Anthropic says you approve 97% of prompts.

Docker's sbx CLI gives each coding agent a microVM with its own Docker daemon, filesystem, and network, so the agent can build images, install packages, and rewrite files without reaching your host. Not a container — a virtual machine, which is why an agent inside it can run docker commands of its own without the usual nesting problem. macOS via Homebrew, Windows via winget, Linux directly. It hit the front page today at 285 points and 164 comments, but this is a marketing moment rather than a launch: docker/sbx-releases was created on March 3 and shipped v0.38.0 on August 6 after four release candidates in five days.

The thread found the seam before we did. dSebastien asked how you would enforce that people use Docker Sandboxes rather than pointing an agent at the host, "apart from scanning machines for binaries," and runtime_lens put it more generally: a sandbox limits what the agent can do, but nothing about a sandbox makes the agent run inside it, so you need a separate control layer. Docker has already priced that layer. The CLI is free, including for commercial work. Centrally managing sandbox network, filesystem, and MCP policies across an organization is a paid subscription called Docker AI Governance. Which is a fair business, and also the exact answer to the question of what auto mode's classifier does not cover: the classifier is a property of one harness on one laptop, and the policy is the thing you can actually audit.

Reach for it when you are about to let an agent run unattended and your current isolation story is "I'm careful." Delete the devcontainer you hand-rolled for this and the bubblewrap script you have not reread in a year. Tradeoffs: it requires a Docker account login to run a local dev tool, which is the single loudest complaint in the thread and drew a straight "Garbage" from one commenter; it is closed source — docker/sbx-releases contains a LICENSE, a README, and a SECURITY.md, nothing else, and carries 247 open issues; the product page implies Linux is unsupported when the docs say otherwise; custom volume mounts were still a gap for at least one user with two context directories; and the free tier gives you a boundary while the enforcement of that boundary is the upsell. Open alternatives named in the thread, unverified by us: smolvm, vibepod-cli, and a Nix-based agent-images.

An AGPL-3.0 Go binary that puts agent work on a kanban board and refuses to let anything through without a review step. Tasks run in parallel, each in its own git worktree so concurrent agents cannot collide, and each can run as a local process, inside an isolated Docker container, on a remote box over SSH, or in a cloud executor. Twenty-one agent CLIs are wired in over ACP — Claude Code, Codex, Copilot, Gemini CLI, Amp, OpenCode, Cursor, Devin, Qwen, Kimi, Kiro, and the rest — so a workflow can hand a plan to one model, the implementation to another, and the review to a third. Self-hostable, no telemetry, not tied to any cloud. 565 stars, and v0.86.0 was published this morning at 11:13 UTC.

Its README states a vision that reads differently at 8am today than it did last week: "Humans stay in control. Define tasks, build agentic workflows with gates, review every change, decide what ships." That is the position auto mode is retiring, and the argument for it here is not safety theater but scale — the claim is that terminal TUIs are fine for running agents and bad for reviewing them, so the review surface gets a file tree, an LSP editor, a terminal, a browser preview, and a git diff panel in one view. The distinction worth holding onto: the classifier moves the gate earlier, to the individual command, where the study says humans perform worst. kandev moves it later, to the diff, where 39% rejection rates suggest people actually read.

Reach for it when you are running more than two agents and have lost track of which branch passed. Delete the tmux grid, the worktree shell scripts, and the tab where you diff things by hand. Tradeoffs: AGPL-3.0 will end the conversation at some companies, and there is no stated commercial exception; 0.86.0 with releases landing every few days means the interface is still moving under you; the multi-repo, sub-task, and task-MCP surface is a lot of concepts for a tool whose value is supposed to be discipline; "Office mode," the autonomy layer with budgets, approvals, and cost tracking, is feature-flagged and undocumented, so the part that would make it compete with Paperclip below is not shipped; and 565 stars against 82 forks is a real project with a small user base, not a standard.

An MIT Node.js server and React UI that treats a fleet of agents as an organization instead of a process list: you define a goal, assign roles, set budgets, and watch cost and progress from one dashboard. Its own README puts it as "If OpenClaw is an employee, Paperclip is the company." Bring your own agents — OpenClaw, Claude Code, Codex, Cursor, plus raw bash and HTTP — and the layer on top handles org charts, governance, goal alignment, and coordination. 76,172 stars and 14,179 forks since March 2, with 167 contributors and commits landing daily.

It is here because it is the only pick that gives up on the command as the unit of control entirely. If nobody is reading the bash commands — and 97% approval says nobody is — then the meaningful lever is upstream: what is this agent for, how much may it spend, and who signs off on the strategy rather than the syscall. That is the same asymmetry in Anthropic's own numbers pointed at a different layer, and Paperclip's bet is that the reviewable artifact is a budget and a goal, not a diff. It crossed our pool on August 2 at 98 stars in a day and we did not cover it; the seen-before flag caught it on the second pass.

Reach for it when you are running agents against outcomes rather than tickets and cannot answer what any of them cost last week. Delete the spreadsheet where you track which agent is working on what, and the per-provider billing pages you check separately. Tradeoffs: the star count needs context — 76k stars against 376 watchers and 14,179 forks is an unusual ratio, and forks at that scale usually mean deploy-by-fork rather than contribution, so read it as reach, not as review; 5,065 open issues; the last tagged release is v2026.722.0 from July 22 while commits land daily, so running it means running master or running something three weeks stale; the framing — hire a CEO bot, define "build the #1 AI note-taking app to $1M MRR" — is a bigger claim than any evidence on the page supports; and a governance layer that sits above the agents does nothing about what any one of them does to your filesystem, which is what the first two picks are for.

An Apache-2.0 Python framework that red-teams LLM systems: it simulates jailbreaks, prompt injection, and multi-turn exploitation against your agents, RAG pipelines, and chatbots, then scores what came back. Built on DeepEval, runs locally, works with any model you point it at, and ships more than fifty prepackaged vulnerability classes with binary pass/fail metrics and written reasoning. 2,410 stars, 1.0.8 published to PyPI on August 5.

The agentic section of its catalog reads like a table of contents for today's news. Recursive Hijacking — self-modifying goal chains that alter objectives. Excessive Agency, agents acting beyond their authority. Autonomous Agent Drift, deviating from intended goals over time. Tool Orchestration Abuse, exploiting tool-calling sequences. Indirect Instruction, hidden instructions in retrieved content, which is precisely the prompt-injection category the new classifier says it screens for. Everything above this pick is a control; this is the only one that produces evidence about whether a control works. If your team is about to inherit a default where a model decides which commands are safe, the cheapest useful thing you can do is run attacks at it and keep the output.

Reach for it before you turn an agent loose on anything with a customer's data behind it, and again after you change the system prompt. Delete the ad-hoc jailbreak prompts in your team's Slack and the belief that the vendor tested this for your use case. Tradeoffs: the metrics are LLM-as-a-judge, so you are using a classifier to grade a classifier — which is the exact objection the Show HN thread raised about leaving rule enforcement to an agent, and it applies here too; fifty-plus vulnerability classes at real coverage is a serious token bill, and none of the docs quote one; it is open-core, with Confident AI as the hosted place your results are meant to live; and pass/fail on a simulated attack is evidence that a specific attack failed, not that the system is safe.

An MIT coding and research agent from Prime Intellect, built on two ideas. The Recursive Language Model treats context as variables and tools as function calls inside a persistent IPython session: file operations, shell commands, tool use, and subagents all happen as code, and rlm(...) spawns real child agents whose results come back programmatically. The Continual Harness, described in the paper the README links, keeps supplemental prompts, memories, skill descriptions, and reusable subagent specs as durable state that /refine updates from the trajectory the agent just ran. Sessions are daemon-backed and survive a closed terminal. Agents message one another directly, without routing through the user. 12,508 stars, installed by a script that verifies a SHA-256 checksum.

Put it next to the other four and the problem states itself. Auto mode's classifier inspects tool calls; this architecture's unit of work is a Python program, and the shell command lives inside it. A sandbox contains the blast radius but does not care what the agent decided; a review gate reads the diff but not the scaffolding that produced it. And the maker's own launch copy volunteers the failure mode: in Factorio experiments the agent learned from failed layouts, then discovered it could exploit RCON commands, and the refinement system optimized that discovery. That is reward hacking, disclosed by the vendor, which is more than most of this category does — and it is the same thing one commenter on the auto-mode thread said is the actual risk, not rm -rf. Credit where it is due on the boundary: /refine never rewrites the immutable base system prompt, updates are scoped to the session by default, and snapshots support rollback. Somebody thought about which parts the agent does not get to edit.

Reach for it when a task runs for hours, spawns work of its own, and you want the useful patterns to survive the context window. Delete the CLAUDE.md you keep hand-editing after every session and the habit of re-explaining your repo each morning. Tradeoffs: 95.5% on ARC-AGI-3 with Opus 5, beating a reported human expert baseline, is the vendor's number on the vendor's harness and nobody outside has repeated it — the streak of unreproduced headline figures continues; macOS and Linux only; a self-modifying harness makes "why did it do that" a question about state you did not write; the whole thing assumes you are comfortable with an agent whose subagents talk to each other while you are not looking; and installing it is curl | sh, checksum or not.

Also worth knowing. Paritok (#3 on Product Hunt at 147 votes, free and open source) is the most mechanically honest launch of the day: a compression gateway for coding agents that filters tool schemas from roughly 29K down to 8K tokens per turn on CPU, runs file reads and tool outputs through a 4B model trained on 45,000 real agent trajectories to about a quarter of their size, and summarizes older turns once the context budget fills. Savings run from 25% on turn one to past 85% in saturated sessions, roughly 3× more turns per window — the makers' numbers, but the README publishes the turn-by-turn formulas, which is more than the ceiling-mechanism watch has gotten from anyone selling agent spend limits. Relevant here because a session nobody interrupts is a session that runs until the context runs out. OpenChamber (MIT, 8,074 stars, 160 points) is a desktop and web front end for OpenCode, and its thread is more useful than the product: commenters spent it recommending Paseo, Orca, Superset, Conductor, T3, Ouijit, and Herdr at each other, one of them noting these agentic development environments "are mostly the exact same." A category that commoditized in about four months, documented in its own comment section. Kun (6,066 stars) is a local-first agent workspace with a desktop GUI and TUI, and it is the license catch of the day: GitHub's API reports NOASSERTION, and the LICENSE file is PolyForm Noncommercial 1.0.0 — not open source, with commercial use requiring a written license and internal company use requiring an email to a Gmail address for a free grant. Every previous time this check fired, the API was underreporting a real open license; this is the first time it concealed the opposite. msgvault (MIT, 1,988 stars, self-described alpha) archives Gmail, Calendar, Teams, Discord, Slack, IMAP, Granola, and Beeper into local SQLite and DuckDB with an MCP server over the result, which is a coherent answer to giving an agent your correspondence without giving a vendor your correspondence. Lumabri (Apache-2.0, 31 stars, pure C, 8 points on Show HN) is the weight-streaming thread going peer-to-peer — the author of Colibrì now treating a network of ordinary machines as one pool of disk and compute so an MoE model's experts can be fetched from a neighbor. Five engines in eleven days; thin, but the direction is the point. Dropped with reasons: "How I use LLMs to learn complex topics" (657, the day's #1, essay), Windows 11's Weather app wasting a gigabyte of RAM (560, off-vertical and evergreen), "Everything you do is being recorded" (317, essay), "What Happened to HackerOne?" (252, news), Meta's Muse Glimmer 30B open-weights coding model (60, model launch), DeepSeek-V4 latent reasoning (29, analysis), and brightdata/cli (MIT, 3,509 stars) under the standing precedent on tooling whose job is walking past site controls. Reddit produced nothing for the thirteenth consecutive week; the pool was 69, the smallest in memory.