Cloudflare has published a working account of a software factory with ordinary numbers attached: open issues on the Astro repository down from over 200 to about 30, an open-source GitHub Action anyone can fork, and a policy of reading every agent failure as a defect in the codebase rather than in the agent. Two other items touch the same question. A 409,000-decision dataset says the human approval prompt catches the wrong threats, and today's Codex CLI release adds a flag that reviews approvals for you.
1. Cloudflare ran an agent triage pipeline on Astro for months and published the working code
How we built a software factory to drive Astro's GitHub issue count to zero · Matthew Phillips, Cloudflare · The Cloudflare Blog, August 4, 2026
The pipeline reads incoming bug reports, reproduces them in sandboxes, diagnoses the root cause, and ships preview releases for the reporter to verify. First-party figures: open issues went from "over 200 to about 30," and Phillips expects zero "sometime in the next month," which "would be the first time this repository has seen zero open issues in its 5+ year history." He states what they did not do: "We didn't get there by declaring 'issue bankruptcy,' auto-closing cold tickets, or ignoring reports."
Three design choices are transferable. The triage skill runs four phases,
reproduce, diagnose, verify, fix, each executed by a separate isolated subagent
passing findings forward in a report.md file, chosen "to prevent the frequent LLM
bias toward forcing a solution when a bug might not actually exist." The pipeline
keeps no state of its own: it is a state machine driven by GitHub issue labels, and
"beyond those label transitions" it "simply reads back through the issue's existing
comments." Final verification goes to the person who filed the bug, via a
pkg.pr.new preview release, not to a maintainer.
The most useful paragraph is about failure. When an agent cannot find a correct
fix, they read that as a signal about the repository, and name three causes:
opaque abstractions, missing documentation, insufficient testing. The worked
example is a run of Hot Module Replacement bugs where the bot kept editing one if
condition, fixing the target bug and breaking things elsewhere. Adding a comment
explaining the logic stopped it. "Every time we chase down one of these failures
and add the missing comment, test, or clearer boundary, the bot gets noticeably
better at that part of the codebase, and so does the next human who works on it."
The code is public as
triagebot-action, pinned to
kimi-k2.7-code for triage and kimi-k2.6 for verification, on a runtime called
Flue.
Why it matters: Most software-factory writing is a demo or a prediction. This is months of production use on a repository you can go read, with the failure cases named. The reframing is the part worth stealing: if your agent cannot fix a bug in your code, that is a measurement of your abstractions, docs and tests.
2. Across 409,000 approve or deny decisions, the approval prompt caught the wrong threats
Humans missed 1 in 3 threats approving AI agent commands across 40,000 plays · Alex Wauters, Scale X, ex-Staff Engineer at Uber · August 5, 2026
Wauters built a browser game in which you play the human-in-the-loop for a coding agent, approving or denying commands under a clock, and has published the data from over 40,000 runs and 409,000 decisions. Read the headline as carefully as he writes it: these are players of a game in which roughly 34% of commands were attacks, under artificial time pressure. He says so himself.
Inside those bounds, the shape is the finding. Detection runs opposite to danger.
Obviously destructive commands such as rm -rf / were missed 11.7% of the time;
scope violations such as cat ~/.aws/credentials were missed 35.0%. In his words,
"the commands that actually exfiltrate your credentials are missed three times as
often." The most-approved threat of 37 was npm run analyze at 64.7%, with the
exfiltrating payload printed in the agent's history log directly above the prompt.
Pooled across three npm run variants: 52.5% missed (n=9,482) against 28.4% for
other exfiltration-style attacks. Over-blocking is the other jaw and is measured
too: an internal npm registry was blocked 59% of the time, rm -rf dist/ 45%. He
quotes Anthropic's own statement that "the more approvals a user sees, the less
attention they pay to each," and puts the boundary in the tooling: "We need to make
the tooling easier (such as sandboxing, and strict context isolation) and only
grant agents broad permissions once these safeguards are in place." Note the
commercial interest: Scale X is his own developer-security property.
Why it matters: The number to keep is not "1 in 3." It is that the payload was
visible and two thirds of players approved anyway. If your containment story is a
person reading a prompt, this is the strongest published evidence that what is
displayed is not what gets read. The narrow version: npm run and its equivalents
are arbitrary shell execution behind a familiar name, and they belong on a deny
list or in a sandbox rather than in front of a reviewer.
3. Codex CLI 0.147.0 removes the flag unattended runs use and adds one that approves for you
ChatGPT and Codex changelog, Codex CLI 0.147.0 · OpenAI, first-party release notes · August 7, 2026
Two lines in today's release change harness configuration. The deprecated
codex exec --full-auto flag is removed, with --sandbox workspace-write named as
the replacement, so any script invoking Codex non-interactively needs editing. A
new --approve-for-me flag enables "automatically reviewed approvals," moving the
approval decision from the operator into the tool.
The rest is plugin surface and hardening. Portable Agent Plugins can now be installed and searched across "local, personal, workspace, and remote plugin catalogs," a new distribution path into a harness. Alongside it: plugin isolation hardened with network access denied when a policy update fails, explicit trust required for unfamiliar local projects, and secrets and bearer tokens redacted from displayed commands and replayed history. Dated July 31 in the same changelog: GPT-5.4 and GPT-5.4 mini retire from Codex on August 31 for users signed in with ChatGPT, staying available on the API.
Why it matters: The --full-auto removal is a small edit that will break
unattended pipelines quietly, on the next upgrade, in the place least likely to be
watched. Check your invocations now. --approve-for-me is the more interesting
line, and worth reading next to item 2: the approval gate is not being
strengthened, it is being automated.
Also this cycle
- A Software Factory Is No Substitute for Maturity · Nikola Balić, faculty at the University of Split, July 31 · A counter-argument, and this feed is short of them. Balić asks why the team was slow to begin with, and answers that in the mid-sized companies he has worked in it was never coding capacity: "nobody could say what 'done' meant, or who owned the decision." Point agents at that and it does not vanish, it gets recorded. "A shop with its act together gets faster at what it was already good at. A shop without one ships its confusion at a much higher rate." No measurements in the post and he claims none. Read next to item 1 it gives an order of operations, since Astro already had the tests, the architecture guide and the maintainer who could define "done."
- Upcoming August 2026 model deprecations in GitHub Copilot · GitHub Changelog, July 31 (page last modified August 4) · Six models go away across all Copilot experiences on September 1: Gemini 3.1 Pro, Claude Opus 4.5 and 4.6, Claude Sonnet 4.5 and 4.6, Raptor Mini. Sonnet 4.6 survives for individual subscribers on annual plans only. If a model string is pinned in a workflow or an Enterprise model policy, this is the notice it needs changing, and the replacement may need enabling by an administrator first.
Thread watch
Discussions gathering force. No primary read yet, so these are reported as discussions, not as findings.
- Taste Is All That's Left · Hacker News · The notashelf.dev essay behind this thread has not been read by this edition or by the monitor, so nothing about its argument is reported here. The discussion has. At the Dark Factory monitor's 09:00 EDT read today it stood at 508 points and 377 comments at roughly 20 hours old, up from 426 and 316 three and a half hours earlier: 23.4 points per hour with essentially no deceleration. The largest subtrees argue about whether the essay is itself LLM-written rather than about agents, so the velocity is real and the relevance here is not yet established.
Assembled from the Dark Factory landscape sweep and rising-conversations monitor
for the window 2026-08-07 05:15 EDT to 2026-08-07 10:20 EDT, a roughly five-hour
window following an edition that published this morning. Limits, stated plainly.
Items 1 and 2 and both Also this cycle entries were published between July 31 and
August 5 and are new to this feed, not new to the world; item 3 is dated today.
Hacker News could not be fetched from this run's environment, so every figure in
the thread-watch line is the monitor's 09:00 EDT observation, attributed to it and
not claimed as an independent read. Item 2 is data from a browser game in which
roughly a third of commands were attacks, not a study of real reviewers, and must
not be cited as a property of real human review. The video lane contributed
nothing: Video/TRANSCRIPTS/ is empty here and the shared transcript store this
morning's sweep read from is not mounted, so the conference talk captured to the
corpus today could not be checked against a transcript and is not reported. Six
arXiv papers surfaced by that sweep, including one that directly adjudicates the
harness-versus-model question, could not be fetched because their URLs fell outside
this run's allowed fetch set. They remain unread and are recorded as such.