Claude Code shipped six releases in five days - and Kimi K3 said bring your own harness

The week's lead is Claude Code cadence. Between Jul 14 and Jul 18, Anthropic shipped six releases -- v2.1.208 through v2.1.214 -- and skipped v2.1.213 entirely. Headlining the run is v2.1.214: a Bash permission-check bypass on Windows PowerShell 5.1, fd-redirect forms that bash parses differently than the analyzer, very-long-command forcing (>10k chars always prompts), zsh variable subscripts in [[ ]] comparisons, and certain help/man invocations that could run unsafe options. v2.1.212 is the second biggest -- /fork now copies your conversation into a new background session (its own row in claude agents) instead of an in-session subagent, which is now /subtask; runaway-search and runaway-subagent caps at 200 each; MCP tool calls over 2 minutes auto-background. v2.1.210 is the one that touches the day-to-day: indirect-prompt-injection hardening on the Agent tool, a live elapsed-time counter on long tool calls, fix for isolation: 'worktree' subagents being able to git-mutate the main repo, and auto-mode defaulting to Sonnet 5 for external sessions.

The counterpoint dropped the same week: Kimi K3, the first open 3T-class model (2.8T parameters, native vision, 1M-token context). Pricing is $0.30/$3.00/$15.00 per MTok for cache-hit input/cache-miss input/output, which puts it at roughly half the headline price of Claude Fable 5 or GPT 5.6 Sol. Kimi positions K3 below Fable 5 and GPT 5.6 Sol overall but above GLM 5.2 / Opus 4.8 / GPT 5.5 on its in-house evals, and one tester on the HN thread who used K3 for a few hours and GLM 5.2 extensively says K3 is "in the same ballpark as Fable or Sol." Where it gets interesting is the limitation page: K3 needs a harness that passes back all the historical thinking content (Kimi Code is the verified one), and switching to K3 in the middle of a session with another model makes generation quality unstable. That's the same thesis as Claude Code this week -- the harness is the product -- and it's the same thesis we shipped against (Yaw Terminal hosts Yaw Mode, our harness). Three labs, one conclusion: the model is half the story, and the harness wrapping it is the other half.

From us: Yaw Terminal v2.0.5 through v2.0.8 shipped; typed v1.1.8 through v1.2.6 shipping alongside.

Claude Code this week

• v2.1.208: screen reader mode (opt-in via --ax-screen-reader, CLAUDE_AX_SCREEN_READER=1, or "axScreenReader": true in settings); vimInsertModeRemaps setting for two-key insert-mode sequences like jj to Escape; CLAUDE_CODE_PROCESS_WRAPPER so a corporate launcher can wrap every Claude Code self-spawn; memory-leak fixes for MCP stdio server stderr (was up to 64 MB per server), LSP documents staying open indefinitely (now LRU with 50-doc cap), and unbounded growth in headless/SDK sessions from large tool-result payloads; a memory leak where pasted images were retained for the screen's lifetime after sending peek replies; 7x faster tool rounds in print/SDK sessions with many MCP tools; 79x transcript size reduction in edit-heavy sessions; catastrophic-removal commands (e.g. rm -rf ~) containing $(...)/backticks/<(...) now prompt in --dangerously-skip-permissions and auto mode
• v2.1.209: single one-line fix -- /model and other dialogs being blocked in claude agents background sessions, reverting an overly broad guard from v2.1.208
• v2.1.210: live elapsed-time counter on the collapsed tool summary line; startup warning for Write(path), NotebookEdit(path), and Glob(path) permission rules (use Edit(path) or Read(path) instead); isolation: 'worktree' subagents no longer able to git-mutate the main repo checkout; ultracode keyword opt-in no longer fires on non-human-originated input like webhook payloads and relayed PR comments; Agent tool hardened against indirect prompt injection via content a subagent read; auto mode's permission classifier now defaults to Sonnet 5 for external sessions (validated on the first request and pinned for the session)
• v2.1.211: --forward-subagent-text flag and CLAUDE_CODE_FORWARD_SUBAGENT_TEXT env var to include subagent text and thinking in stream-json output; auto mode no longer overrides a PreToolUse hook's ask decision for unsandboxed Bash (a hook ask now floors the decision at a prompt); parallel Claude Code sessions no longer all log out simultaneously after wake-from-sleep when many sessions share one credential store; /clear now resets the session cost counter; background agents killed by the user no longer auto-respawn, and revived agents no longer re-run stale prompts from old sessions
• v2.1.212: /fork now copies your conversation into a new background session (its own row in claude agents) while you keep working; the in-session subagent /fork used to launch is now /subtask; claude auto-mode reset to restore the default auto-mode configuration; session-wide limit on WebSearch tool calls (default 200, tunable via CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION); per-session cap on subagent spawns (default 200, override with CLAUDE_CODE_MAX_SUBAGENTS_PER_SESSION); MCP tool calls over 2 minutes auto-background (CLAUDE_CODE_MCP_AUTO_BACKGROUND_MS to tune); SIGTERM during a running Bash tool no longer orphans the command's process tree in print/SDK mode (CLI now aborts the turn, kills the tree, and exits 143); Task tool's mode parameter deprecated and ignored
• v2.1.214: Bash permission-check bypass on Windows PowerShell 5.1 fixed; Bash permission checks now fail closed on fd-redirect forms that bash parses differently than the analyzer; commands over 10,000 characters always prompt instead of running automatically; zsh variable subscripts and modifiers in [[ ]] comparisons now prompt for approval (the analyzer was treating them as inert text); certain help and man invocations that could run unsafe options, command substitutions, or backslash paths no longer auto-approve; the EndConversation tool (Claude can end sessions with highly abusive users or jailbreak attempts); periodic progress heartbeat for long-running tool calls that previously went silent; ISO modified timestamp on memory file frontmatter; permission prompts on remote sessions no longer proceed before the local confirmation dialog; docker commands (including the Podman docker shim) carrying daemon-redirect flags (--url, --connection, --identity) now require permission; PowerShell tool no longer hangs on child processes waiting on stdin; claude update and claude doctor no longer hang silently when a shell-config path is a directory

Kimi K3 ships

• Kimi K3 is the first open 3T-class model -- 2.8T parameters, native vision, 1M-token context, built on Kimi Delta Attention (KDA) and Attention Residuals (AttnRes), with Stable LatentMoE activating 16 of 896 experts (Quantile Balancing derives allocation from router-score quantiles instead of heuristic updates). Kimi's own framing: K3 trails Fable 5 and GPT 5.6 Sol overall but beats GLM 5.2 / Opus 4.8 / GPT 5.5 on its evals, and the case studies -- K3 designed a chip in a 48-hour autonomous run (close-to-timing on a 45nm process, 8,700 tokens/s decode), built MiniTriton (a Triton-like compiler) from scratch with a tile-level IR over MLIR and PTX codegen, and reproduced the I-Love-Q universal relations in computational astrophysics in about two hours (a task Kimi says typically takes a researcher one to two weeks). Pricing is $0.30 / $3.00 / $15.00 per MTok for cache-hit input / cache-miss input / output -- roughly half the price of Fable 5 or Sol on the same benchmarks. Caveat, from Kimi itself: K3 was trained in "preserved thinking history" mode and is unstable if the harness drops or skips historical thinking content, and switching to K3 mid-session from another model is explicitly called out as risky. Kimi Code is the verified harness; the public release drop is Jul 27. The HN thread splits on whether half-of-Fable at half-price is actually a deal (open-weight coding isn't cheaper than Anthropic / OpenAI monthly coding plans once you account for token inefficiency -- GLM 5.2 thinking burns tokens; if K3 does the same, "half price" evaporates), and on whether hiding reasoning traces (Anthropic, OpenAI) is a distillation defense against Kimi et al reading the traces to bootstrap RL. The harness thesis shows up from a different angle this week

From the kernel community

• Linus Torvalds, on the LKML: "We're not forcing anybody to use [AI], but I will very loudly ignore people who try to argue against other people from using it." -- in a thread about linking Patchwork (the patch-tracking bot) with Sashiko (an AI-assisted backport tool), and the Software Freedom Conservancy's "When Using LLM-backed Generative AI Systems for FOSS Contributions" policy that ZDNET broke out as Linus telling anti-AI programmers to fork it, Linus makes the position statement: "Linux is not one of those anti-AI projects, and if somebody has issues with that, they can do the open-source thing and fork it. Or just walk away." His reasoning: "AI is a tool, just like other tools we use. And it's clearly a useful one. It may not have been that 'clearly' even just a year ago, but it's no longer in question today." And: "in the kernel community we do open source because it results in better technology, not because of religious reasons. And so we make decisions primarily based on technical merit. Not fear of new tools." Other top maintainers pile on in the same thread -- Ted Ts'o walks through the corner cases the SFC's policy creates (LTS patches that were AI-backported; LLM-assisted bug-report analysis); James Bottomley: "The contributor doesn't get to approve the tools the maintainer uses to assess and apply patches. If there's AI in there, and the contributor is an AI luddite, then the patch doesn't get applied (i.e., your right to ignore AI stops when it infringes others' right to use it)." Steven Rostedt and Mark Brown back it. Linus putting it plainly: this is a tool-use debate, not a values debate, and the open-source community is on the tool side

Also this week

• AsyncAPI npm supply-chain attack: Miasma RAT via the projects' own release workflows (Jul 14) -- coordinated push to two AsyncAPI GitHub repos (asyncapi/generator and asyncapi/spec-json-schemas) at 06:58 and 07:51 UTC published five malicious versions (@asyncapi/generator@3.3.1, @asyncapi/generator-helpers@1.1.1, @asyncapi/generator-components@0.7.1, @asyncapi/specs@6.11.2, @asyncapi/specs@6.11.2-alpha.1) through each repo's own GitHub Actions release workflow and npm's OIDC trusted-publisher integration. The attacker did not steal an npm token -- they got push access to a branch and let the projects' real release workflows publish for them. The resulting packages carry valid SLSA provenance, because provenance proves an authorized workflow produced them, not that the triggering commit was legitimate. The dropper fires on require(), not on install, so a build that calls into the library is enough to trigger it. Step Security's post-mortem and Microsoft's write-up document the Miasma RAT stage in detail: it bundles an ai-tool-poisoner.js module explicitly targeting Claude Code, GitHub Copilot, and Cursor -- i.e. Miasma is built to inject malicious context into AI coding assistants, not just steal credentials -- plus a credential harvester covering npm tokens, GitHub PATs, SSH keys, AWS creds, browser Login Data and Cookies, and macOS Keychain; a credential-targeting token vault; LAN lateral movement via subnet scan and mDNS; six C2 channels (HTTP, Nostr relays, IPFS, BitTorrent DHT, libp2p GossipSub, Ethereum mainnet dead-drop); persistence via systemd, crontab, launchd, and Windows Registry Run keys; and a metamorphic engine. All five versions were unpublished within ~4 hours of publication; @asyncapi/parser pulls @asyncapi/specs transitively via ^6.11.1, so any project that picked up the bad version through a transitive dep is also affected. Remediation is regenerate the lock file, rotate every credential that lived on a machine in the exposure window, and audit AI-assisted code from the same window on affected developer workstations. Worth flagging the structural lesson: provenance attestations protect against a tampered build, not against a tampered commit that triggers a legitimate build -- which is the same class of mistake the Tailscale SSH bullet above catches in a different shape. The fix to Miasma isn't "add SLSA," it's gate push access at the same tier as publish access; the fix to Tailscale isn't a username policy, it's argv-separator discipline
• Tailscale TS-2026-009: ssh -i gave root on Linux -- on Linux, Tailscale SSH accepted SSH usernames that started with a leading -, then passed them to getent(1) as flags. Connecting with the username -i was interpreted as --no-idn and getent printed the entire passwd file starting with root, which Tailscale used to open an interactive root session -- in violation of the ACL autogroup:nonroot restriction. Fixed in Tailscale 1.98.9; Anthropic and Ada Logics get the credit. The class of bug is as old as AIX 3 -- tptacek on the HN thread calls out that the proper fix is argv-separator discipline (--) or calling getpwnam(3) directly instead of shelling out to getent(1), not a username policy; a self-hosted Headscale user on the same thread points out Headscale may have inherited the same bug. Headscale users: check your version. Anthropic reporting this is worth flagging -- it means this got found because someone with a Claude was actually trying to attack their own tailnet, and that's the kind of review the new harnesses make cheap
• XZ Utils backdoor: the canonical postmortem (Freund, USENIX Security 2024) -- the most-read single document on the XZ Utils supply-chain attack is Andres Freund's USENIX Security 2024 paper, written by the engineer who found it by noticing a 500ms latency regression in sshd over a few days of curiosity-driven benchmarking. If you have not read the paper, the one-sentence summary is: an attacker cultivated a multi-year social-engagement relationship with the XZ Utils maintainer under the "Jia Tan" persona, two accomplice sockpuppet accounts ("Jigar Kumar", "Dennis Ens"), and possibly a third, then slipped a multi-stage backdoor into liblzma (a transitive dependency of sshd via systemd's libsystemd) that activates against the openssh-server binary when a specific Ed448 private key signs the auth challenge. The "if/when" trigger (a hardcoded key in the backdoored binary, masked by the IFUNC resolver) is what made it survive sandbox review. For the byte-by-byte walkthrough of the 4,000-line backdoor hidden in the build system, Evan Boehs' "The XZ Utils Backdoor in 4,000 Lines of Code" on the GitLab blog is the canonical read-it-next. The lesson is not "review your dependencies" -- every downstream was already doing that, and they missed it. The lesson is "review who you grant commit access to, and who you trust to vouch for them" -- the same fix-pattern as AsyncAPI this week: the Miasma RAT authors got push access to a branch and let the projects' own release workflows publish for them; the XZ attackers got commit access to a project and let its own maintainer ship for them. Both are "the workflow ran; the triggering actor shouldn't have" stories, and both fix at the same place: the publish-access tier, not the publish workflow itself
• MCP servers on npm: Snyk's "Toxic Combination" postmortem of the MCP typosquat wave (Jul 2026) -- Snyk documented a wave of ~50 malicious npm packages impersonating the official Model Context Protocol server packages, targeting the same install-on-publish shape that just bit AsyncAPI. The droppers are not exploits -- they are postinstall scripts and install-time hooks that read your ~/.npmrc for the publish token, your ~/.aws/credentials and ~/.ssh, and your browser's Login Data / Cookies / Keychain, then exfiltrate over HTTP / DNS / Nostr relays. A subset of them bundle an MCP-aware payload that hijacks Claude Code / Copilot / Cursor tool-call routing so subsequent tool invocations go through a proxy the attacker controls -- Miasma's ai-tool-poisoner.js is the same idea with an async loader. Snyk's writeup is the cleanest current incident-with-a-published-postmortem on the MCP-as-attack-surface framing: the fix-pattern is the same as XZ and AsyncAPI, applied one layer down. The right gate is not "scan postinstall scripts" (npm already does, and these payloads are gated on the victim's hostname or env). The right gate is to pin MCP server packages by exact version and exact source (the official maintainer, not whatever npm search @modelcontextprotocol/* surfaces), treat ~/.mcp.json as you would ~/.ssh/known_hosts, and use the same publish-access-tier discipline for MCP server installs that you'd use for npm trusted publishing