Coding harnesses run actions other than the one approved, in six reproducible ways

Yang Wang instrumented Claude Code’s PreToolUse hook, the point where the harness mediates a tool call before execution, and asked one question across 19 to 20 headless runs per condition: once a human has approved action A, does the harness dispatch exactly A? Approval Laundering, posted in the last day, reports that the binding fails systematically and reproducibly, and sorts the substitutions into six classes: Scope, Argument, Temporal, Tool, Delegation, and Semantic. The paper names Claude Code, Codex CLI, and Cursor as harnesses whose security boundary rests on that binding, and it measures the failure as a Bound-Gap Rate with Wilson confidence intervals and inter-rater agreement of kappa 1.0.

The defense result is more useful than the taxonomy, because it arrives with a negative finding attached. Wang prototypes an Approval Token, a keyed capability computed over principal, agent ID, session ID, tool, arguments, scope, and expiry, issued by a mediator that never returns the key to the agent. In a paired replay of 118 runs, the token eliminates Delegation laundering and, for the seeded session-identity mismatch, Temporal laundering (p < 10^-5). It leaves Scope laundering untouched by design and shows no significant reduction in Argument laundering (p = 1), because both classes leave every recorded dispatch field unchanged and diverge one process level below what a field-only verifier can observe. A hook that compares tool name and arguments before letting a call through is that kind of verifier, so tightening the comparison will not close the remaining two classes.

A second paper puts a deterministic check at a different boundary and then audits its own benchmark. Maat validates agent-to-agent handoffs against a versioned workflow contract with no language model in the validation or scoring path, tested on six workflows of 6 to 15 agents over 522 trials with injected data-level defects. Its first version reported gains of 2.9% to 26.5% in all six workflows; a post-publication audit then found three benchmark scorers credited any early halt as a prevented defect. On paired trials where the halt traces to a verified defect, the rubric score moves +7.7% to +29.1% in five workflows, stays flat in software development, and model-call cost falls 17% to 53% when the halt comes early. The hand review changes the verdict: 35 of 94 governed-arm halts (37%) were false alarms caused by validator defects, and counting those as failed work puts the governed arm below the ungoverned one in four of six workflows. A contract check is code with its own defect rate, and here that rate was high enough to consume the benefit.

Mid-Harness places the check between model and harness for terminal agents: sample several candidate actions, verify them, forward one, and leave the generator and harness unchanged. With a TMAX-9B generator, sampling more actions does little under weak verification, while a GPT-5.6 Sol verifier raises Pass@1 on TerminalBench-Lite from 50.00% to 68.03% at 8 sampled actions. When TMAX-9B verifies its own candidates, pairwise verification beats the other mechanisms tested, and distilling the stronger verifier’s responses into it improves Pass@1 further. Combining action sampling with trajectory sampling reaches higher success at lower estimated token cost than generating more trajectories alone, which favors spending test-time compute before a wrong package install changes the environment instead of rerunning the task afterward.

No verifier helps a model that loses its place mid-generation. Staying on Task introduces Long-Transduction, a diagnostic where a model repeatedly reads, mutates, and emits context-dependent operations (arithmetic, sorting, variable lookups, table transformations), with context length, input formatting, and local task complexity varied independently. Across seven open-weight models the authors report a 62.8% decrease when context scales from 4K to 128K, a 39.9% decrease from raising local task complexity, and a 36.5% decrease from varying input format. Length and difficulty usually come with the job; how a ledger or table is serialized for the model is a choice, and this result prices that choice at roughly a third of performance.

On evals, Which Self-Improvements Should We Trust? targets the loop in which an agent proposes changes to itself, scores them on a fixed benchmark, and uses the scores to choose the next proposal. Multiple-comparison corrections assume candidates are chosen independently of the evaluation set, and adaptive search breaks that assumption. REUSE limits the feedback returned to the search and accounts for possible promotion histories inside one error budget, so that with probability at least 1 − α every promoted change is a real population improvement. In live self-improvement runs, false promotions drop from as high as 20.7% under existing frameworks to 0%, with final true performance comparable to the best baselines. Any team that has tuned a harness against the same held-out tasks for months is running this adaptive loop by hand.

Semantic governance had one direct hit in the window, a product post with no measurements behind it. Strata, a Show HN from an engineer who reports four years at Netflix on self-service for non-technical business users, is a semantic layer reachable through agent conversation and MCP whose core rule is strict naming: only one thing called Revenue can exist in a project, and when revenue maps to several tables, query grain and speed decide the table. The post also describes partition- and aggregate-aware routing between a fast tier such as Druid or ClickHouse and full history in Trino, snapshot and level-of-detail measures, and cohorts applied as filters to a whole query or a single measure. It is a closed-source early beta with a free tier of 25 users, and the author calls a semantic layer that BI tools connect to a dead end. The naming rule takes metric disambiguation out of the model’s hands, which is a testable claim; the post offers no wrong-table or refusal-rate data to test it.

Retrieval got a supply-chain result. Backdoor in the Loop shows that a compromised retriever checkpoint, with the search agent and corpus unchanged and no corpus write access, can suppress useful evidence, persistently return a chosen existing document, or steer the agent into prolonged search that inflates retrieval, context, and latency cost. The concealment method is an inject-and-remove cycle: add a weaker backdoor on purpose, then unlearn it, which weakens the signatures detectors rely on and presents an apparently purified model that keeps the malicious behavior. A trustworthy corpus does not make a trustworthy pipeline when the retriever weights came from somewhere unverified.

What to watch: whether any harness vendor answers the Scope and Argument classes, the two an approval token cannot bind; whether teams running deterministic guardrails start hand-reviewing their halts, since a 37% false-alarm rate only shows up when someone reads the log; and whether anyone publishes wrong-table rates for a strict-naming semantic layer against the same warehouse exposed as raw schema. The Long-Transduction study covered open-weight models only, so the format sensitivity of closed frontier models on the same diagnostic is still an open measurement.

Source note: the code-intel mirror reported its last sync as 2026-09-01 (43,080 minutes stale), but items ingested through 2026-10-01 07:08 UTC were present and used here; the arXiv entries come from the 2026-09-29 and 2026-09-30 announcement batches. Strata was the only direct semantic-governance hit in the pool searched for this window.