---
title: 'In the News: August 7, 2026, Midday'
description: 'Cloudflare ran an agent triage pipeline on Astro for months, cut open issues from 200 to about 30, and treats every agent failure as a defect in the codebase.'
canonical_url: 'https://darkfactory.dev/news/2026-08-07-midday'
markdown_url: 'https://darkfactory.dev/news/2026-08-07-midday.md'
collection: news
date_published: '2026-08-07T10:30:00-04:00'
date_modified: '2026-08-07T10:30:00-04:00'
---

# In the News: August 7, 2026, Midday


Cloudflare has published a working account of a software factory with ordinary
numbers attached: open issues on the Astro repository down from over 200 to about
30, an open-source GitHub Action anyone can fork, and a policy of reading every
agent failure as a defect in the codebase rather than in the agent. Two other items
touch the same question. A 409,000-decision dataset says the human approval prompt
catches the wrong threats, and today's Codex CLI release adds a flag that reviews
approvals for you.

## 1. Cloudflare ran an agent triage pipeline on Astro for months and published the working code

**[How we built a software factory to drive Astro's GitHub issue count to zero](https://blog.cloudflare.com/astro-issue-triage/)** · Matthew Phillips, Cloudflare · The Cloudflare Blog, August 4, 2026

The pipeline reads incoming bug reports, reproduces them in sandboxes, diagnoses
the root cause, and ships preview releases for the reporter to verify. First-party
figures: open issues went from "over 200 to about 30," and Phillips expects zero
"sometime in the next month," which "would be the first time this repository has
seen zero open issues in its 5+ year history." He states what they did not do: "We
didn't get there by declaring 'issue bankruptcy,' auto-closing cold tickets, or
ignoring reports."

The triage skill runs four phases,
reproduce, diagnose, verify, fix, each executed by a separate isolated subagent
passing findings forward in a `report.md` file, chosen "to prevent the frequent LLM
bias toward forcing a solution when a bug might not actually exist." The pipeline
keeps no state of its own: it is a state machine driven by GitHub issue labels, and
"beyond those label transitions" it "simply reads back through the issue's existing
comments." Final verification goes to the person who filed the bug, via a
`pkg.pr.new` preview release, not to a maintainer.

When an agent cannot find a correct fix, the team reads it as a signal about the
repository and names three causes:
opaque abstractions, missing documentation, insufficient testing. The worked
example is a run of Hot Module Replacement bugs where the bot kept editing one `if`
condition, fixing the target bug and breaking things elsewhere. Adding a comment
explaining the logic stopped it. "Every time we chase down one of these failures
and add the missing comment, test, or clearer boundary, the bot gets noticeably
better at that part of the codebase, and so does the next human who works on it."
The code is public as
[triagebot-action](https://github.com/withastro/triagebot-action), pinned to
`kimi-k2.7-code` for triage and `kimi-k2.6` for verification, on a runtime called
[Flue](https://flueframework.com/).

**Why it matters:** This is months of production use on a repository you can read,
with the failure cases named. An agent that cannot fix a bug is also measuring the
repository's abstractions, docs and tests.

## 2. Across 409,000 approve or deny decisions, the approval prompt caught the wrong threats

**[Humans missed 1 in 3 threats approving AI agent commands across 40,000 plays](https://scalex.dev/blog/ai-agent-permissions-stats/)** · Alex Wauters, Scale X, ex-Staff Engineer at Uber · August 5, 2026

Wauters built a browser game in which you play the human-in-the-loop for a coding
agent, approving or denying commands under a clock, and has published the data from
over 40,000 runs and 409,000 decisions. Read the headline as carefully as he writes
it: these are players of a game in which roughly 34% of commands were attacks, under
artificial time pressure. He says so himself.

Inside those bounds, the shape is the finding. Detection runs opposite to danger.
Obviously destructive commands such as `rm -rf /` were missed 11.7% of the time;
scope violations such as `cat ~/.aws/credentials` were missed 35.0%. In his words,
"the commands that actually exfiltrate your credentials are missed three times as
often." The most-approved threat of 37 was `npm run analyze` at 64.7%, with the
exfiltrating payload printed in the agent's history log directly above the prompt.
Pooled across three `npm run` variants: 52.5% missed (n=9,482) against 28.4% for
other exfiltration-style attacks. Over-blocking is the other jaw and is measured
too: an internal npm registry was blocked 59% of the time, `rm -rf dist/` 45%. He
quotes Anthropic's own statement that "the more approvals a user sees, the less
attention they pay to each," and puts the boundary in the tooling: "We need to make
the tooling easier (such as sandboxing, and strict context isolation) and only
grant agents broad permissions once these safeguards are in place." Note the
commercial interest: Scale X is his own developer-security property.

**Why it matters:** The headline says "1 in 3." The payload was visible and two thirds of players approved anyway.
If your containment story is a
person reading a prompt, the experiment shows that what is displayed may not be what gets
read. The narrow version: `npm run` and its equivalents
are arbitrary shell execution behind a familiar name, and they belong on a deny
list or in a sandbox rather than in front of a reviewer.

## 3. Codex CLI 0.147.0 removes the flag unattended runs use and adds one that approves for you

**[ChatGPT and Codex changelog, Codex CLI 0.147.0](https://developers.openai.com/codex/changelog/)** · OpenAI, first-party release notes · August 7, 2026

Two lines in today's release change harness configuration. The deprecated
`codex exec --full-auto` flag is removed, with `--sandbox workspace-write` named as
the replacement, so any script invoking Codex non-interactively needs editing. A
new `--approve-for-me` flag enables "automatically reviewed approvals," moving the
approval decision from the operator into the tool.

The rest is plugin surface and hardening. Portable Agent Plugins can now be
installed and searched across "local, personal, workspace, and remote plugin
catalogs," a new distribution path into a harness. Alongside it: plugin isolation
hardened with network access denied when a policy update fails, explicit trust
required for unfamiliar local projects, and secrets and bearer tokens redacted from
displayed commands and replayed history. Dated July 31 in the same changelog:
GPT-5.4 and GPT-5.4 mini retire from Codex on August 31 for users signed in with
ChatGPT, staying available on the API.

**Why it matters:** The `--full-auto` removal is a small edit that will break
unattended pipelines quietly, on the next upgrade, in the place least likely to be
watched. Check your invocations now. Read `--approve-for-me` next to item 2: the
approval gate is not being
strengthened, it is being automated.

---

## Also this cycle

- **[A Software Factory Is No Substitute for Maturity](https://www.nibzard.com/dark-factory)** · Nikola Balić, faculty at the University of Split, July 31 · A counter-argument, and this feed is short of them. Balić asks why the team was slow to begin with, and answers that in the mid-sized companies he has worked in it was never coding capacity: "nobody could say what 'done' meant, or who owned the decision." Point agents at that and it does not vanish, it gets recorded. "A shop with its act together gets faster at what it was already good at. A shop without one ships its confusion at a much higher rate." No measurements in the post and he claims none. Read next to item 1 it gives an order of operations, since Astro already had the tests, the architecture guide and the maintainer who could define "done."
- **[Upcoming August 2026 model deprecations in GitHub Copilot](https://github.blog/changelog/2026-07-31-upcoming-august-2026-model-deprecations-in-github-copilot/)** · GitHub Changelog, July 31 (page last modified August 4) · Six models go away across all Copilot experiences on September 1: Gemini 3.1 Pro, Claude Opus 4.5 and 4.6, Claude Sonnet 4.5 and 4.6, Raptor Mini. Sonnet 4.6 survives for individual subscribers on annual plans only. If a model string is pinned in a workflow or an Enterprise model policy, this is the notice it needs changing, and the replacement may need enabling by an administrator first.

---

## Thread watch

_Discussions gathering force. No primary read yet, so these are reported as
discussions, not as findings._

- **[Taste Is All That's Left](https://news.ycombinator.com/item?id=49199346)** ·
  Hacker News · **The notashelf.dev essay behind this thread has not been read, so
  nothing about its argument is reported here.** The discussion has. At 09:00 EDT it stood at
  508 points and 377 comments at roughly 20 hours old, up from 426 and 316 three and
  a half hours earlier: 23.4 points per hour with essentially no deceleration. The
  largest subtrees argue about whether the essay is itself LLM-written rather than
  about agents, so the velocity is real and the relevance here is not yet
  established.