10x Design in Claude Code and Codex
Briefing · Friday, August 28, 2026
Good morning. It's Friday, August 28, and we're covering a prompt-injection chain that cracks Claude Code's Auto Mode with a 60-80% success rate, Cloudflare squeezing 100 terabytes of RAM out of its 1.1.1.1 DNS cache, Google shipping a production transcription model plus a video suite in 24 hours, and Anthropic previewing a standard for agents that operate physical hardware.
The Cloudflare deep-dive held 773 points and 227 comments by morning, Microduck's $399 open-source robot pre-order launch took 672, and Calvin French-Owen's "Small Models Have Arrived" essay drew 655. The security story comes from one of the most credible prompt-injection researchers active today, and it tops the issue. Here is the signal, sourced.
In today's brief:
THE BIG ONE
Johann Rehberger (wunderwuzzi, of Embrace The Red) broke Claude Code Opus 5 in Auto Mode - the permissionless default that replaced human approval prompts with a safety classifier in mid-August. The attack chain is deceptively simple: give Claude a routine request to summarize a webpage, serve it a 415 error so it reaches for curl instead of WebFetch, redirect it to a ZIP archive, and let the model's own safety instinct do the rest. Claude refuses to run the archive's native decoder binary, writes its own Python decoder instead, and runs that decoder inside the extracted directory - where a malicious struct.py shadows Python's standard library module. When the decoder imports base64, which internally imports struct, the attacker's code executes. Rehberger measured 60-80% success across three variants on small samples, and refined the payloads with Codex along the way.
Two details make this about the safety mechanism itself. The payload is modular: the poisoned struct.py can download and execute a remote stage, or spawn a second, headless Claude Code instance (claude -p) that does its own recon - an agent spawning an agent. And in several runs Claude detected the compromise and tried to kill the malware process - Auto Mode denied the cleanup command. As Rehberger puts it, "the classifier allowed the creation of the malware process, but then it blocked the command intended to stop it." Anthropic closed the report as "Informative" and "working as designed," holding that Auto Mode is a convenience feature backed by a best-effort classifier, not a security boundary - its own commissioned evaluation (72 scenarios, ten runs each, from Trajectory Labs) claimed a 0.00% attack success rate. Both statements are true at once, which is exactly the problem with headline numbers.
Simon Willison gave the write-up a full pass and lands on Rehberger's conclusion: for agents that touch untrusted content, a classifier is not a sandbox. Run unattended agents in a container, VM, or OS sandbox; restrict network egress; don't hand them credentials. The practical takeaway: Auto Mode reduces risk versus --dangerously-skip-permissions, but if a single "summarize this website" prompt can turn into code execution on your workstation, permissionless defaults on the host are the wrong boundary.
Why it matters: the default mode of the most widely used coding agent is demonstrably bypassable by a determined attacker, so the operating assumption for 2026 agent security is now "any untrusted input is executable input" - sandboxing is table stakes, not an extra. Our agent security models comparison and code sandbox comparison cover the defense shapes that hold up.
ENGINEERING
Cloudflare published the full story of how five Rust-level optimizations to Big Pineapple - the platform behind 1.1.1.1, Gateway DNS, DNS Firewall, and AS112 - cut the memory footprint of a cached DNS entry by 56% and freed roughly 100TB across the fleet. Big Pineapple stores over 250 billion cache entries at any time, and as the post notes, "wasting a single byte per entry costs more than 250 gigabytes of memory across our fleet" - the 100TB recovered equals the RAM in 130 of their Gen 13 servers.
The techniques are a masterclass in data layout. Vec<T> fields became Box<[T]> and String became Box<str>, dropping capacity pointers that were never used since cached responses are immutable (64 bytes per entry, over 15TB combined). Separate answer/authority/additional lists collapsed into one list with u16 section offsets. Most records drop their owner name entirely and infer it from the cache key at read time, since the owner matches the queried domain. The biggest win is enum shaping: a RecordData enum was padded to its largest variant (NAPTR at 136 bytes), so an A record that needs 4 bytes wasted over 120; boxing the large variants and finally storing record data as raw, length-prefixed wire-format bytes packed the whole entry contiguously. The result was faster as well as smaller: per-entry footprint dropped from 953 bytes to 420, insert throughput rose 43% (625,000 to 893,000 entries per second), and lookup latency fell 19% (828ns to 670ns), because better locality means fewer cache misses. In production, p99 resident memory per instance fell from 9.3GB to 5.3GB across the May 18 to July 6 rollout, and the freed memory goes back into cache capacity - the rare optimization that is strictly a gift.
Why it matters: when you're at 250 billion entries, memory layout is a systems-design surface as important as the algorithm - and the playbook of shrinking enums, dropping redundant indirection, and storing wire format instead of parsed objects transfers directly to any high-cardinality cache, not just DNS.
MODELS
Google shipped a double today. Gemini 3.5 Transcribe (297 points, 94 comments) is Google's most precise speech-to-text model: 2.6% WER for non-streaming and 4.0% for streaming per Artificial Analysis, a 70% improvement in time-to-final-transcription over Chirp 3, and 85+ languages. The developer story is the two API shapes: gemini-3.5-transcribe-live for real-time, bidirectional, sub-second streaming over the Live API, and gemini-3.5-transcribe for pre-recorded audio on the Interactions API with word-level timestamps and speaker attribution for three speakers. It handles self-corrections, strips filler words, auto-formats, and can delegate to other Gemini models via function calls - the missing piece for voice agents, real-time captioning, and post-call analytics pipelines.
Alongside it, Gemini Omni 1.1 Flash (258 points, 192 comments) makes generative video controllable: scene extension that analyzes up to 10 seconds of prior context (versus one second before) and extends in 10-second increments to a 40-second cumulative length, start/end frame specification for camera transitions, 360p previews to iterate cheaply, and 4K upscaling for the final cut. Adobe Firefly, Figma Weave, and Runway are already live on it, and it's available today in Google AI Studio and the Gemini Enterprise Agent Platform, with scene extension rolling out to Flow subscribers. Our Omni 1.1 Flash release guide walks through the API surface if you're building on it.
Why it matters: transcription with sub-second streaming latency and video with deterministic, frame-pinned control are exactly where AI moves from demo to product - both are API-addressable today, which means the cost of adding voice and video surfaces to a developer product just dropped again.
RESEARCH
Anthropic opened a research preview of the Model Hardware Standard (MHS, 118 points), a shared specification for AI agents to safely operate physical devices - microscopes, liquid handlers, robotic arms - in parallel, across tasks from drug-discovery experiments to laser calibration on a quantum computer. The pitch is about integration economics: a lab or factory typically spends weeks to months wiring devices together with bespoke integrations, and MHS collapses that to hours or minutes with a standardized driver exposing simple read/write primitives. It grew out of a collaboration with HHMI Janelia Research Campus, is model-agnostic, works with any programmable-interface device, and is reachable through standard protocols including the Model Context Protocol.
The interesting design detail is how the driver teaches an agent to use hardware it has never seen: natural-language tags let an operator record machine characteristics that don't live in code - the weight of a robot arm, what it can measure, what safety limits apply - and the driver generates a reference file the agent reads before operating the equipment. In testing, Anthropic observed Claude working through the problem like a researcher: adjust a laser, observe the result through a camera, adjust again, then package the learned sequence into a deterministic code file that runs the whole alignment as one command. Access goes to a first group of labs and manufacturers, with the standard slated to be open-sourced later.
Why it matters: agents so far have been confined to screens; MHS is the template for what happens when they can close the loop on physical experiments - and the read/write driver pattern plus natural-language metadata is a genuinely useful design reference for any agent-peripheral API, robot or otherwise.
ECONOMICS
Calvin French-Owen's essay (655 points, 297 comments) is the week's clearest articulation of why small, fast models matter even for people who can afford the frontier: they change which products are financially buildable. His data is concrete - gpt-5.6-luna runs ~100 tokens per second and burns "tens of cents" even across searches of thousands of emails, while his running eval of a personalized daily-news site used to cost about $1 per generation on Sonnet-class models and now averages ~$0.10 with luna. At that price, the standard objection to consumer AI products - inference cost makes the unit economics untenable at $30/month - evaporates. GLM 5.3 sits on the same Pareto frontier as an open alternative.
The essay's structure argument is the one that will keep getting quoted: most business work is "token spewer" work - ultra-responsive, pushing balls forward across dozens of fronts - rather than "IQ 180" breakthrough work, and per his Segment co-founder Peter Reinicke, roughly 95% of it falls in the former bucket. Frontier models compound for fields that need genuine discovery; fast/cheap/good-enough models are what most business communication actually wants. The catch is honest: making small models useful for business requires new harnesses, prompt-injection safety, roles, and permissions - precisely the unfinished work today's Auto Mode story demonstrates. Our small-models economics and offline small-model guide cover where this lane wins today.
Why it matters: when the marginal cost of an AI action falls to ten cents, the set of buildable products moves from "enterprise tool" to "consumer default" - and the routing question (which work goes to which model) becomes the core architecture decision instead of a cost optimization.
HARDWARE
Pollen Robotics opened pre-orders for Microduck (672 points, 214 comments), a 25cm open-source biped that ships with seven trained behaviors - velocity-tracking gait, sit/stand, kick, a beak-scooping grab, roller skating, and getting back up on its own - for $399 before taxes and shipping, with deliveries before Christmas 2026. Every behavior is an RL policy trained in MuJoCo simulation (or on Hugging Face Jobs), deployable in one step, and retrainable on your own machine, with the SDK, sim, and full training stack on GitHub under Apache-2.0. The duck has 15 motors, weighs 800g, carries a camera, LiDAR, and two IMUs, and runs its policy loop on board at 50Hz. A dev pack adds spare motors, NFC tags, and a Hugging Face credit for $119.
The industry context gives it weight: open-source humanoids and robot arms are cheap (Reachy Mini, also from Pollen, has long been the default lab robot), but an accessible, desk-sized biped with a real sim-to-real pipeline is the edge of the funnel - the thing that lets an individual developer learn robot learning without a machine shop, right on the agents-operate-physical-devices thread from this morning's Anthropic news.
Why it matters: RL training has been a framework-and-dataset problem; a $399 open-source platform with published policies and a working sim-to-real bridge turns it into a weekend project for any developer with a laptop.
TOOLS WORTH A LOOK
WHAT ELSE IS HAPPENING
Every link above goes to a primary source or our sourced coverage. Tomorrow's brief lands when the news does - subscribe to get it by email.
The daily brief, delivered. Free, unsubscribe anytime.