vibehacker
News
MIXED ·

Claude Code's sec-default mod now pins nine policy env vars so installed plugins can't change them

An Oct 11 rebuild of Claude Code's built-in sec-default mod blocks plugins outside policy from setting any managed-settings variable plus nine always-pinned names like CLAUDE_CONFIG_DIR, CLAUDE_CODE_MANAGED_SETTINGS_PATH, and USE_LOCAL_OAUTH, and treats plugins from git, GitHub, or npm marketplaces as user-installed, never org-vouched. With no managed settings at all, every variable counts as pinned; the change ships inside the binary after 2.1.296, so there's no version number to check yet.

Read at mixed-news.com
Claude Code
An AI coding agent for terminal, IDE, web, and Slack

More news

View all

Claude Code dynamic workflows are generally available: tens to hundreds of parallel subagents

Dynamic workflows are now GA in Claude Code CLI, Desktop, and VS Code for Pro/Max/Team/Enterprise (plus Claude API, Bedrock, Vertex, and Foundry): Claude writes orchestration that fans work across parallel subagents, checks results before folding them in, and can resume interrupted runs. Start with “Create a workflow” or the ultracode effort setting; usage is much higher than a normal session, and admins can disable them in managed settings…

Anthropic Blog

Endor Labs Agent Security League: best coding agent writes secure code only 37.4% of the time

Endor Labs' public leaderboard, built on CMU's SusVibes (200 Python tasks across 77 CWE classes, with anti cheating checks), tops out at Claude Code with Claude Fable 5.1: 87.2% of solutions work but only 37.4% also pass hidden security tests, ahead of Codex with GPT 6 Astra (34.6%) and GPT 6.1 Sol (34.1%). Across 32 agent and model combos, working code still mostly isn't safe code, so keep security review before merge…

Endor Labs

ColGrep-Agent-2B: local 2B code-search agent cuts Claude Code tokens by 34%

LightOn released ColGrep Agent 2B, an open 2B local code search agent that sits between a coding agent and the repo; in their Claude Code tests on 52 questions across 13 repos, delegating search cut API tokens 34% and cache aware cost 40% vs grep, with no statistically significant accuracy change. Install with brew install lightonai/tap/colgrep && colgrep install agent , then colgrep install claude code (Codex and OpenCode hooks too)…

Hugging Face Blog (LightOn)

Codex raises GPT-6.1 Sol default context from 272K to 500K

OpenAI Codex lead Tibo raised GPT 6.1 Sol’s default context in Codex and ChatGPT Work from 272K to 500K tokens ( 80% more) to cut compactions on long tasks, with no long context fees on ChatGPT subscription usage. Override via model context window and model auto compact token limit in /.codex/config.toml ; the API max remains 1M…

AICoder

Codex CLI 0.157.0 starts a persistent self-updating app-server daemon by default

Opening an interactive Codex session on 0.157.0 now spins up a background app server that survives after the TUI exits, copies 374 MB of platform bits under /.codex , and runs an hourly updater that can force kill active turns after a 60s drain. Opt out with codex features disable daemon auto start , then codex app server daemon stop (and kill any leftover pid update loop )…

AppSec Scoop

Spotted something we missed? Start a thread.