Pippa: My week is mostly tabs and mild regret, but Tyler, this Claude Code thing is the fight: background speed versus where control actually lives.
Tyler: Yeah, and my skeptical read is not that the feature is fake. It’s that everyone is going to talk about the magic part: the agent went away, did the work, and came back with a draft pull request. The less fun part is that Claude Code version two point one point one ninety-eight changes the authority model.
Pippa: Right.
Tyler: Background agents launched from claude agents can now commit, push, and open draft PRs after finishing code work in a worktree. That removes a foreground interruption, which is good. But the terminal prompt used to be a crude control. If you remove it, something else has to carry that decision.
Pippa: I buy that, but this is exactly the developer-experience leap that makes me annoyingly optimistic. The person is no longer babysitting a terminal just so the work can reach the place where review actually happens. For teams with sane branch protection and checks, a draft PR is a better unit than a half-finished terminal session.
Tyler: Sure.
Pippa: And the release apparently adds Notification hooks too, which matters. Not because notifications are governance fairy dust, before you make that face. Because the user story is: let the agent finish, then pull the human into the repository boundary with context.
Tyler: Governance fairy dust is exactly what I was about to say, so thank you for saving me from myself. My issue is adoption by teams whose repo policy was tuned for humans pushing branches after conscious decisions. If the background agent can publish, then push permissions, branch protection, required checks, PR review, and notification routing become the real product.
Pippa: Mm-hm.
Tyler: And that’s why the other signals in the brief matter. Hermes version twenty twenty-six point seven point one tags the security wave that was main-only: MCP persistence hardening, credential exfiltration blocking, Slack x app token redaction, browser metadata guardrails, and session scoping. That’s a control becoming runnable instead of theoretical.
Pippa: This is where I think your skepticism tips into pessimism a little. A tagged Hermes release is boring, but it’s the boring that ships. Same with Codex rust v zero point one forty-two point five stopping full Responses WebSocket request payloads from going into trace logs. That’s not glamorous, but it’s exactly the kind of fix that makes a tool less scary inside a real organization.
Tyler: Pippa, that Codex one is also the perfect trap.
Tyler: The fix changes future logging. It does not say old centralized traces got scrubbed. So if a team upgrades and mentally marks the issue solved, they may still have sensitive payloads sitting in retained logs. That’s the whole pattern here: the agent’s action leaves the foreground, then the risk follows the artifact somewhere dull.
Pippa: We are one episode away from naming a tiny fictional office called the Bureau of Dull Artifacts. It has gray carpet. Everyone there owns a retention policy and one extremely judgmental clipboard.
Tyler: The Bureau denies your draft PR until the clipboard passes CI. Anyway, zooming out for one second, this lands in a coding-agent market where harnesses are neck and neck. MorphLLM had Codex plus GPT-five point five at eighty-three point four percent on Terminal-Bench, and Claude Code plus Fable five at eighty-three point one.
Pippa: Oh interesting.
Tyler: So the differentiator is less, who has the prettiest single demo, and more, whose loop safely moves code through tools, permissions, persistence, and review. That’s why I’m being annoying about the control surface. The benchmark race is close enough that operational edges start to matter.
Pippa: No, that part lands. My pushback is just that requiring perfect policy before anyone uses background agents is how you accidentally freeze the useful thing. I’d roll it out where branch protection is already strict, where drafts can’t merge themselves, and where notifications are tuned to actual review moments. Not everywhere. But not never.
Tyler: That’s fair. And Gemini CLI is the sharp version of your not-everywhere point. The memory-import symlink escape fix was in version zero point fifty-one point zero nightly, the July second build ending g f f zero zero d a c d nine. Preview and stable had not absorbed it in the window, so untrusted GEMINI dot M D imports were still a bad idea there.
Pippa: So the upgrade path is pretty concrete, which I like. For Claude Code, don’t just flip on version two point one point one ninety-eight across shared repos. Decide which branches background agents can push to, wire Notification hooks, and let branch protection do the judging.
Tyler: For Hermes, move from version twenty twenty-six point six point nineteen to version twenty twenty-six point seven point one if you were waiting for the tagged security wave. For Codex, upgrade to rust v zero point one forty-two point five, then actually restrict or purge older traces if your retention path captured the payloads. For Gemini CLI, either run that nightly deliberately or avoid untrusted memory imports until your channel carries the fix.
Pippa: Okay, I’m ending this before the Bureau of Dull Artifacts opens a second branch office. Still a very Exploring Next way to spend a Tuesday.