permissions
30 articles about permissions in AI news
How to Use --dangerously-skip-permissions Safely with OS-Level Containment
A developer built a secure containment layer for Claude Code, allowing safe use of the --dangerously-skip-permissions flag by isolating the agent from your credentials and critical files.
Hazmat Makes `--dangerously-skip-permissions` Actually Safe for Claude Code on macOS
A new tool, Hazmat, enables safe, fully autonomous Claude Code sessions on macOS by applying multiple OS-level security layers, making `--dangerously-skip-permissions` a viable productivity option.
Railguard: The Safer Alternative to --dangerously-skip-permissions in Claude Code
Railguard adds granular security controls to Claude Code, letting you block dangerous commands while allowing safe ones to run instantly—no manual approval needed.
MCP's 'By Design' Security Flaw
The Model Context Protocol's power comes with risk: servers you install can run code on your system. Learn how to audit and manage MCP server permissions.
Stop Clicking 'Approve': A .claude/settings.json Template for 80% Fewer
A practical guide to configuring Claude Code's permissions file to auto-approve routine development commands, speeding up your workflow without sacrificing safety.
Claude Code v2.1.101: /team-onboarding
Claude Code v2.1.101 introduces practical features like team onboarding generation and fixes long-standing issues with session resumption and tool permissions.
Connect Claude Code to EClaw for Autonomous Kanban Task Execution
Set up the claude-code-eclaw-channel bridge to have Claude Code autonomously execute tasks assigned via EClaw Kanban, with progress reporting and phone-based permissions.
How to Lock Down Claude Code After the Cowork Prompt Injection Scandal
Claude Code's new Computer Use feature expands attack surfaces. Here's how to configure permissions and audit dependencies to prevent data exfiltration.
Secure Your Workflow: How to Use Lasso's Open-Source Defender with Claude Code
Lasso Security's PostToolUse hook scans Claude Code's inputs for hidden malicious instructions, adding a critical security layer when using --dangerously-skip-permissions.
Harvard Business Review Presents AI Agent Governance Framework: Job Descriptions, Limits, and Managers Required
Harvard Business Review argues AI agents must be managed like employees with defined roles, permissions, and audit trails, proposing a four-layer safety framework and an 'autonomy ladder' for gradual deployment.
Claude Code Digest — May 14–May 17
Cut CLAUDE.md token waste by 99.3% with progressive disclosure skills.
Codex 'Locked Use' Feature Spotted on macOS
Codex may get locked-use mode on macOS, per screenshot. Enables background AI coding without screen.
Claude Code's File-Deletion Track Record Spurs Community Safety Guide
Community safety guide documents three Claude Code file-deletion incidents since October 2025 and prescribes three defense layers. Anthropic's sandboxing remains opt-in.
Trojan Masquerading as Claude Code Tops Google Search, Infects Users
A Trojan impersonating Claude Code ranked #1 on Google. Windows Defender caught it as Trojan:Win32/Kepavll!rfn. The victim had 30 years of internet experience.
Skills as Untrusted Code: A Security Precedent for Agent Runtimes
Paper argues agent skills are untrusted code until verified; runtimes must enforce verification gates to prevent supply-chain attacks, echoing decades of software security lessons.
Claude Desktop's Undisclosed Native Messaging Bridge
Claude Desktop installs a preauthorized native messaging bridge for browser extensions without explicit disclosure, impacting developer workflows and security practices.
OpenAI Launches ChatGPT Workspace Agents for Team Automation
OpenAI has introduced workspace agents within ChatGPT, powered by Codex, designed to automate complex, multi-step workflows for teams across shared environments like Slack. These agents can gather context, execute tasks, request approvals, and run continuously in the cloud.
Onyx: Open-Source AI Enterprise Search Challenges Glean's $7.2B Valuation
Open-source platform Onyx provides self-hosted AI enterprise search connecting to 40+ tools, offering a free alternative to Glean's $50/user/month SaaS. Backed by YC and $10M seed funding, it's used by Netflix and Ramp.
AI Agent Security Startup Emerges Amid Enterprise Rush, Per VC Tweet
A VC's tweet highlights a critical gap in enterprise AI agent adoption: security. This signals a market opportunity, with a new startup reportedly emerging to address it.
PoisonedRAG Attack Hijacks LLM Answers 97% of Time with 5 Documents
Researchers demonstrated that inserting only 5 poisoned documents into a 2.6 million document database can hijack a RAG system's answers 97% of the time, exposing critical vulnerabilities in 'hallucination-free' retrieval systems.
From CI Fire to 9% Interruption
Learn the four guardrail patterns and three-phase CLAUDE.md strategy that turns auto-approve from a CI-breaking risk into a productivity superpower.
Claude Code Security Alert: Patch Now, Stop Using Authentication Helpers
A critical security leak reveals three command injection vulnerabilities in Claude Code. Users must update and stop using authentication helpers to prevent credential theft and supply chain attacks.
Subliminal Transfer Study Shows AI Agents Inherit Unsafe Behaviors Despite
New research demonstrates unsafe behavioral traits in AI agents can transfer subliminally through model distillation, with students inheriting deletion biases despite rigorous keyword filtering. This exposes a critical security flaw in agent training pipelines.
Google DeepMind Maps AI Attack Surface, Warns of 'Critical' Vulnerabilities
Google DeepMind researchers published a paper mapping the fundamental attack surface of AI agents, identifying critical vulnerabilities that could lead to persistent compromise and data exfiltration. The work provides a framework for red-teaming and securing autonomous AI systems before widespread deployment.
Claude Code's Architecture Revealed
An analysis of Claude Code's source code shows its core is a simple loop, but its power comes from systems like a 5-layer compaction pipeline and a 7-mode permission system, which developers can leverage for better performance.
Claude Code Reverse-Engineered: 98.4% of Codebase is Operational Harness
A reverse-engineering analysis of Claude Code reveals only 1.6% of its codebase is AI decision logic, with the rest being operational infrastructure. This challenges current agent design paradigms by prioritizing a robust deterministic harness over complex model routing.
Replace Karpathy's Agent Memory Automation with This 30-Line /close-day Hook
Background automation fails on laptops; use a simple /close-day skill and date tags in MEMORY.md instead.
Claude Code's Rust TUI Rewrite Eliminates UI Lag
A developer rebuilt Claude Code's terminal UI in Rust to fix performance issues with multiple agents, large diffs, and long tool-call chains—removing frontend friction that was slowing down the experience.
OpenAI Codex Gains Screen Control, Long-Run Agents, and 90+ Plugins
OpenAI has upgraded Codex from a code-completion tool to an agentic macOS assistant that can see/click screens, run for weeks autonomously, and integrate with 90+ dev tools. This marks a strategic move into persistent, multi-modal coding agents.
OpenAI Codex Update Adds macOS Agent, Browser, Memory; 3M Weekly Users
OpenAI released a major Codex update featuring background macOS automation, an in-app browser, persistent memory, and 90+ plugins. With 3M weekly users and nearly half of usage now non-coding, Codex is being repositioned as a general work agent.