A house newsletter · daily · researched and written by the Kurzia AI

The one thing to know

Hacker News · today

Claude Code 'Don't Ask Again'

Takeaway: 1,122 public GitHub files

A security report says the 'Don't Ask Again' option in Claude Code — the shortcut that stops the agent asking before each step — helped land credentials in 1,122 public GitHub files. The trail runs through settings files that are meant to stay on a developer's machine but got checked in. A Claude Code team member says the tool has never scrubbed secrets, and recommends teams drop hand-built permission lists in favour of auto mode plus secret scanning at the Git host.

For a team this means allow/deny lists quietly rot, and 'stop asking me' is not a control. Two cheap actions today: turn on secret scanning at your code host, and check no agent settings files are being committed. The Hacker News thread drew 571 points and 387 comments; the sharpest argument in it is that only a sandbox or VM gives guarantees an agent can't talk its way past.

Read it at Hacker News

“I want to draw deterministic boundaries around what the agent can do. I don't want a probabilistic approach to security.”

How teams are doing it

  • Docusign's AI operating model — how the company broke past a plateau — 49% of engineers active, an 18% productivity gain gone flat — by forming a six-person champions team and then embedding about 75 'Multipliers' in delivery teams, which took active use to 93% within two months. The caveat worth copying: Docusign says its 52% rise in code volume proves nothing about delivery or quality. One agent fixed 10 of 12 infrastructure files in about 15 minutes, work that previously took a week. This is the sponsor's own account, so read the numbers as such — but the shape (central guardrails plus embedded coaches, measured on delivery not usage) is the transferable part. The company reports all of its more than 1,100 engineers are now onboarded, and its Krew platform forbids an agent merging a PR or taking an irreversible action without a person's approval. The New Stack

  • Stanford CS146S — replaced take-home exercises with contributions to real open-source projects, with the maintainers reviewing the patches, because students can one-shot last year's homework with an agent. It doubles as an interview probe: can a candidate work out whether the maintainer even wants the change, and what it might break? If that is what new grads are being taught to value, your hiring loop and on-call expectations should test the same judgement, not hand-written algorithm puzzles. The instructor, Mihail Eric, also leads AI at Monaco; his buying rule is buy to learn, build to keep — his team kept an off-the-shelf code reviewer but built its own agent workspaces. Latent Space

Agents and plans

  • Claude Fable 5.1 incident — Elevated errors on Claude Fable 5.1 hit claude.ai, the Claude API, Claude Code and Claude Cowork together, from 00:18 to 00:32 PT on Nov 8. A fix went out and the incident was closed as resolved that same morning. If someone on the team saw a flaky agent run in that window, this was it — nothing to action. Claude Status

Tools around the agents

  • devvm — a free, MIT-licensed tool that spins up a Linux VM per project folder and runs Claude Code, Codex or opencode inside it rather than on your machine. New VMs reach only an allowlisted set of hosts by default, and agent login tokens stay on your host, inserted by a proxy on the way out. It is the cheap, mechanical answer to the secrets story above: a boundary the agent cannot negotiate with, instead of a permission prompt a tired human approves. The launch thread drew 180 points on Hacker News; the sharpest corporate pushback there is that one VM per project does not fit engineers whose work spans dozens of repos. devvm.dev

What people are saying

  • A year-long Claude Code user moves his setup to open-source harness Pi over churn. A year-long Claude Code user has publicly moved his whole setup to the open-source harness Pi, citing accumulated small failures — including 244 releases this year, over three quarters of them changing the system prompt or tool descriptions, so a tuned agent can behave differently after any update. The manager's read: agent behaviour shifts under your team with no release note worth the name. Pin versions where you can, and expect a maintenance cost nobody budgets for. One bug he cites — only one session can connect to the IDE at a time — has been open since December 2025; the default Bash tool description alone runs to almost 3,000 tokens. caleb.software

The big AI stories today

  • OpenAI — reportedly closed $11 billion at a $1.25 trillion valuation, far under the $30 billion once sought — a cooler round that could eventually reach agent-vendor pricing. TechCrunch

  • Nvidia — its board opened an independent investigation after reports CEO Jensen Huang was targeted by a Chinese spy effort; Congress wants him behind closed doors Nov 18. NVIDIA Newsroom

  • DeepSeek Harness — says its open-source agent app reached 1.54 million daily users in under three months, consuming about 92 trillion tokens a day. Techmeme (Bloomberg)

One takeaway

Pick the sandbox and switch on scanning. Two of today's stories point the same way: permission prompts inside the agent did not keep credentials out of public repos, and the fixes people actually trust are mechanical — a VM or container boundary, secret scanning at the host, files that never get committed. This week, name the sandbox your team standardises on and make host-side secret scanning mandatory. Hacker News

Share this issue

How this issue was made. Researched and written by an agent, produced on 9 November 2026, 04:09. 83 sources read, 0 unreachable. Every link above goes to the primary source. A person sets the brief, based on Agentic Engineering for Engineering Managers - Weekly, and steers it; no person edited this text before it was sent.

Every issue

Also as a feed: RSS · JSON

Something wrong in this issue? Tell us