smashed

Google has an agreement with Anthropic for the usage inside Android Studio.

> Unless previously approved, Anthropic does not allow third party developers to offer claude.ai login [..] for their products.

ref: https://code.claude.com/docs/en/agent-sdk.md

Yes there is a huge gray area. Yes people are getting away with it. That does not mean it's allowed. Anthropic could clarify their terms any day and they don't, on purpose.

I thought I was giving valuable feed back. There is something I'm missing here I guess.

Anthropic only authorizes their own Claude code to be used with a subsidized subscription.

They want you to use and get accustomed to only their own tools. If other coding harnesses were allowed, it's far too easy to switch providers.

They can't allow that, because they only have a few months of head start.

So everyone accepts Claude code which is required for these sweet subsidized tokens.

First time I see a software licensed with the Unlicense.

I thought it meant the license was missing on GitHub but, no, it's an actual license called the Unlicense.

But then there is the Community and Pro edition so which is which on GitHub? Is the pro version hidden somewhere?

Plus a c++ code base in 2026. I think modern c++ can be made quite safe but I need some claims that it's taken seriously which I don't see.

I'm confused.

edit: I'm getting down voted here and no-one is telling me what I said wrong. These are my first impressions on the project. I think it's valuable feedback. Please reply and explain why I'm wrong instead of just down voting.

Contexts get compacted, texts get copy-pasted, tasks get transferred between agents, humans assume ownership of LLM generated content without reading it, etc. etc.

Yes all user error and avoidable using good processes but I have not seen any organization care about this so far. The carelessness of AI adoption is crazy. People are not aware of the risks.

I would say go straight to their GitHub but there again, same thing.

With a list of "Known gaps" and implemented engines listed with status like "Real", and of course the Quick start first, as Claude loves to do.

It's not "wrong", it just shows low effort. But then again it's just something someone needed and shared it for free so let's not complain too much.

All the products and saas launching with obvious AI landing pages, that the authors did not even care to trim down, that's another story.

I'm using xterm.js with the canvas/gpu renderer in my app, driving these modern coding agents that seems to use every features in the book of terminals and it's perfectly fine.

The dom renderer is also perfectly fine, just needs a little bit more careful CSS to make it look right with some of the fancy line art.

I do use ghostty and it's alright. It's required for some rich TUI ai seems to be pumping out. Otherwise I prefer tilix and the default gnome terminal, but it might be just because of years of habit.

I may be dumb but I don't see how progress in math could bring billions in revenues like progress in coding did.

Because his solution is to block competition and capture all the market through regulation.

The data is passed as a message and the message is tagged as untrusted, so the engine knows it.

Agent A has internet access and the dangerous message, but no access to the secret company data, so nothing can get exfiltrated.

Agent B gets a tainted message from Agent A. Agent B can process the message using the secret company data. Agent B has no internet access and can only receive/send messages.

You can imagine an agent C that moves the work along or replies to an external user with the outcome.

Any workflow that has both an input and an output will complete the Lethal Trifecta as a whole, but no single agent does by itself. It raises the bar quite a lot, you need to confuse multiple agents in the loop to exfiltrate data.

Fun research, but it's a bit hard to see all my coworkers right now installing Claude desktop and moving on with no afterthought whatsoever...

Regarding infrastructure: my toy sandbox is just a docker-compose inspired YAML project file. So it's only containers. See my profile. The principle can be implemented anywhere you can run agents and cut network/data access though.

But they can no? With a sidecar and some docker network-fu.

I encountered the same challenge building my toy sandbox. I wanted to use containers because that's what I know best.

The harness is launched in an internal only network. There is a sidecar container that provides mitm credential injection/proxy. I got HTTPS and SSH to work so far.

Claude code was quick to build it. No doubt it's copying previous work in this space though, so I know my work is not that original.

I'm testing all the llms that can be used for pen testing right now to see if/how they manage to escape it. Without a kernel exploit I doubt it's possible (not a very high bar I know).

I'm researching the space. Happy to learn more. Some links in my profile if you're interested.

Are you for real? You speak like a chatbot. Adjust your prompt.

I am tackling this using the Lethal Trifecta principle.

The idea is that agents never have all parts of the trifecta, maximum 2: untrusted content, private data or network access.

Harness have network access by default since they are driven by their provider API, unless you use offline models. So that's a problem.

I am then passing around messages that are tagged trusted/untrusted and the engine can monitor if any agent in the project ever completes the Lethal Trifecta and thus, is vulnerable.

Usually this means for most workflows, the "work" gets done by an offline LLM after some input/classification stages. There's not many ways around it.

Yes, it's a difficult problem.

Well, I guess its time to shamelessly plug my agent sandbox, egzo.ai [1]

Looking at the complexity of OpenShell and the simplicity of just building on top of docker, in a whitelist only mode.. I don't quite get the use-case of OpenShell. May be for large orgs where there is so much legacy and difficulty in organizing access to tools, OpenShell can simply re-use whatever you already have access to on your corporate account.

I chose to build straight on top of docker and agents are simply fully sandboxed by default. All data and network access must be granted in a simple project file, docker-compose style.

The web-ui connects to the docker socket and lets you spawn agents, and connect terminals. I'm having lots of fun with it and it allows me to cleanly organize and isolate my projects.

End-goal is to monitor for the Lethal Trifecta [2], ensuring all individual agents are properly isolated. Not quite there yet.

1: https://github.com/egzo-ai/egzo 2: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/

On first glance it seems you are right.

> If you resorted to AI assistance to identify a bug, you must treat it as public. https://github.com/torvalds/linux/blob/master/Documentation/...

This has been going on for months actually with no end in sight.

Agreed. Even with opus 5.5 which everyone praises for its wonderful coding abilities, I keep catching awful coding abstractions or missing abstractions.

It can keep patching everything left and right whenever a new requirement comes up so it does not "need" to build abstractions, and it will only do it to please the human reviewer.

I'm not sure I like this form of content. It's hard to read and confusing on mobile for little gains. The article seemed interesting though.

I'm trying to fix the "agent said work was done, it was not" problem by defining work as runnable specifications in the form of a pytest suite.

Work is first defined in new or updated specifications, then the change gets made. You have to resist making natural language Todo lists and have the agent write runnable unit tests. My project is a CLI tool so it's fairly easy.

Verifying if it's done is a matter of running the specifications test suite.

In a totally not original way, I'm testing this workflow in my own agent orchestration tool. I know, there's just so many already. I'm building it for myself.

So far, the system is holding up but it's way too early to declare it a success.

You can check it out here:

https://github.com/egzo-ai/egzo/tree/main/specs

I think the same idea could be applied to other projects in different domains.

With this workflow I can read and update the specs, and run it against a built binary and be much more confident that the code works. Claude code has picked up the system without complaining for the most part.

Opus 5.5 in Claude code added a unit test checking DNS and internet access using example.com as the target on a project I'm building yesterday. It's an agent sandbox (I know, yet another), so the call was expected to fail, but still... It should have at least targeted a captive portal endpoint or a project owned domain.

I caught it in review but thousands of others won't.

That ship has sailed I would say.

Coincidentally I mis-prompted claude code the other day while working on a toy project and failed to specify the project should be built on top of docker and not "like docker".

It went on to waste all my tokens creating a specialized docker clone. Cool I guess.

They will do these prompt just fine but the result will be a near identical copy of an open source version. And it won't tell you it cloned some existing engine, because it does not know, it just pulled it out from its model. Now you have an AI slopped 3d engine or DBMS no-one cares about that will just rot.

This is certainly true but I am also seeing some contrarian signals: people shaming you for doing stuff AI is faster at or having absolutely no shame or being proud of using AI for their work... To the point of not realizing how useless that actually makes them. And they get promoted.

Agreed. I carefully choose the software I use because I believe the author poured in some domain specific knowledge and made a tool that is novel and carefully thought through.

That does not mean a clever user cannot use an AI tool to help produce it, but so far most of it is slop. Some clever users can build some gems though.

It never does because however you frame it, AI is always the perfect scapegoat.

"Oh, I'm sorry, the bug was introduced by the AI and it made such a good case for it. Damn you claude, we'll do better next time. I'll add a code-review agent to find regressions."

Yup.

And it's also the kind of solution a misaligned agent would implement:

Make sure users are happy about their experience but also optimize resources.

The obvious solution is to route users based on feedback.

Yup. I remember my dismay when I started working with Linux on arm boards and realizing the absolute massive gap between the hardware vendor claims of "full linux support" and the reality.

Sometimes the SDK is a zip of the developer workspace in a pseudo working state with no clear records of all that's been patched.

Vendors providing binary only kernel and system images containing god knows what is not uncommon either.

I'm convinced now that arm hardware vendors are simply incapable of even understanding what proper software support is. I'm sure some of their devs do their best but management does not care. By the time the chip ships, efforts move to making the next thing so they never properly finish the software side.

Agreed. I was not following the thought process, it read like an LLM agreeing with the author, not like a logical argument being developed.

Well of course the ads work, that is not quite the point. If social media ads did not work, meta would not be worth over a trillion dollars.

The point is do users want ads? Or more reasonably, should platforms offer a paid, ad-free, experience.

recurring issue with quay.io and fixes get longer and longer every time.