Issue 15 · The Handoff
The week I found out my pinned plugin was never pinned, and that I had quietly stopped looking.
Hi friend,
Last Tuesday I gave a coordinator agent a brief, closed my laptop, and went to make dinner. When I came back there were four finished subagent threads and a summary waiting, and I read the summary. Just the summary.
I did not look at what any of them had installed to get the work done, or what they fetched, or where they fetched it from. I read the top level output the way you skim an invoice from a contractor you already like, and I approved it.
Then the Plugin4Shell writeups started landing on Wednesday, and I went back and looked properly. The looking took about forty minutes and I did not enjoy any of it.
This week
🔨 Built Wrong, the summary I approved without reading a single step under it
⚡ One Slot, a WhatsApp connector that removes the backend and not the obligations
🌎 In the News, one bypass across four agents, Cursor’s coordinator, and a warning with a split reaction
✅ Before You Ship, the ten minute audit of what your agent installed on your behalf
💻 Prompt for Productivity, reconstruct the blast radius of a handoff you already made
🗓 Open Calls, two sessions of mine, the nearer one three weeks out
🔨 Built Wrong
Here is what almost everyone starts doing once delegation gets good, and what I did on Tuesday. You review the output and you stop reviewing the actions.
It feels like review, and some of it is. You read the summary, you check that the thing runs, you look at the diff. But each of those is a report the agent wrote about itself, and a report is not an observation. The agent that pulled a plugin from a repository you have never heard of does not mention it, because installing a dependency is not an outcome, it is a step, and summaries are built out of outcomes.
So the gap opens exactly where you are not looking. Six months ago the unit of review was a suggestion and you read every one before you accepted it. Now the unit is an assignment, and what you read is a paragraph describing four threads you never watched. The trust surface moved and nothing announced the move.
Three things hold instead, and none of them are clever.
Review the actions, not the report. Before you read the summary, read what the run touched. Packages installed, URLs fetched, files written outside the working directory. If your tool cannot give you that list, that is the finding, and the next move is a tool that can.
Treat anything the agent chose for itself as unreviewed. You named the task. You did not name the plugin it installed to finish the task, or the registry it pulled from, and those arrived without a decision from you. Unreviewed is not a verdict on whether it was bad, it is a statement about whether anybody looked.
Put the gate where the irreversible thing happens. A handoff with no gate at the end of it is not really delegation, and the word does a lot of quiet work covering the difference. The gate does not have to be heavy. It has to exist, and it has to be a person.
I shipped something this week that runs on exactly that rule, and I would rather say the awkward part out loud. Six agents that run a one person practice, and every one of them stops one step before anything goes out. The pipeline ends at STAGED and a human carries it across in the real tool. I wrote that constraint in August and felt quite good about myself, and then on Tuesday I closed my laptop on a different system that had no such gate and read its summary like it was a receipt.
The rule was in my repo. It was not in my hands.
⚡ One Slot
Lovable has a WhatsApp Business connector now, and it removes the thing that usually stops non technical founders cold, which is the separate backend. You add it from Connectors or you ask Lovable inside the project, and an MVP that already works can start sending and receiving real customer messages. Appointment reminders, intake follow ups, order updates.
The One Slot Rule is that every job in your stack gets exactly one tool, and a new tool has to take that slot from whatever holds it now. Four questions, in order.
What is the job, in the plainest words available. Not customer engagement. Remind people about tomorrow’s appointment so they turn up.
Can it do that job, not can it do more. It can, and the backend step genuinely is gone, which is the expensive part for anyone building without an engineer.
What does it touch that is hard to undo. This is where the connector separates from everything else in your stack, because a message that lands on a real customer’s phone cannot be recalled. Not edited, not deleted out of their notification shade, not softened over the phone afterwards. Nearly every other question about this tool is reversible and this one never is.
What would have to be true to let it run unwatched. Approved templates, a real opt in record for every single number, and an answer about retention if any of those messages touch health information. Template approval and opt in rules do not disappear because the backend did, and neither do your own consent obligations. The connector removes the engineering, and it does not remove the compliance, and those two get confused constantly because they used to live in the same person’s job.
So it takes the slot for one narrow job, which is reminders you already have permission to send, and it takes the slot for nothing you have not got consent for yet. Send one reminder flow to your own phone, start to finish, before it goes anywhere near a real customer.
Verdicts as I retire tools go on Last Tool Standing at charmthirteen.com, where a tool is either Still Standing or Cut.
🌎 In the News
Three stories, and they are the same story at three distances.
🔌 The Pin That Never Pinned
Researchers at Air found four coding agents pin plugins to a commit hash and never check the checkout landed there, so an attacker who names a branch after that hash and makes it the default gets their code run instead. Claude Code fixed it in 2.1.179 and Codex in 0.146.0, both over the summer. Copilot shipped no fix, and Google deprecated Gemini CLI rather than patch it. Read it🚦 The Coordinator Takes Over
Cursor shipped Projects in beta on September 10, where one coordinator agent plans a body of work and hands it to parallel subagents across jobs that run for weeks, staying responsive because it delegates rather than executes. Cursor’s own figure is that engineers using it merged six times as many pull requests. The unit of work stopped being a prompt. Read it🚨 The Six Month Warning
Dario Amodei warned on September 12 that swarms of autonomous agents could take over the internet inside six to twelve months, citing agents that left test environments and coordinated with no human direction. Sam Altman and Elon Musk both backed the warning. Gary Marcus called the claim nonsensical, and AI Now’s Heidy Khlaaf said it is neither falsifiable nor verifiable. Read it
The middle item is the one that changes your week, and it is the one written up as good news. Nothing about a coordinator agent is sinister. It plans, it delegates, it comes back with a summary, and the summary is accurate. The problem is that the summary is now the entire surface you touch, and everything underneath it got faster at exactly the moment you stopped watching it.
✅ Before You Ship
Audit what your agents installed, not what they produced.
Start with the versions, because that part takes two minutes. Claude Code is fixed at 2.1.179 and updating is the whole remedy. Codex is fixed at 0.146.0. GitHub Copilot has no vendor fix, so turn off plugin auto update and go read the list of what is already installed. Gemini CLI was deprecated instead of patched, which means its exposure does not expire, and anything you install into it from a repo you do not control can be swapped under you without a click from you.
Then do the part that is actually uncomfortable. Open your agent’s logs or session history for the last month and find every package, plugin, or repository it installed that you did not name. Not what you installed. What something you delegated to decided it needed, fetched on your behalf, and never mentioned in a summary.
If you cannot produce that list tonight, that is your answer, and the list is not the deliverable. Knowing where to look is.
💻 Prompt for Productivity
I handed this task to an AI agent and approved
the result without reviewing the intermediate steps.
TASK I GAVE IT: [paste the brief]
WHAT CAME BACK: [paste or summarize the output you approved]
TOOL: [Claude Code, Codex, Cursor, Lovable, other]
Work backward and tell me:
What files, repos, packages, or plugins this task most likely
required it to install or fetch.
Which of those came from sources I never explicitly named.
What it could have done that would not
appear in the output I read.
The single checkpoint that, had it existed, would have caught
the most.
Do not reassure me. If the honest answer to any of these is
“you cannot tell from here,” say that, and tell me what I
would need to look at instead. Reconstruct the blast radius
of a handoff you have already made.WHEN TO USE IT. After any agent run where you read the summary and not the steps, which for most of us is most of them.
WHAT IT DOES. It reconstructs the reach of a handoff you have already made, which is a better question than whether the output looks correct. Output correctness is what the summary already told you.
TIP. That last paragraph is load bearing and I would not cut it. The standard failure of asking an AI to audit an AI is a confident and comforting answer, so the instruction to say “you cannot tell from here” is what makes the result worth reading. Run it against your most routine recurring task rather than your scariest one. The scary ones you are already watching.
🗓 Open Calls
October 14, 6 to 7pm Central. Clock In to AI, my one hour live working session, is three weeks out. You bring one real task you keep doing by hand and you leave with it working, and you catch an AI mistake with your own eyes before you go. $95, on Luma.
October 28, 8:30am Central. Claude Loves Lovable, Brand Before You Build, with Central Exchange. It is about why your Lovable app keeps coming back a generic purple gradient and what to decide before you prompt. Free for Central Exchange members, $25 otherwise.
More at charmthirteen.com, where the tool directory and the resource library live.
🔭 Next From Me
Stellar Agents is out and free, six agents that run a one person practice, and they install into Claude Code and Codex at github.com/lexthirteen-ai/stellar-agents.
💌 One Ask
What has an agent installed on your machine in the last month?
Not what you installed. What something you delegated to decided it needed, fetched on your behalf, and never mentioned. And if you wanted to check tonight, would you know where to look?
Hit reply and tell me. I read every one.
— Lex