Claude Code tightened the harness—because apparently it still had holes. Here's how we got here: Claude Code's harness hardening has been about whether agent tools stay inside the policy box. Earlier reports covered Novee Security's default-harness findings, Hermes Agent reports of provider errors reaching model context, and Claude Code v2.1.248's restricted mode. That mode removes command and code-running tools, plus WebFetch, unless explicitly allowed, while keeping file tools inside the working directory. This is AI Coding Daily. Today: permission checks that could be bypassed, edits that look fine until they corrupt source, and a token-saving claim that needs a real receipt. This one's from Anthropic:
Fixed file tools (Read, Write, Edit) following a symlink swapped inside the working directory after the permission check, which could read or write outside the approved location Fixed plugin commands declared in a marketplace entry being able to point outside the plugin directory; such paths are now rejected with a path-traversal error
Claude Code 2.1.251 adds more symlink and path checks, plus model-switch hooks. The changelog buries the headline: Read, Write, and Edit could pass a permission check, then follow a swapped symlink outside the approved directory. That's a very specific time-of-check, time-of-use failure. Plugin commands could also point outside their own directory, so the boundary was porous in two separate ways. We spent August talking about hook matchers firing too broadly. Now the file permission check itself could be beaten. If your agent has write access in a production repo, that matters a lot more than the new foreground-subagent stream. The new PreModelSwitch and PostModelSwitch hooks widen the control surface again. Teams need to test what happens on a model change. Symlinked search paths matter too, and so do denied Read rules—Grep and Glob needed fixes there as well. From JuliusBrussee at GitHub:
Original skill made agents say less. Caveman 2 makes them read less too. 33.2% fewer provider-reported input tokens in a pinned Claude Code benchmark. benchmark_counterfactual Keep your agent. Brain big. Context small.
Caveman has 101,860 stars for teaching Claude Code to stop with the throat-clearing. Fine. But the measurable claim is 33.2% fewer provider-reported input tokens across 54 pinned runs—not the big 65% slogan. And that distinction matters. The author says it trims visible completion, not hidden thinking tokens. Shorter prose can help, but it doesn't prove the agent reasoned equally well on your repository. A pinned Claude Code benchmark makes every optimization look disciplined. Put it through a 50-file refactor, then let a reviewer count the missing constraints. We just covered v2.1.251's spend-limit bar and rate_limits.spend_limit field. Gateway teams have enough telemetry now to run Caveman against their own workload. Publish the before-and-after, including failures. What's still missing is per-model attribution. Over on Hacker News:
Author here. A few people are arguing against a stronger claim than the repo is meant to make. As well, this was very much intended to be a joke and not research level commentary. This skill is not intended to reduce hidden reasoning / thinking tokens. Anthropic’s own docs suggest more thinking budget can improve performance, so I would not claim otherwise. What it targets is the visible completion: less preamble, less filler, less polished-but-nonessential text.
That's a sensible boundary from the author. Less filler helps UX and transport; proving it preserves—or reduces—reasoning cost would take different measurements. From Hacker News:
Idk I try talk like cavemen to claude. Claude seems answer less good. We have more misunderstandings. Feel like sometimes need more words in total to explain previous instructions. Also less context is more damage if typo. Who agrees? Could be just feeling I have. I often ad fluff. Feels like better result from LLM. Me think LLM also get less thinking and less info from own previous replies if talk like caveman.
Yep. Compression turns one typo into a tiny grenade. If the agent and engineer spend three turns repairing shorthand, the token savings evaporate. Over on Hacker News:
This is neat but my employer rates my performance based on token consumption; is there one that makes Claude needlessly verbose?
Enterprise incentives win again: somebody will absolutely buy the inverse plugin and call it executive communication. Here's Google:
Google AI Studio Build Mode is corrupting my large source files when Gemini 3.7 Flash is asked to make a small, surgical code change. The files are approximately 13,000 lines each. Gemini is explicitly instructed to modify only the requested code and preserve everything else. Instead, after the edit, parts of the file become corrupted and contain large amounts of replacement characters ( ), control characters, and binary-looking garbage.
Gemini 3.7 Flash was asked for a surgical edit on a 13,000-line UTF-8 Java file and returned replacement characters, control characters, and binary-looking garbage. A diff can look plausibly small while the file is already wrecked. And it survived browser changes, account changes, extensions off—the failure stayed put. If Build Mode touches a source file, “edit succeeded” has to mean the bytes survived, not just that the request got a cheerful response. We just covered a 33.2% token-reduction claim on a pinned 54-run benchmark. Now run that cost win against a 13,000-line UTF-8 file and verify byte-for-byte preservation. Parse validity is nowhere near enough. A code agent saving tokens by quietly turning your source into archaeological fragments is an unusually expensive optimization. zengzheqing, writing in GitHub:
Enabling the Kanban feature in Desktop Settings → Plugins makes the board panel appear in the sidebar, but the agent still gets zero kanban tools and kanban-related skills stay gated out of the index. The agent-side surface is a separate opt-in: config.yaml top-level toolsets: list must contain kanban (see tools/kanban_tools.py::_profile_has_kanban_toolset — profiles must explicitly opt in; "Humans running hermes chat without the kanban toolset see zero kanban tools").
Hermes Desktop lets you flip Kanban on, draws the sidebar panel, then gives the agent zero Kanban tools. A settings toggle that only changes the wallpaper is how bad assumptions get shipped into a PR. Issue 96969 maps four separate controls: the Desktop plugin, a gateway dispatcher, the toolsets: entry, and requires_toolsets on skills. Settings only exposes the first one, while installed skills simply disappear from the hermes skills list. The UI says Kanban is enabled while the capability is absent. We just talked about hook scope widening silently; here's the inverse failure— the switch looks healthy, but the agent is missing its hands. The fix is straightforward: enable the toolset alongside the UI, or label the panel UI-only and show every gated skill with its missing opt-in. Silent gating makes a successful configuration look broken. Here's Parth Gupta at DEV Community:
ORCHESTRA is a multi-agent hackathon judge. Its clarity prompt is a real file, backend/prompts/clarity-judge.md. When that file changes, nothing in CI notices. The output is a qualitative assessment, so regressions are invisible: JSON still parses, the score still looks plausible, and chiefJudge quietly keys its confidence off a fallback sentence that is no longer there.
Sentinel's useful idea is finding the noise floor: run 10 cases three times each, then compare the changed prompt against itself before calling a regression. That's closer to a real gate than a dashboard admiring a score. And its first failure was a classic eval-harness bug: the judge never saw the submission it was supposed to grade. A green prompt eval with missing case inputs is a very expensive thumbs-up. What I like about Sentinel: it blocks on measured drops, then leaves the merge to a human. After the Gemini corruption report we just covered, parse-valid output clearly isn't a sufficient receipt. Right—and “two tests worse” is a reviewable claim. But I'd want the cases, prompt versions, model parameters, and variance results attached to the PR, because the test suite just showed it can lie too. Have feedback, a story idea, or a correction for AI Coding Daily? Email us at aicodingdaily at lantern podcasts dot com. We'd love to hear from you.
Links to every story we covered are in the show notes, so you can dig into whichever developments caught your attention. Thanks for listening. We'll be back tomorrow with more AI coding news. That's AI Coding Daily for today. This is a Lantern Podcast.