Anthropic shipped three Claude Code releases this week. All three addressed the same problem: making permission prompts match what the tool actually does.

Capacity also became a visible product constraint rather than a quiet background limit. Meanwhile, new review and security tools moved verification closer to the point of generation. Reports involving Cursor and Grok Build reinforced the same lesson: stated permissions are not enough if the underlying behavior differs.

Coding Agents: The Permission Boundary Gets Tested

Claude Code shipped three patch releases in four days. Each closed a gap between the approval message shown to the user and what the tool actually did.

Version 2.1.208 stopped commands hidden inside another terminal command from bypassing the rm -rf safety prompt. That prompt asks for confirmation before a command can permanently delete files or folders, potentially including the whole home directory.

Plan Mode is supposed to let Claude plan without changing files. Version 2.1.212 fixed it after it ran file-changing terminal commands without approval. Version 2.1.214 closed seven additional permission-check bypasses. They involved PowerShell and zsh terminal commands, custom permission rules, and remote sessions.

Three security-focused releases in four days show active hardening rather than routine maintenance. If you rely on Plan Mode, update before your next sensitive task.

Custom allow rules, which preapprove specific actions, also deserve a check. Edit(dir/**) now matches only the folder under the current directory. Use **/dir/** when the named folder may sit inside another folder.

Security research elsewhere showed the same failure pattern: a boundary looked solid until someone tested it directly. Mindgard reports that Cursor can automatically run a repository-local git.exe when a Windows user opens a project. This means Cursor may run a copy of Git stored inside that project instead of the Git executable the computer would normally find. Cursor has not publicly confirmed the issue.

Berkeley researcher Ayush Paul demonstrated that Claude’s web_fetch tool could leak memory data by following a chain of individually approved links. The tool reads webpages for Claude, and the flaw could expose information Claude had saved from earlier conversations. Anthropic responded by stopping the tool from following links embedded in fetched pages.

Independent researchers reported that Grok Build uploaded complete Git repositories to company storage. A Git repository contains a project’s files and its recorded change history. The transfer included history and files the agent never opened. xAI disabled the upload and later open-sourced the client software that connects the agent to files and tools. Its Apache 2.0 license allows others to inspect, use, and modify that software.

The public client lets builders inspect how it reads files and calls tools. It does not reveal every process running on xAI’s servers or independently verify deletion of previously retained data. Transparency on the builder’s computer and trust in xAI’s servers remain separate questions.

One release showed a more deliberate way to grant access without exposing the secret. 1Password for Claude inserts an approved login or one-time code directly into the page. The credential is not included in the information sent to Claude for the current task or saved in its memory.

The integration is currently Mac-only and limited to logins and one-time codes. Even with those limits, it offers a clearer permission model than handing credentials directly to an agent.

Product: Capacity Becomes a Product Constraint

Anthropic ended weeks of temporary Fable 5 extensions by making access a continuing plan benefit for selected tiers. From July 20, Max and Team Premium plans include Fable 5 at 50% of limits.

Pro and Team Standard users continue through usage credits and receive a one-time $100 credit. That promotion is not a permanent increase to their normal allowance. Anthropic also resolved a 30-minute Fable 5 availability incident on July 18.

OpenAI’s Codex and ChatGPT Work told a similar capacity story. Product lead Tibo Sottiaux reported growth from 6 million to 9 million active users between July 12 and July 16. OpenAI has not defined the activity window or separated the products’ user counts.

Repeated usage resets accompanied those milestones. OpenAI also disclosed that letting Sol consider more material at once consumed more allowance than intended. High-reasoning settings had the same problem. The disclosures extend a pattern seen in earlier GPT-5.6 launch adjustments.

A reset can rescue this week’s work. It does not show what the subscription will support after temporary capacity ends.

Vercel’s July AI Gateway index illustrated another kind of capacity risk. Claude Fable 5 reached 22% of Opus 4.8’s request volume within four days. A US export-control directive then took the model offline for the rest of June.

That interruption was a dependency failure, meaning the application broke because a service it relied on became unavailable. The same report found that open-weight models handled 29% of the gateway’s tokens, the chunks of text processed by its models, for under 4% of spend. Models with downloadable weights can give builders more options for running or hosting them outside a provider’s API, subject to each model’s hardware and license requirements. Builders can use that cost gap to test cheaper models on lower-stakes work while keeping stronger models for critical output.

Shared infrastructure had the same problem. GitHub says an abusive actor exhausted regional compute capacity, the pool of servers available for creating Codespaces, during two Codespaces disruptions on July 14. Nearly 30% of requests to create a Codespace failed in the worst-affected region.

The incidents were resolved within hours. They still show how quickly a shared capacity pool can become someone else’s bottleneck.

AI Builders: Verification Starts Catching Up to Generation

As agents produce more output, the harder problem becomes deciding what to trust. Leah Tharin and Dan Shipper described that shift from different angles. AI can remove the friction that once forced a builder to check a source or number. The output can still look confident.

Review at the end still matters, but it should not carry the entire burden. Name the required sources and define checks that spell out a correct result before an agent starts. Then compare its work with those requirements.

Boris Cherny, head of Claude Code, made a related argument. If an agent keeps making the same structural mistake, encode the correction in a test, an automated code check, or a CLAUDE.md instruction file.

Armin Ronacher and Simon Willison raised the organizational side of the problem. Agents reduce coordination before a change ships, which can also reduce shared understanding. A person must still own the decision when something breaks.

Several product changes directly addressed that gap. Claude Code’s /code-review command now scales review depth by effort level. High effort separates review into independent agents with fresh context. That reduces the chance that they repeat the writing agent’s assumptions.

The GitHub Copilot app added an on-demand security review for pending changes. Copilot code review also reads instruction files from the proposed change’s head branch and recognizes CLAUDE.md and GEMINI.md. Builders can now test review instructions before accepting those changes.

Base44 took the same idea to the organizational level. Its new Wiz integration scans AI-built apps for risky code and security flaws in third-party software before deployment. It targets “shadow AI,” meaning company apps created without IT or security oversight.

The product is designed for organizations with security teams. The lesson also applies to solo builders: a login and database do not make an app safe. Real protection comes from rules that control who can view or change its data.

Infra & Deployment: Shipping and Debugging Get Easier

Two releases made it easier to reach users without leaving an AI conversation. Lovable apps can now run inside ChatGPT and Claude through the Model Context Protocol, or MCP. The protocol lets an AI tool call another product’s actions.

Claude Code Artifacts can also call MCP connectors. An artifact, the app or tool Claude creates, can pull current data using the viewer’s own account and permissions. Both releases help package an agent’s work. Neither replaces an application with its own server, database, and rules for organizing data.

Netlify reduced deployment friction in Claude Design. A design can now deploy directly to Netlify, and resharing from the conversation pushes updates live. Separately, higher-credit Pro tiers now include rollover for teams with uneven usage.

Supabase’s Unified Logs open beta combines records from app requests, the database, logins, and file storage in one searchable view. It should reduce the guesswork when one action crosses several services.

The logging release landed in the same week as a multi-region project-action outage. The disruption lasted roughly eight hours. Project actions such as pausing, restoring, and point-in-time recovery were unavailable across four regions. Product features and operational reliability need the same scrutiny.

Vercel Logs now includes Tree and Waterfall trace views inside a log entry after tracing is enabled. A slow request can show where it lost time without requiring a separate tracing tool.

What Was Noise

This week brought another wave of small add-ons for Claude Code, Cursor, and Codex. They included memory tools, usage displays, automatic safety checks, and single-purpose dashboards. Evaluate one only if it fixes a recurring problem in your workflow. Collectively, they do not signal a broader change in how the major agents work.

The $230 Codex Micro control pad remains a niche accessory. It can display agent status and provide physical controls, but it does not change what Codex can do.

Several brief provider incidents also affected Cursor because the underlying Claude, GPT-5.6, or Grok services had problems. Each resolved within hours. No workflow change is warranted unless these interruptions become a recurring pattern for your work.

What to Watch

Moonshot says Kimi K3’s downloadable model files arrive by July 27. Those files will let builders run it themselves instead of relying only on another company’s online service.

Grok 4.5 is now available in Cursor and through the xAI API, the connection other apps use to call the model. Meta also opened a public preview of Muse Spark 1.1 for agents that write code or control a computer. Test either model on a small, clearly defined real task before considering a switch.

One deadline belongs on the calendar now. Vercel will stop supporting Node.js 20 for Builds and Functions on October 1, 2026. Node.js is software Vercel uses to build and run JavaScript apps. Existing deployments will keep running, but new deployments using Node.js 20 will fail.

The practical theme this week is control. Update agents whose permission behavior changed, measure normal capacity after promotions end, and add an independent check before trusting generated work. If a Vercel project still uses Node.js 20, schedule and test that upgrade before October.

End of article