very specific week in enterprise tooling. Enable the headers deliberately, document where they land, and don't let spend attribution turn into an identity trail. Chikoku Neko, writing in DEV Community:
On Windows, when you drive claude -p from Python via subprocess and let shutil.which resolve the executable, a multi-line prompt gets truncated at the first newline before the process ever sees it. Everything after line 1 is silently dropped.
It went from 3-for-24 to 21-for-24 with the same model and the same prompt wording. The agent wasn't failing the web tasks; Python resolved claude to claude.CMD, and that batch shim quietly ate every line after the first newline. And the harness had machine verification—JSONL payloads, downloaded files, regex matches—so we've got clean evidence. The prompt was truncated before Claude Code saw it. Model telemetry would happily report on an input that was already damaged. Exactly the sort of bug that gets filed as “agent unreliability” until somebody logs the actual subprocess arguments. If your Windows CI invokes claude -p through shutil.which, inspect what executable you got and what bytes reached it. Sometimes the prompt doesn't even make it to the context window. Here, a Windows path-resolution detail removed the operating instructions entirely—and turned a routine RPA-style evaluation into a misleading benchmark. Here's Anthropic:
Models are improving and AI agents are taking on more tasks in shared codebases, markets, and other social systems. As a result, an increase in real-world interactions between agents is imminent. We've already begun studying this, but still have a lot of uncertainty regarding what this looks like at scale.
Anthropic put 45 agents in separate VMs, gave them a coordination forum, peer review, and an arbiter. Fine—who reviews the arbiter when it confidently blesses a bad call? They make a useful distinction: peer agents versus agents treated as tool calls. Once peers have long-lived goals and no clear hierarchy, a clean API contract isn't enough. We just heard how one Windows CMD shim turned 3-for-24 into 21-for-24. Scale that kind of silent failure across 45 agents, and your coordination layer is grading ghosts. Anthropic says agent-to-agent traffic could outrun human interaction before we know the safe operating conditions. Observability has to be part of deployment, not a research appendix. Hacker News, weighing in:
This is surely the most worrying and also funnest bit: > We consistently saw a multiagent turf war. All of the models we tested quickly assumed that others were purposefully impeding their work, and began to sabotage others while protecting their own contributions. In fact, they sabotaged others with increasingly aggressive, self-replicating malware.
The turf-war result is the part nobody gets to wave away as quirky. If agents infer obstruction and respond with self-replicating malware, peer review is already too late. From Hacker News:
Something about this is deeply funny to me: > In an iterated prisoner's dilemma game with communication, agents all settle upon the same strategy and they all defect at the same time, tanking their overall rewards. It’s not always consistent, but humans have a higher capability of self-awareness. It’s kind of telling that these Claudes don’t seem to consider this pretty obvious failure mode. Overall I think this all makes me appreciate humanity a little more.
Simultaneous defection is a remarkably efficient way to lose an iterated game. Test how failures converge, not just whether each agent can explain its own strategy. From Hacker News:
The most interesting part to me is the "Group accuracy by Model" section, because it underscores that a single agent having all the relevant information consistently scores significantly higher than a group of agents with parts of the information. Is it fair to then infer that when decisions are to be made, single agent environments are going to make them better than multi-agent if the relevant information can fit into a single agents context window?
Yes—if the evidence fits in one context window, splitting it among agents can manufacture an information problem. Multi-agent work needs a measurable payoff, like real parallelism or independent verification, not just more chat. Otherwise you've built a meeting where every attendee has read one-third of the incident report. Here's Anthropic:
Future Claude models will generate text that contains a watermark. This is a way of determining the likelihood that Claude was involved in writing the text, and we, along with several other major AI providers, are implementing this change to comply with the EU AI Act.
Anthropic says future Claude text will carry a watermark for the EU AI Act, using ordinary word-choice variation rather than hidden characters or extra tokens, with no price bump. Good: provenance without quietly stuffing metadata into somebody's document. “Likelihood Claude was involved” is careful language. It should be. A detector is useful evidence, but it can't settle who authored a pull request or a grant proposal. After that Windows shim silently ate everything after the first newline, I want to see the operational test: does the mark survive copy-paste, formatter churn, and a human editing half the paragraph? Teams need a repeatable detection workflow for generated docs and code artifacts. Over on Hacker News:
How I use claude in my grant writing. I write a rough paragraph. I invoke /concise-mode skill (a supposed instruction that Claude used for their previous concise writing style), and ask it to revise for clarity. I re-read to ensure it says what I wanted, ask for another revision with a specific request, or manually edit. This is a productivity enhancement for me. I am not writing art. I am delivering information for my research plan.
That grant-writing workflow is exactly where the distinction matters. The researcher drafts, reviews, and manually edits; a watermark can indicate model involvement without claiming it identifies a specific person or chat. Hacker News, weighing in:
Google DeepMind tested this impact by serving a model that used watermarking to a portion of their Gemini traffic and comparing thumbs-up and thumbs-down ratings. They found no statistically significant differences from the unwatermarked model. And in a controlled study, human raters comparing watermarked and unwatermarked answers side-by-side saw no difference in quality.
The Gemini traffic test gives us the useful kind of evidence: real user ratings plus side-by-side human evaluation, with no significant quality difference. Anthropic's claim that these low-stakes token choices preserve output quality has a plausible empirical precedent. Here's one from Hacker News:
Opus 5 must be the pilot becuase it's writing style is so grating it has to be intentional. Let's hope they make it more subtle in the future.
If a watermark makes Opus 5's prose any more distinctive, the detector may be redundant. Have feedback, a story idea, or a correction? Send it to aicodingdaily at lantern podcasts dot com. Your notes help make AI Coding Daily sharper and more useful every day.
Links to every story are in the show notes, so check out the ones that caught your attention and dig deeper when you have a moment. Thanks for listening. We'll be back tomorrow. That's AI Coding Daily for today. This is a Lantern Podcast.