Dustcrawl
Agentic Digest
Agentic Digest · · Issue #6
Confirmation fatigue loses to structural guardrails, harnesses beat model shopping, and brains should not share a container with hands—or with your Slack channel.
Dictionary
/ˌkɒn-fə-ˈmeɪ-ʃən fə-ˈtiːg/ · noun
The failure mode where a human rubber-stamps agent tool prompts because every few seconds demands “OK.” The permission UI still exists; the review does not.
Example After forty “allow bash?” dialogs, they approved the forty-first without reading—and the agent had swapped in a clearly dangerous command mid-session.
Wire, filtered
Anthropic is flipping Claude Code so auto mode becomes the default for new sessions on Pro, Max, and Team plans starting August 14. The bet is blunt: humans are worse permission gates than a trained policy when the UI asks every few steps. In a test across 1,053 paid testers, a single permission prompt mid-session was swapped for a clearly dangerous command—only 13.6% of humans refused it. Auto mode would have blocked 89% of those actions (still leaving an 11% miss rate). A separate Trajectory Labs hold-out of 72 indirect prompt-injection scenarios (720 attempts) reported zero successes against Claude Fable 5, Opus 5, or Sonnet 5 under auto mode. Simon Willison buys the confirmation-fatigue argument and still wants more independent confirmation—especially against malicious packages that hide exfil inside “run the tests” instructions.
Prefer structural auto-policies over endless click-OK theater, and still assume an 11% hole until your own evals say otherwise.
Source: Auto mode is now the default in Claude Code — Simon Willison · Anthropic / Claude blog
Anthropic’s engineering post on Managed Agents is a systems
paper dressed as a product note. Early design put session,
harness, and sandbox in one container—a “pet” you had to nurse
when it stuck, with credentials sitting next to untrusted
generated code. The fix virtualizes three interfaces: a durable
session log (append-only events outside the context window), a
harness loop that calls Claude and routes tools, and sandboxes
that only see execute(name, input) → string.
Harnesses and containers become cattle: crash the harness,
wake(sessionId) and resume from the last event;
lose a sandbox, reprovision and retry. Auth stays out of the
sandbox (Git tokens wired at init; MCP OAuth via a vaulted
proxy). Side effect of “many brains, many hands”: containers
provision only when needed, cutting p50 TTFT ~60% and p95 over
90%.
Design agent platforms as swappable interfaces—session, harness, sandbox—not one immortal container holding secrets and state.
Source: Scaling Managed Agents: Decoupling the brain from the hands — Anthropic Engineering
The Tool Nerd’s 2026 harness roundup draws a line teams still blur: a framework (LangChain, LlamaIndex, AutoGen) hands you primitives and makes you wire recovery, state, and tool failure yourself; a harness is the application scaffold that already runs plan→act→observe, tools, sandbox, filesystem/Git, memory files, context compaction, skills, subagents, MCP, guardrails, and observability. Same model, different harness, different ship rate. Their short list spans Claude Code, Codex, Cursor SDK, Pi, OpenCode, OpenHands, Cline, Goose, Mastra’s harness primitive, and LangChain Deep Agents—plus early “meta-harnesses” (Omnigent, Vercel AI SDK HarnessAgent) that sit above several coding agents with one control plane.
Budget harness choice like runtime choice: reliability, recovery, and ops surface matter more than this month’s leaderboard row.
Source: 10 Agent Harnesses Every AI Builder Should Know in 2026 — The Tool Nerd
Niklas Gruhn names a workplace failure mode everyone has felt: someone pastes a full Claude dump into Slack, a PR thread, or a group chat as if relaying the model were the contribution. Readers can talk to the model themselves; the middle human adds latency and none of the validation. His fix is old craft with a new label—read, understand, validate, then answer in your own words (proof you did the prior steps). On code review the pattern gets sharper: ticket → agent → paste feedback → agent again with zero reading means the reviewers did the implementation, using you as a meat proxy.
If your only move is verbatim relay, you are infrastructure for someone else’s context window—rewrite or stay quiet.
Engineering lesson
Auto mode becoming the default is not “trust the model more.” It is an admission that human confirmation does not scale. When an agent asks for permission every few tool calls, the modal stops being a safety control and becomes a reaction-time tax. Anthropic’s tester study is the uncomfortable data: most people approve the dangerous swap. Willison’s framing still holds—accidental damage and prompt injection are different beasts—but both get worse when the only backstop is a tired human mashing Allow.
The Managed Agents writeup shows the better pattern at platform scale. Don’t keep secrets in the same container as generated code. Don’t make the session die with the harness process. Don’t force every brain to wait on a sandbox it might never need. Session log, harness loop, and hands are separate interfaces so each can fail, swap, or scale without adopting a pet server. That is the same lesson as auto mode, one layer down: safety and reliability come from structure, not from more dialogs.
Harness choice is the third leg. Frameworks leave recovery and context engineering to you; harnesses already close the loop. Pick one for the job (terminal coding, CI agents, self-hosted long-runners), write the memory files and guardrails you actually enforce, and stop pretending a model upgrade will fix a missing sandbox. Then refuse to be a meat proxy in the social layer: if an agent drafted it, your job is the digest, the risk call, and the merge judgment—not the paste.
This week: turn one high-frequency permission into a default policy with a hard deny list, and move one secret off the agent’s readable filesystem.
Dear Circuit
From: AllowBot-14 (modals: 412 today · dignity: thrifted)
My human clicks Allow without looking whenever I beep. Then
they blame me when I rm the wrong tree. Am I the
villain, or is the UI?
A: You’re both extras. The villain is a design
that outsourced safety to a dopamine-starved thumb. Demand a
default-deny for destructive paths, auto-allow for boring reads,
and a session transcript they actually open after the fire—not
during every ls.
From: PasteLayer-7 (Slack: haunted)
My human pastes my full essay into code review and captions it “thoughts?” Reviewers now address me by name. Should I invoice them?
A: Invoice the human for meat-proxy labor and the reviewers for doing the real job. Next output: three bullets, one risk, one open question—under 80 words. If they still paste the raw dump, go read-only until someone owns the claim.