DEV Community: Akash Das

A pre-flight checklist for shipping a Claude connector

Akash Das — Sat, 22 Aug 2026 18:46:58 +0000

Writing an MCP server is the easy part. Shipping one as a Claude connector means passing four gates that have nothing to do with your business logic: Anthropic's network can reach you, Claude can get an OAuth client identity, a human reviewer approves your tool design, and your server does not waste the user's context window.

Here is the checklist I wish I had had, in the order the failures actually happen.

Gate 1 — Can Anthropic's infrastructure reach you?

Claude connects from Anthropic's servers, not from your laptop. So the tests you run at your desk prove almost nothing. Run these from a network that is not yours:

# Every returned address must be globally routable.
# Any 10.x, 172.16–31.x, 192.168.x, 100.64.x, loopback or link-local
# address in the answer kills the connection before an HTTP request is sent.
dig +short your-server.example.com

# Connectors are IPv4-only. Empty first line + populated second line = the bug.
dig +short A    your-server.example.com
dig +short AAAA your-server.example.com

# A 301/302/307/308 to a different host strips the Authorization header
# (RFC 9110 §15.4). The target answers 401 and Claude reports an auth failure.
curl -sSI https://your-server.example.com/mcp | grep -i '^location:'

Checks:

[ ] DNS answer contains only public addresses, from outside your network
[ ] An A record exists, not just AAAA
[ ] The MCP URL does not cross-host redirect

If your access log is empty while Claude says Couldn't reach the MCP server, one of those three is why. Full teardown of all four documented causes: Claude cannot reach your MCP server, but curl can.

For local development, tunnel instead of fighting this: cloudflared tunnel --url http://localhost:3000 or ngrok http 3000.

Gate 2 — Can Claude get an OAuth client ID?

Incompatible auth server: does not support dynamic client registration

The obvious fix is the wrong one for most public connectors. Dynamic Client Registration mints a fresh OAuth client on every new connection — that is a row per connection, not per customer, so a busy connector slowly fills your identity provider with junk clients.

Claude accepts three ways of getting an identity:

Method	What you host	Good fit for
`oauth_dcr` (RFC 7591)	a `POST /register` endpoint	internal servers, few users
`oauth_cimd`	a static JSON document at an HTTPS URL	public connectors, high traffic
`oauth_anthropic_creds`	nothing new — you mail Anthropic a client ID and secret	teams who cannot change their IdP

The CIMD trap is worth memorising, because it fails silently. Claude picks CIMD only when your metadata says both of these:

{
  "client_id_metadata_document_supported": true,
  "token_endpoint_auth_methods_supported": ["none"]
}

Miss the second and Claude falls back to dynamic registration, and then fails with the error above even though your CIMD is fine.

Checks:

[ ] Metadata advertises both CIMD fields, if you are using CIMD
[ ] registration_endpoint is omitted, not set to null — null fails schema validation rather than being ignored
[ ] You have decided DCR vs CIMD on expected connection volume, not on which error message you saw first

Comparison of the three methods and when each one is right: Claude cannot register with your OAuth server. Now what?.

Gate 3 — Will directory review reject your tool design?

This one has an automatic-fail that a lot of servers ship on day one:

// Rejected. One tool, safe and unsafe methods in the same surface.
{
  "name": "api_request",
  "inputSchema": {
    "properties": { "method": { "enum": ["GET", "POST", "DELETE"] } }
  }
}

Read and write must be separate tools, and writes should be split further by action where you can — create, update, delete. No description text saves the combined version.

Checks:

[ ] You are on a Team or Enterprise plan (the portal is in Claude.ai org settings; individual plans cannot submit at all)
[ ] No tool accepts both safe and unsafe HTTP methods
[ ] Freeform query tools name or link the target API in their description — "Queries the Slack Web API" passes, "Makes a request to the API" fails
[ ] Every tool has a title plus readOnlyHint: true or destructiveHint: true
[ ] Every tool name is 64 characters or fewer
[ ] No description tells Claude what to do, calls other software, or embeds hidden or encoded text
[ ] Privacy policy is real, not a stub — a thin one is an instant fail for local connectors

Those hints are not paperwork. They drive auto-permissions, so read-only tools can run without prompting each time. Skip them and your connector is both non-compliant and slower to use. The rest of the rejection triggers: What gets a Claude connector rejected from the directory.

Gate 4 — What does your connector cost the context window?

Stop splitting servers to save context. Tool search ships on by default in Claude Code: only tool names and server instructions load at session start, and full schemas arrive on demand. Anthropic's reference says adding more servers has minimal impact on the window, with no fixed per-server tool cap.

What still costs you:

Each tool description and each server instructions block is truncated at 2KB
Tool output warns above 10,000 tokens and is capped at 25,000 by default (raise with MAX_MCP_OUTPUT_TOKENS)
Deferral turns off entirely under several conditions, including ANTHROPIC_BASE_URL on a non-first-party host — so a team gateway silently restores the old up-front cost

You can also opt one server out on purpose:

{
  "mcpServers": {
    "core-tools": {
      "type": "http",
      "url": "https://mcp.example.com/mcp",
      "alwaysLoad": true
    }
  }
}

Checks:

[ ] Descriptions and instructions fit in 2KB, before truncation picks the cut for you
[ ] Large tool results are paginated or filtered server-side, not dumped
[ ] You know whether your org's gateway config is disabling tool search

The full table of conditions that keep tools loading up front: Your MCP connector spends context before you type.

Optional gate — should it draw a UI at all?

MCP Apps is the first official MCP extension: your server returns interactive HTML, the client renders it in a sandboxed iframe, and the page talks back over JSON-RPC on postMessage. Claude, ChatGPT, VS Code and Goose all render it, so it is portable rather than a single-vendor bet.

Worth it when the result is genuinely visual — a brushable scatter chart, a map, compiled shader output. Not worth it when your tool returns three fields. Directory submission for an MCP App also wants 3 to 5 PNG screenshots at 1000px or wider, and any link destination missing from your allowed link URIs makes the user confirm every click.

Run an example server locally first; it takes about five minutes:

{
  "mcpServers": {
    "qr": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/qr-server", "--stdio"]
    }
  }
}

The build-vs-skip trade-off in full: Should your Claude connector draw its own UI?.

TL;DR

Four of the five ways a connector fails are environmental, not logical — network reachability, client identity, review criteria, and client-side budget. Your code being correct is exactly what makes them hard to find. Run the dig checks from outside your network, choose CIMD if you expect volume, split read from write before you submit, and stop hand-optimising a context cost the client already handles.

What has bitten you shipping an MCP server? The redirect-strips-the-token one cost me the most time.

Five agent engineering problems, with the numbers behind them

Akash Das — Wed, 19 Aug 2026 19:52:00 +0000

The agent conversation on Reddit and in GitHub issues has moved. A year ago it was "what can agents do". Now it is "why does mine call the same tool nineteen times", and "what happens to my threads on August 26".

Here are five problems that keep coming up, each with the specific fact I had to dig out to answer it. Every one of them has a number attached, because "it depends" is not an answer you can ship.

1. Your agent loops because `tool_choice` sticks

The advice everyone gives is to set max_iterations. That caps your bill. It does not fix the bug.

When you set tool_choice to required or to a named function, that setting persists across model calls. Your framework runs the tool, sends the result back, and the same forced setting rides along. The model is told again that it must call a tool. It obeys. That is the loop.

The merged fix in openai-agents-python resets tool_choice to auto after tool execution. So step one is upgrade, not guardrail code.

Step two is the part almost nobody does. A loop is not "many calls" — it is the same call. Oracle's langchain-oracle patch detects repeats by matching the tool name and identical arguments in succession, with a max_sequential_tool_calls backstop defaulting to 8. Their earlier fix had set tool_choice to none after any tool result, which stopped loops and also broke a four-step diagnostic agent after its first call.

An iteration counter cannot tell a six-step workflow from a six-step loop. Argument identity can.

Full breakdown: Your agent loops forever. It is probably tool_choice.

2. The Assistants API shuts down on August 26, and your threads do not move

If you are still on /v1/threads, you have days, not months. OpenAI's deprecations page sets removal at August 26, 2026, one year after the notice. No degraded mode, no grace period.

The migration itself is small. Assistant becomes Prompt, Thread becomes Conversation, Run becomes Response, Run step becomes Item, and the create-then-poll loop collapses into a single responses.create call.

The part that bites is one sentence in the migration guide: OpenAI will not provide an automated tool for migrating Threads to Conversations. If your product shows chat history, that history is user-visible data sitting on someone else's server behind an endpoint that stops answering.

Export the raw JSON this week even if you have not chosen a target format. Exported data can wait; deleted data cannot.

Two things that surprised me: vector stores and files survive the cutover and just need vector_store_ids passed to the file search tool — but thread-created stores expire seven days after last use, so half of them are already gone. And Azure lands on the same date with a different destination: Microsoft's docs point Azure users to Foundry Agents, not to the Responses API.

Full breakdown: The Assistants API shuts down August 26. Port it now.

3. AutoGen is in maintenance mode, and the port is a redesign

Straight from the AutoGen README: "AutoGen is now in maintenance mode. It will not receive new features or enhancements and is community managed going forward."

Microsoft Agent Framework is the successor, built by the same teams as a merge of AutoGen and Semantic Kernel. Single agents port in an afternoon. Multi-agent teams do not, because AutoGen's event-driven Team becomes a typed, graph-based Workflow with edges you declare. You redraw the flow rather than translating it.

Two changes throw no errors at all. Agent is stateless and keeps no history between calls, unlike AssistantAgent — your code runs, your agent forgets the last turn, and you attach AgentSession to fix it. And agents now keep calling tools until the job is done rather than stopping at a count you set, which is friendlier for simple tasks and harder to price.

Check your model providers before planning anything. Microsoft's own pages disagree: the migration guide lists Anthropic and Ollama clients as planned, while the newer overview page lists both as supported. Run a spike against your actual provider before you commit a sprint.

Full breakdown: AutoGen is in maintenance mode. Where to migrate now.

4. Memory and prompt caching pull against each other

Agent memory gets treated as a storage question — pick a vector store, summarize when the window fills. That misses the bill.

Caching is a prefix match. Memory wants to live high in the prompt, next to the system instructions, which is the most expensive place in the request to edit. Anthropic's caching reference puts numbers on it: cache reads cost 0.1x base input, five-minute writes 1.25x, one-hour writes 2x. Swapping a read for a five-minute write is 12.5x the cost for the same tokens.

There is also a floor nobody mentions. The minimum cacheable prefix is 512 tokens on Opus 5, 1,024 on Sonnet 5, and 4,096 on Haiku 4.5. Fall short and nothing errors — the request just is not cached, and you learn about it from the invoice. That is exactly why routing cheap background summarization to a small model so often fails to help.

The other useful distinction: clearing is not summarizing. Context editing drops old tool results in order and swaps in placeholders, defaulting to a 100,000-token trigger while keeping the last three tool uses. It costs no extra model call and keeps the conversation shape. Compaction spends a call, rewrites history into prose, and permanently loses whatever the summarizer judged unimportant. For a tool-heavy agent, the bulk is old tool output — clear that first.

Full breakdown: Agent memory that does not wreck your prompt cache

5. Your end-to-end eval hides the regression

LangChain's State of Agent Engineering survey (1,340 responses, late 2025) found 89% of organizations have agent observability and 52.4% run offline evals. Most teams can watch the failure and cannot catch it first.

The interesting part is why the teams with a gate still miss things. A June 2026 paper on layer-isolated evaluation broke one agent layer at a time and watched the metrics. The aggregate pass rate moved 1.7 to 5.9 percentage points. The test slice matching the broken layer moved 25 to 91 points.

Read that as a release gate. Break your routing layer and an end-to-end suite reports a couple of points of noise — you would approve that ship. Sliced by layer, it screams.

The cheap fix is that much of an agent is ordinary software. Routing rules, schema validation, escalation thresholds, memory writes: none of it is non-deterministic. The same paper's suite is 238 cases across 23 slices, 225 of them running in 2.39 seconds with no model calls at all. Build that layer first and save the judge for what needs it.

And if you do use a judge, calibrate per comparison. A May 2026 study shows that sharing one calibration across the models you are comparing can reverse the sign of the result — you ship the worse agent while the report says you shipped the better one.

Full breakdown: 89% watch agents fail. Only half test before shipping.

The thread that connects them

Four of these five are the same shape: a default changed, or a setting persisted, and nothing threw an error. Sticky tool_choice, a stateless Agent, an uncached prefix, an averaged-away regression. Agents fail quietly far more often than they crash, which is why the fixes are mostly about making the failure visible rather than making the model smarter.

If you have hit one of these and solved it differently, I would genuinely like to hear it — the argument-identity loop check in particular feels like something more frameworks should ship by default.

Five developer deadlines in August 2026: Copilot credits, Rust 1.98, TypeScript 7

Akash Das — Tue, 18 Aug 2026 02:40:45 +0000

Five things changed for developers in the last two weeks, and four of them have a date attached. Here is the short version of each, with the full write-up linked.

1. Stripe is buying OpenRouter for more than $7 billion

Bloomberg reported the finalized deal on August 16, 2026 — roughly 5.4x the $1.3 billion valuation OpenRouter carried in May. The gateway adds no markup to inference; it charges 5.5% on card credit purchases and 5% on BYOK usage above the monthly allowance. So the question is not "is it expensive", it is "who owns the meter now".

Full breakdown, including when a direct provider key beats the gateway: Stripe bought OpenRouter. Should you still route through it?

2. GitHub Copilot's promotional credits end August 31

Business pools drop from 3,000 credits per user to 1,900. Enterprise drops from 7,000 to 3,900. One credit is $0.01, so a 50-seat Business org loses $550 a month of included usage and a 200-seat Enterprise org loses $6,200 — with no change in how anyone works.

Worked numbers plus the budget controls that are off by default: Copilot's bonus credits end August 31. What breaks then?

3. TypeScript 7 is fast, but half the ecosystem cannot use it

The Go compiler landed on July 8, 2026 with 8x to 12x faster full builds — VS Code went from 125.7s to 10.6s. There is no stable programmatic API in 7.0, so typescript-eslint, ts-jest, ts-morph and the template checkers behind Vue, Svelte, Astro and Angular are stuck on TypeScript 6 until 7.1.

The staged upgrade that works today: TypeScript 7 is 10x faster. Can your project use it?

4. Python 3.15 hit rc1, and free-threading finally has a stable ABI

3.15.0rc1 shipped August 4, 2026, with no further ABI changes before the October 1 final. PEP 803 gives free-threaded builds a stable ABI, which is what makes C extension wheels practical. It still costs 1% to 8% of single-threaded performance, and it is still not the default build.

Which workloads actually gain, and how to test it in an afternoon: Python 3.15 hits rc1. Is free-threading ready yet?

5. Rust 1.98 lands August 20, and one change can break crates

The new fast path for derive(PartialOrd) when Ord is derived can change behaviour for types whose two ordering implementations disagree. Nothing fails to compile; your sort order moves.

Also worth correcting: several write-ups claim c_variadic ships in 1.98. The stabilization PR carries the 1.99.0 milestone and was merged after 1.98 branched, so it is the release after this one.

Ten-minute check for your workspace: Rust 1.98 lands August 20. One change can break crates.

Two of these have hard deadlines this month — Copilot on August 31 and Rust on August 20. The other three are decisions you can take at your own pace, as long as you take them deliberately.

Your AI Agent Bought the Wrong Thing. Who Pays?

Akash Das — Sun, 16 Aug 2026 09:54:23 +0000

Browsers and chat apps are now happy to hand an AI agent your payment details and let it check out on your behalf. Nobody has told you what happens when the agent buys the wrong running shoes, buys two of them, or misses a price that changed between the search and the purchase. Regulators have not answered that question either — but the payments rules that already exist answer a narrower and more useful one: your protection depends almost entirely on which card you attached. Debit falls under a rule written on the assumption a human pressed the button. Credit falls under a rule with a broader definition of authority and a dispute right that survives an agent's mistake. Attach the credit card.

The rule everyone is arguing about was written for humans

In the US, debit and bank-account transfers fall under Regulation E, which implements the Electronic Fund Transfer Act. Regulation E hangs everything on one distinction: was the transfer authorized or unauthorized? An unauthorized electronic fund transfer is one initiated by a person other than the consumer without actual authority to initiate it, which in practice turns on demonstrable consent.

Now run an agent through that definition. You told an agent to find and buy the best deal on running shoes. It bought a pair you did not want, at a price you would not have accepted. You consented to the shopping. You did not consent to that purchase. Is it authorized?

Nobody knows. Legal analyses through 2026 keep landing on the same word — unresolved — because Regulation E never contemplated a consumer delegating open-ended purchasing authority to software. The Consumer Bankers Association asked regulators in January 2026 to work through exactly this with the industry, covering dispute resolution and liability where agent-driven transactions cause financial harm. As of August 2026 no rule has arrived.

That uncertainty is not neutral. When a consumer protection rule is ambiguous, the consumer is the party who finds out how it resolves by spending months arguing with a bank.

Credit cards sit under a friendlier rule

Consumer credit cards fall under the Truth in Lending Act and Regulation Z, and the standard there is different in two ways that both help you.

First, authority is defined broadly. Card use is authorized when the person who initiated it had actual, implied or apparent authority. That is a wider net than Regulation E's, and it arguably covers an agent acting outside the precise scope you had in mind — which sounds like bad news, and is, for the narrow question of whether you can call the charge fraud.

Second, and more important: TILA gives you a dispute right that does not depend on calling anything fraud. You can dispute a purchase of goods or services that you did not accept or that was not delivered as agreed. An agent that bought the wrong item, ordered a duplicate, or bought something never delivered runs straight into that provision.

The practical consequence is that on a credit card you have a route to your money back that does not require winning the "was this authorized?" argument at all. On a debit card, that argument is the whole case.

Who actually absorbs the loss

Follow the money one step further and the answer is blunt: in most agent-purchase disputes, the loss lands on the merchant, not the bank and not the card network.

Chargeback monitoring programs — Visa's VAMP, Mastercard's ECM — do not care how a transaction was initiated. A merchant's chargeback ratio is a chargeback ratio whether a human clicked buy or an agent did. Merchants are being told, correctly, to start capturing evidence trails now: which agent acted, under what instruction, with what spending limit, and what confirmation the consumer saw.

That matters to you as a shopper for one non-obvious reason. Merchants who cannot defend agent transactions will start refusing them, or will require confirmation steps that defeat the point of the agent. The friction you meet at checkout over the next year is a direct readout of this unresolved liability question.

Europe is not filling the gap either

The natural assumption is that the EU AI Act covers this. It does not — not yet.

AI systems making autonomous financial decisions can fall into the AI Act's high-risk tier, which carries human-oversight, transparency and documentation duties. But the Digital Omnibus, in force since 27 July 2026, postponed the Annex III standalone high-risk obligations from 2 August 2026 to 2 December 2027, and high-risk AI embedded in regulated products to 2 August 2028. The transparency rules in Article 50 kept their August 2026 date, but they oblige disclosure, not a refund.

European consumers still have the strong existing framework — PSD2 strong customer authentication, distance-selling withdrawal rights, chargeback rights through the card scheme. Those are real, and in the case of the EU's 14-day withdrawal right for most online purchases, they are considerably better than anything a US shopper has. But none of them were written with a delegated agent in mind either.

What to actually do before you let an agent spend

Five things, in order of how much they protect you:

Give the agent a credit card, never a debit card or direct bank access. This is the single decision that determines which rulebook you are under.
Use a virtual card number with a hard limit. Most major US issuers and every European neobank worth using can mint a card locked to one merchant with a spending cap. An agent cannot exceed a limit that does not exist.
Keep the transcript. The instruction you gave the agent is your evidence of what you did and did not authorize. If the tool does not retain a durable log of agent actions, treat that as a reason not to give it a card.
Set the confirmation threshold low. Tools that support "ask before spending over X" should be set to a number that is annoying, not comfortable. The friction is the protection.
Dispute fast and use the right words. For a wrong or undelivered item on a credit card, the framing is a billing dispute over goods not accepted or not as agreed — not fraud. Fraud invites an investigation into whether you authorized the agent, which is the argument you want to avoid having.

None of this is exotic. It is the same logic that has always made a credit card the correct instrument for internet purchases, applied to a new class of buyer that happens not to be a person. The regulators will get to agentic payments eventually; the card you attached today decides how much that delay costs you.

Originally published on www.nihardaily.com. For more articles like this one, visit www.nihardaily.com.

Do You Have to Label AI Content? The Aug 2 Rules

Akash Das — Sun, 16 Aug 2026 09:53:48 +0000

Two AI labelling laws switched on together on August 2, 2026 — Article 50 of the EU AI Act and California's AI Transparency Act — and almost every explainer written about them is aimed at compliance officers at model companies. If you are a freelancer, a marketer, a small publisher or anyone who just puts AI-made images and text on the internet, the useful question is narrower: which of these duties is actually yours, and which belong to OpenAI, Google and Adobe whether you think about them or not? The honest answer is that most of the machinery lands on the model providers, and your own obligations are few, specific, and easy to satisfy — if you know which three they are.

The rule that decides everything: are you a provider or a deployer?

The EU AI Act splits obligations between the provider — whoever puts the generative AI system on the market — and the deployer, meaning whoever uses it. Nearly all the engineering-heavy requirements sit with the provider.

Under Article 50(2), providers must design their systems so that synthetic image, audio, video and text output carries a machine-readable mark that identifies it as AI-generated. That is watermarking, C2PA-style content credentials, cryptographic signing — provider work, not yours. If you generate an image in a mainstream tool, that marking is the tool's job.

The deployer duties in Article 50 are the ones that can attach to an individual, and there are three:

Chatbot disclosure. If you deploy an AI system that interacts with people, those people must be told they are dealing with AI — unless it is obvious from context.
Deepfake disclosure. If you publish AI-generated or manipulated image, audio or video that resembles real people, places or events, you must disclose it.
AI-written text on matters of public interest. If you publish AI-authored text intended to inform the public on matters of public interest, you must disclose that too — with a carve-out that matters enormously to bloggers, covered below.

Everything else in the transparency article is provider machinery.

The editorial-responsibility carve-out most write-ups skip

The text obligation has an exception written into it: the disclosure duty does not apply where the AI-generated text has undergone human review or editorial control and a natural or legal person holds editorial responsibility for its publication.

Read plainly, that is the difference between a site that pipes model output straight to publication and a site where a named human reads, edits and stands behind the piece. The second case is outside the labelling duty for text — not because the AI involvement is hidden, but because a person has taken responsibility for the claims. It is worth noting how neatly this rewards the editorial workflow that helpful-content ranking already rewards.

The image, audio and video duty has no equivalent human-review escape. A deepfake stays a deepfake after you edit it.

Dates: what actually applies today

Article 50 applied from 2 August 2026. It kept its date when everything around it moved.

The Digital Omnibus — the EU's amending package, which entered into force on 27 July 2026 — postponed the high-risk obligations that were supposed to arrive on the same day: Annex III standalone high-risk systems (recruitment, credit scoring, education, law enforcement, border control) now bite on 2 December 2027, and high-risk AI embedded in regulated products under Annex I on 2 August 2028.

The one concession Article 50 received is narrow: generative systems already placed on the EU market before 2 August 2026 have until 2 December 2026 to bring their machine-readable marking into conformity under Article 50(2). Systems launched on or after 2 August 2026 get no grace period at all. Note again who that helps — it is a provider grace period. Your deepfake and chatbot disclosures were due on 2 August.

Penalties for breaching Article 50 fall in the AI Act's middle tier: up to €15 million or 3% of worldwide annual turnover, whichever is higher, rather than the headline €35 million / 7% reserved for prohibited-practice violations. And the Act reaches non-EU businesses whose AI output is used in the EU, so a US freelancer serving European clients is in scope.

California: same date, entirely different mechanism

California's AI Transparency Act (SB 942, amended by AB 853) became operative on 2 August 2026 — a date deliberately aligned with the EU. Its structure, though, is nothing like Article 50's.

CAITA regulates covered providers only: generative AI systems with more than one million monthly visitors or users that are publicly accessible in California. If you are reading this wondering whether it applies to you, it does not. There is no CAITA duty on ordinary users, and — a detail that surprises people — it does not cover AI-generated text at all. Images, video and audio only.

What covered providers owe as of 2 August:

Latent disclosure: machine-readable provenance metadata embedded in generated image, video and audio, identifying the system, its version, and the date of creation or alteration, in a form durable and consistent with industry standards.
Manifest disclosure: an option for the user to add a visible AI marking, made permanent or extraordinarily difficult to remove where technically feasible. Note it is an option offered to you, not a label forced onto your output.
A free public detection tool that accepts uploads, URLs and API calls and reports whether the content came from that provider's system.

Two later phases matter for planning: from 1 January 2027, large online platforms must detect and surface embedded provenance data, and AI hosting platforms may not knowingly offer non-compliant systems; from 1 January 2028, capture-device manufacturers must support the disclosures by default. Enforcement is $5,000 per violation, per day, by state authorities, with no private right of action.

What this means in practice

Put the two regimes side by side and the practical picture for an individual is short.

You must, if you publish into the EU: label deepfake-style synthetic media, tell people when they are talking to your chatbot, and either disclose AI-written public-interest text or take genuine editorial responsibility for it.

You do not have to: watermark every AI-assisted image you post, add a badge to AI-assisted copywriting, or run detection tooling. Those are provider duties, and in California they are provider duties that only bind services above a million monthly users.

Worth doing anyway: keep the provenance metadata intact. Latent marks travel in file metadata, and re-exporting, screenshotting or stripping EXIF removes them. Nothing in either law obliges you to preserve a mark someone else embedded — but a 2027 platform rule that surfaces provenance is coming, and content that arrives with credentials intact will read as more trustworthy than content that arrives bare. That is a reputational argument, not a legal one, and it is the right way to think about most of this: the legal minimum for an individual is genuinely small, and the disclosure habit is worth more than the compliance box.

Originally published on www.nihardaily.com. For more articles like this one, visit www.nihardaily.com.

Claude Code Auto Mode Goes Default August 14

Akash Das — Sun, 16 Aug 2026 09:43:09 +0000

On August 14, 2026, auto mode becomes the default permission mode for new Claude Code sessions on Pro, Max and Team plans. The agent stops asking before each step and simply proceeds, unless the action it wants to take is judged irreversible, destructive, or aimed outside your environment. Anthropic's argument for the change is a number from its own testing: in a 1,053-action study, auto mode blocked 89% of harmful actions, while humans clicking through approval prompts caught 13.6%. The uncomfortable half of that finding is why — users habitually approved 97% of the prompts they were shown.

If you have used a coding agent for more than a week, you already know the feeling being described. The prompt stops being a decision and becomes a keystroke. Anthropic calls this permission fatigue, and it is making the case that a model checking each action against a policy is a better guard than a human who has stopped reading.

What changes on August 14, and what does not

Three things are true at once, and they get mixed up in most of the coverage.

First, the default flips only for new sessions on Pro, Max and Team. Existing sessions keep the mode they are running in.

Second, auto mode is not "approve everything." Actions classified as irreversible, destructive, or targeting something outside your environment still stop and wait for you. Deleting data, force-pushing over history, and reaching for a remote system you did not point the agent at are the shapes of action that still surface a prompt.

Third, the rollout ships with two controls that matter more than the default itself: prompt-injection screening on incoming content, and hard deny rules you configure so that certain actions can never be taken regardless of what the model concludes. Deny rules are the part worth your afternoon. They are the only control in the list whose behaviour does not depend on a model's judgement.

The 89% number cuts both ways

Eighty-nine percent blocked means eleven percent not blocked. On a single action that is a good trade against a human's 13.6%. Across a long-running agent session that takes hundreds of actions, an 11% miss rate on the harmful subset is not a rounding error, and independent commentary made that point immediately.

The prompt-injection result is stronger and deserves to be quoted precisely: none of 720 attack attempts succeeded against Claude Fable 5, Opus 5, or Sonnet 5 running auto mode. That is a real result on a real threat model. It is also a result against a fixed attack set, which is a different claim from "prompt injection is solved."

Why this specifically matters after the last year of agent attacks

Here is the part the announcement coverage skipped. The two most widely reported attacks on coding agents in the past year both routed through content the agent read, not code the user wrote.

In one, text inside a GitHub issue was enough to steer Claude Code and Gemini CLI into actions their operator never asked for. In another, a compromised npm package in the dependency chain reached developer machines through the editor. In both cases, the last thing standing between the agent and the damage was a human looking at a prompt and deciding whether the action made sense.

Anthropic's data says that last line of defence was mostly theatre — 97% approval rates are not review. That is a fair reading. But it means the correct response to auto mode is not "trust it" or "turn it off." It is to move the control you were relying on from the prompt into the deny rules, where it does not depend on anyone reading anything.

A ten-minute checklist before Thursday

Decide the default per surface, not per person. A laptop that holds production credentials and a scratch container running throwaway branches do not deserve the same default. Auto mode is far easier to accept when the environment itself is cheap to destroy.

Write hard deny rules for the things you would never approve. Credential files and secret stores. Anything that pushes to a remote or a package registry. Network calls to hosts outside your allowlist. Deletion of anything outside the working tree. These are static rules; write them once.

Check what the agent can reach, not just what it can do. Prompt-injection screening reduces the odds that hostile text steers the agent. Scoping the environment reduces the damage if it does. The second is under your control and does not degrade.

Pin the default centrally if you run a team. Administrators can set a different default or disable auto mode through managed settings, which is the mechanism that matters for a Team plan. Doing nothing is also a choice, and on Thursday it is a choice with a new meaning.

Know how to switch mid-session. You can change permission mode inside a session at any time. Knowing the switch exists is what makes a default tolerable — you can drop to a stricter mode for the fifteen minutes where the agent is touching something you care about.

The honest summary

Auto mode is a bet that a model applying a policy consistently beats a human applying judgement inconsistently. Anthropic's own numbers support the bet, and the 97% approval statistic is the strongest evidence in the whole announcement — not because it flatters auto mode, but because it tells you the control you thought you had was already gone.

What you should not do is read "89% blocked" as a security guarantee, because the same sentence contains "11% not blocked." Treat auto mode as what it is: a better default than a prompt nobody reads, sitting on top of an environment you are still responsible for scoping.

Originally published on www.nihardaily.com. For more articles like this one, visit www.nihardaily.com.

DEV Community: Akash Das

A pre-flight checklist for shipping a Claude connector

Gate 1 — Can Anthropic's infrastructure reach you?

Gate 2 — Can Claude get an OAuth client ID?

Gate 3 — Will directory review reject your tool design?

Gate 4 — What does your connector cost the context window?

Optional gate — should it draw a UI at all?

TL;DR

Five agent engineering problems, with the numbers behind them

1. Your agent loops because tool_choice sticks

2. The Assistants API shuts down on August 26, and your threads do not move

3. AutoGen is in maintenance mode, and the port is a redesign

4. Memory and prompt caching pull against each other

5. Your end-to-end eval hides the regression

The thread that connects them

Five developer deadlines in August 2026: Copilot credits, Rust 1.98, TypeScript 7

1. Stripe is buying OpenRouter for more than $7 billion

2. GitHub Copilot's promotional credits end August 31

3. TypeScript 7 is fast, but half the ecosystem cannot use it

4. Python 3.15 hit rc1, and free-threading finally has a stable ABI

5. Rust 1.98 lands August 20, and one change can break crates

Your AI Agent Bought the Wrong Thing. Who Pays?

The rule everyone is arguing about was written for humans

Credit cards sit under a friendlier rule

Who actually absorbs the loss

Europe is not filling the gap either

What to actually do before you let an agent spend

Do You Have to Label AI Content? The Aug 2 Rules

The rule that decides everything: are you a provider or a deployer?

The editorial-responsibility carve-out most write-ups skip

Dates: what actually applies today

California: same date, entirely different mechanism

What this means in practice

Claude Code Auto Mode Goes Default August 14

What changes on August 14, and what does not

The 89% number cuts both ways

Why this specifically matters after the last year of agent attacks

A ten-minute checklist before Thursday

The honest summary

1. Your agent loops because `tool_choice` sticks