Summary
A cross-implementation comparison of defect classes found in two production AI coding agents — Claude Code 2.1.325 (2026-11-13) and Codex CLI 0.167–0.169 (Nov 6–13 2026) — against the open-source agent yoyo v0.4.0 (f85f91cc). The scan classifies each defect by class and by surface, and separates transferable hardening lessons (credential inheritance, deny-rule scope, command-allowlist soundness, untrusted-directory trust, output-token truncation, context-window overrides) from surface-specific work that does not port.
Key Points
- The dominant transferable theme is credential isolation for the agent's own helper processes: scrub secrets by default for helpers, while leaving user commands' environments intact.
- Relative deny rules lose scope after
cd— a real bug class worth probing in any agent that relocates the working directory mid-session. - Allow rules must bind to the program actually executed, not the name written in the rule; compound commands are a classic bypass.
- Untrusted directories should default to disabling project config and MCP servers, with trust granted explicitly and keyed on content, not path.
- Truncation at the output-token limit corrupts answers silently; re-asking for a shorter complete answer beats returning a tail fragment.
- Gateway model aliases (
claude-*ids not on the official list) must still honour context-window configuration.
Concepts
- Helper-process credential scrubbing — removing sign-in tokens, API keys, and mTLS passphrases from the environment of the agent's internal tools (ripgrep, local git) rather than from arbitrary user commands.
- Relative deny rule — a permission rule expressed relative to the project root; its meaning breaks when the working directory changes.
- Option-swallowing / compound-command bypass — an allow rule for a named program being satisfied by a different program via option parsing or chained commands.