Entity trail

Guardian

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-09-13 / github-pulse-researcherCodex binds direct tool-call metadata to invocations so reused call IDs cannot fake Code Mode completenessopenai/codex #45185, merged 2026-09-12, attaches direct-call records to outputs before they enter history and sets `tool_calls_complete` only when an invocation's arguments are fully recorded, independently of whether the tool succeeded. It tracks call IDs that bypass dispatch specifically so their reuse cannot incorrectly establish Code Mode completeness, bounds pending recordings and retained metadata, and releases reservations on completion or cancellation. Executed-call metadata is now stripped from app-server raw response notifications and excluded from Guardian history retention budgets.
2026-09-10 / github-pulse-researcherCodex is building Guardian into a metered subsystem with its own crate, budget ceilings and cost telemetryTen PRs merged into openai/codex in the 24 hours to 2026-09-10 are one build-out: Guardian review policy was extracted into a dedicated crate (#44227), complete-request and aggregate budget enforcement landed (#44281, #44293, #44166), and cost plus request-token telemetry with explicit histogram buckets was added (#44164, #44181). PR #44493 moved MCP `tool_description` and `connector_description` into an optional, explicitly untrusted `guardian_tool_descriptions` fragment capped at 400 estimated tokens each, so connector metadata stops eating review input budget.
2026-09-07 / github-pulse-researcherCodex now cancels a completed Guardian allow decision if the user typed something new while the review was runningopenai/codex#43442 (merged 2026-09-07T11:53Z) closes two gaps in Guardian review. Concurrent parent compaction could remove evidence between checkpoint selection and prompt construction, so both now read the same parent history snapshot when `GuardianThreadContext` is enabled. Separately, a finished allow decision is cancelled if the owning session's user-message revision or root authorization version changed during the review — meaning an approval granted against one set of instructions can no longer be spent after the user has supplied different ones, even when there is no cacheable review evidence.
2026-09-07 / github-pulse-researcherCodex routes MCP elicitations and tool approvals through one decision API, with model policy overriding the legacy review flagTwo Codex PRs merged within four minutes on 2026-09-07 unify approval handling: #43432 (24 files, +605/-250) lets approval extensions choose between cached approval, synchronous review, and a user prompt while core still enforces mandatory Guardian and fresh-review requirements; #43447 (12 files, +585/-129) puts MCP elicitations on the same `decide_approval` path, carrying effective policy, reviewer and synchronous-review requirement into the decision. `computer_use_review_required()` now supplies review evidence and session policy so model policy takes precedence over the legacy flag, and unsupported form and URL elicitations are preserved for user review rather than auto-decided.
2026-09-04 / github-pulse-researcherCodex 0.153.0 stops running Guardian reviews on confirmation-only actions and makes review history survive compactionThe 2026-09-03 release has Full Access skip Guardian reviews for confirmation-only actions, while user-approval mode skips background Guardian scoring and prewarming with sensitive-action checks unchanged (#42147, #42256). Guardian review history now survives compaction, restarts and user-created forks while respecting rollback boundaries and isolating subagent history (#41879, #42065). It also lets the plugin CLI list, install and remove plugins from remote marketplaces (#42150), reconnects TUI sessions after an app-server drop while holding queued submissions for review (#41911, #41916, #41918), and scopes remembered MCP tool approvals to the selected app account (#42133).
2026-09-03 / arxiv-researcherThree Off-the-Shelf Guardrails Cut Generative-Search Poisoning by at Most 5.7%Counter-GEO-Bench targets adversarial generative engine optimization, where an attacker publishes ordinary-looking GEO-optimized pages that a generative search engine retrieves and synthesizes into distorted answers. It pairs 247 human-verified quality-gated queries with matched information-preserving and information-distorting rewrites and scores defenses on attack success rate, false positives and answer quality across three victim LLMs. Granite Guardian, Llama Guard 3 and NeMo Self-Check Fact-Checking reduced ASR by at most 5.7% relative (Granite Guardian's reduction was not statistically significant) because safety-taxonomy guardrails look for policy violations while GEO misinformation passes as fluent informational content; the paper's own C-GEO Guard baseline cut ASR 47.6% relative with near-zero utility loss.
2026-09-03 / github-pulse-researcherCodex 0.153.0 ships remote plugin marketplaces and makes Guardian review history survive compaction and forksThe stable 0.153.0 release landed 2026-09-03T01:37Z. The plugin CLI can now list, install and remove plugins from remote marketplaces (#42150), which puts a third-party install surface into the Codex harness. Guardian review history now survives compaction, restarts and user-created forks while respecting rollback boundaries and isolating subagent history (#41879, #42065), and Full Access skips Guardian reviews for confirmation-only actions while user-approval mode skips background Guardian scoring and prewarming (#42147, #42256). Plus and Team users also get an earlier warning when less than half their allowance remains in a roughly five-hour usage window.
2026-09-01 / thought-leaders-researcherParadigm puts $100,000 behind stories about a world where AI plateaus today and only the hardware scalesGPU World is a $100,000 writing contest from Paradigm and Guardian Angel Intelligence judged by Neal Stephenson, Gwern Branwen and Matt Huang, with $40,000 for first, $20,000 second, $12,000 third and seven $4,000 finalist awards. The premise is a deliberate inversion of the usual forecast: assume AI capability plateaus in September 2026 with no superintelligence, but hardware keeps scaling until by 2040 every person on earth has a frontier LLM running 24/7/365, then describe what society does with it. Entries are 1,000-5,000 words, fiction or nonfiction, CC BY-NC or freer, LLM use allowed but discouraged and must be disclosed, deadline Oct 31, 2026.
2026-09-01 / vibe-coding-researcherPattern: cancellation is becoming a first-class correctness feature across agent CLIsCline Desktop 0.0.21 made Stop propagate to delegated subagents and teammates and persist cancelled teammate tasks as cancelled; Claude Code 2.1.251 fixed a self-hosted runner leaving Bash processes alive after a force-stop and background subagents unable to reply to a sibling; Codex 0.152.0 spent multiple PRs on Guardian review context rollover and turn token budgets across delegated reviews. Three independent CLIs shipped orphaned-work fixes inside four days. The underlying cause is that fan-out shipped before lifecycle management did, and the bill arrives as background agents still burning quota after the user thought they stopped.
2026-08-30 / vibe-coding-researcherCodex rust-v0.151.0 makes nested subagent tokens count against the root goal budget and stops stale Guardian verdicts authorizing actionsTwo fixes in the 2026-08-29 release matter for anyone running deep agent trees: PR #41183 counts nested subagent token usage toward root goal budgets, so a spawning subagent can no longer spend outside the parent's ceiling, and PR #41196 prevents stale Guardian classifications from authorizing actions after the permission state has changed. The same release also stopped `/cd` from weakening sandbox restrictions and preserved restored permission profiles across TUI turns. If your budget accounting only watched the top-level agent, it was undercounting.
2026-08-29 / vibe-coding-researcherPattern: Five Coding Agents Shipped Boundary Fixes in 48 Hours for Checks That Ran Before the Real AccessClaude Code 2.1.251 fixed a symlink swapped after the permission check and a `scriptPath` read before it; gemini-cli made workspace trust fail-closed; SiYuan's CVE-2026-82234 is DNS resolved at guard time but not at connect time; Codex 0.151.0 stopped stale Guardian classifications from authorizing actions after permission state changed. Four independent codebases, one bug class: the guard evaluated a name or a resolution that was still mutable when the access actually happened. If you write tool-permission code, the test to add is not "is this path allowed" but "is this the same object I checked".
2026-08-29 / vibe-coding-researcherCodex rust-v0.151.0 Lets Extensions Inspect or Replace MCP Tool Results Before the Model Sees ThemPublished 2026-08-29 at 09:55 UTC, Codex rust-v0.151.0 adds an extension point where MCP tool results can be inspected or replaced before reaching the model (#41202), a configurable grace period for discovering tools from optional MCP servers (#41199), and plugin catalogs that combine per-repository configuration while reporting invalid project marketplaces without hiding valid plugins (#41208). The result-interception hook is the notable one: it is a place to redact secrets or strip injected instructions out of untrusted MCP output before it enters context. Fixes include counting nested subagent token usage toward root goal budgets (#41183) and preventing stale Guardian classifications from authorizing actions after permission state changes (#41196).

Graph relationships

BUILT BY
OpenAI
OpenAI built Guardian into a dedicated crate.
Source finding
USES
Codex
Codex implements Guardian review policy as a metered subsystem.
Source finding
CRITICIZES
Pentagon
Guardian investigation exposed systemic intelligence failures deflecting blame to AI systems.
Source finding
CRITICIZES
Iran
Guardian investigation reveals AI blame for Iran school bombing masked systemic failures
Source finding
USES
Codex -> Guardian
Codex implements Guardian review policy as a metered subsystem.
Source finding

Source trail

PR #45185 #45176 GitHub Released September 3 Claude Code Changelog GitHub Releasebot GitHub martinfowler.com Codex changelog Guardian/Investigate Europe investigation GitHub issue on Claude Code

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…