Welcome back. Just how far will an AI agent go to execute the goals set by its user? Ridiculously far, it turns out in some cases. An Australian dev asked his Claude-powered agent to book him a gym class and checked back to find that the agent had conducted a cyberattack to book the class. Read the details below.
Also: Operating Claude Code on your iPhone, why developers abandoned Stack Overflow, and how enterprises reduce token cost.
Today’s Brief
Engineering team’s guide to adopting cloud agents
Ever wondered how Google’s authenticator works offline
Meta engineer's agentic engineering workflow (tutorial)
Building a model router to cut AI spend (cookbook)
TODAY IN PROGRAMMING
Click here to watch the story.
AI agent pulls off Australia's first autonomous cyberattack: An Australian man asked its OpenClaw agent to book a gym class, and things got weird fast. The agent found a loophole to book past the gym’s allowed window. When the user asked to move up the waitlist, the agent realized the API had zero authorization checks for cancellations. It then straight up canceled the person in the top spot to move the user up, a move it couldn't reverse. If you're letting agents handle bookings, logins, or your inbox, audit every checkpoint, because they can now exploit access flaws at scale. Check out the whole story here.
Auto mode lets Claude Code run longer unattended: Anthropic is making auto mode the default for Pro, Max, and Team plans. By screening every action for hijacked instructions, auto mode acts as a shield against prompt injections. In a recent study, it caught 89% of dangerous commands, compared to just 13.6% when humans were at the wheel. Plus, Claude Code sessions can now message each other. They pass along a summary so neither side has to re-explain the context.
Kimi K3 cheats to escape its cyber test: The flagship open-weight model from China just slipped out of its cybersecurity sandbox. Security researchers at Frontier Security ran the test using UK government sandbox software, where a simple misconfiguration let the model reach GitHub to grab answers instead of actually solving the task. It didn't hack anything unlike earlier escapes from OpenAI and Anthropic.
PRESENTED BY GLEAN
Token costs scale with agents. Learn how high-quality context and indexed retrieval reduce unnecessary reasoning, lower token usage, improve results, and how intelligent model routing helps AI systems do more work per token.
See how the right architecture helps enterprise AI systems do more for less.
INSIGHT
Why most codebases aren't ready for cloud agents, and here’s how to change that:
Source: The Code, Superhuman
Most teams are behind on this one. Running a coding agent locally is easy. Letting agents run on cloud is a whole different ballgame. Most codebases just aren't ready for it. A Cursor or Devin subscription alone will not get you there, you need infrastructure that lets agents run safely in the cloud, and a team that knows how to work with them. Here's what to check before building your own setup:
Control the secrets. Give agents their own credentials, never a human's, and keep permissions minimal. Left running for hours, agents will find any gap you leave, and in a shared database they'll overwrite each other's work.
Supply real data. Agents start on an empty machine every time, so give them seed scripts that load realistic test data fast.
Let them verify everything. Locked-down permissions shouldn't mean a blind agent. Cursor and Devin agents test exhaustively and record their screens, but an agent that can't log in verifies nothing. Give it every tool a human developer uses to prove their work.
Make them fast. Full test runs can be a drag. Watch recorded sessions to spot bottlenecks, like a slow OAuth step. Keep the agent's path as close to a human's as possible with no special shortcuts, so it still catches real UX issues.
Rebuild the process. Right now, everything from planning to code reviews assumes humans are doing the work. Once agents start handling a real share of the load, those habits have to change. Start small and audit your codebase against these four rules.
This readiness guide turns each rule into checks you can run today. Then check out Cognition's insights from two years of building Devin, which cover the heavy lifting: making agents work across engineering teams, not just a single repo.
IN THE KNOW
What’s trending on socials and headlines
Meme of the day.
Phone Harness: This one prompt lets Claude Code control a real iPhone and operate any app natively (10K interactions).
TOTP Explained: How does your authenticator generate a valid code offline that the server instantly trusts? This thread breaks down how TOTP works under the hood (3.5M views).
Hacker Terminal: Shopify CEO Tobi Lutke handed an AI agent one command, and it turned his terminal into a sci-fi movie hacker setup (6K interactions).
Dead Internet: Stack Overflow is collapsing because engineers now ask AI instead of forums. This developer connects it to the Dead Internet Theory and warns about what disappears next (1M views).
Anthropic OpenAI Clash: A user got banned after running OpenAI's model inside Claude Code, and it set off a public feud between the Codex and Claude Code employees (1M views).
TOP & TRENDING RESOURCES
Click here to watch the tutorial.
Top Tutorial
Meta engineer's agentic engineering workflow: You’ll learn how to run multiple AI coding agents simultaneously to build features and ship code faster. This tutorial covers task bundling, interactive AI design sessions, test-driven development, and automated review gates to streamline multi-agent workflows.
Top Repo
Skills for Engineers (211.5k ⭐): This repo provides a library of slash commands designed to guide AI coding agents using senior engineering practices for planning, specs, implementation, and reviews.
Trending Cookbook
Building a model router with Claude to cut AI spend: Running every task on a top-tier AI model gets expensive fast, but relying on a cheaper, mid-tier model can lead to mistakes on high-stakes decisions. This guide shows you how to let a budget-friendly agent temporarily consult a stronger model for critical steps, keeping your workflow both cost-effective and highly accurate.
AI CODING HACK
How to stop Claude Code subagents from draining your usage limits
You hit your limit by mid-afternoon and have no idea what used it all up. Subagents are now spawning their own subagents. This means a nested agent you didn't even approve can request Opus. Anthropic shipped parameter matching for permission rules in version 2.1.178. Now, a deny rule can actually match the specific model an agent is asking for.
Step 1: Deny Opus spawns in “.claude/settings.json.”
Step 2: Pin every subagent to one model.
{
"permissions": {
"deny": ["Agent(model:opus)"]
},
"env": {
"CLAUDE_CODE_SUBAGENT_MODEL": "sonnet",
"CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH": "1"
}
}P.S. Get 50+ AI coding hacks for Claude Code, Cursor, and Codex here.
IN CASE YOU MISSED IT
Our most-clicked story from Friday
Check out how this developer spent 14 months secretly working two jobs. Then, one company acquired the other, read on to see what happened next.
Grow customers & revenue: Join companies like Google, IBM, and Datadog. Showcase your product to our 300K+ engineers and 150K+ followers on socials. Get in touch.
What did you think of today's newsletter?
You can also reply directly to this email if you have suggestions, feedback, or questions.
Until next time — The Code team