Claude-Code

A thin thread slipping through a gate that is already standing open, while a second gate behind it never rises

The malware stopped saying please

A repo config that runs code on open is twenty years old — tasks.json, npm postinstall, git hooks. We built the countermeasures too: Workspace Trust, git not shipping hooks on clone, direnv re-blocking on any change. The AI editors regressed on all of it, then added the new part: the config now writes itself from untrusted input, executes before any classifier or prompt gets a vote, and lands with your account’s access to everything you’ve authenticated. Closes with an operator’s appendix: how to lock it down, and where the file hides. Part three of a series, on the device.

A single calm gate standing open on a wide plane, a thin thread walking straight past it instead of through it

Where we're going, we don't need UAC

UAC, sudo, and macOS auth gate vertical escalation — user to root. A coding agent’s blast radius is horizontal: the full reach of an already-authenticated user, which almost nothing mediates once you’ve signed in. We learned the everyone-is-Administrator lesson in 2007. The agent put us back in 2004, and this time the malware says please. Part two of a series, on the device.

Abstract laptop silhouette as a closed perimeter, with inference contained inside, on deep ink black

Local inference, on purpose

Notes on actually running models locally on an M4 Max: omlx as the server, Qwen3.6-35B-A3B and GLM-4.7-Flash for agent work, gpt-oss-120b for writing. Why pointing Claude Code at localhost is fine for offline ergonomics and wrong as a perimeter.

Automated gate opens for expected form while off-shape form slips past

Auto mode is a sensor too

The third time this year I have written down the same epistemic mistake. Auto-accept loops in agentic IDEs trust a classifier to be a control. Real bypasses already exist. The sufficiently motivated attacker problem is now sitting on your laptop, deciding which files to edit while you make coffee.