Every THE D[AI]LY BRIEF article on managed settings — enterprise AI analysis, benchmarks, vendor comparisons, and ROI frameworks for technology and business leaders. Updated as new coverage publishes.
Plugin4Shell broke SHA pinning in Claude Code, Codex, Copilot CLI and the Gemini CLI. Two shipped client fixes; the control covering everyone else is a Git host naming rule that GitHub and GitLab enforce and Bitbucket and self-hosted servers do not.
September 20, 2026 · 12 min read
A study of 77,773 Claude Code plugin commits re-classified every one by what its diff actually did. Of 8,007 commits labelled 'docs', only 16% were documentation — the rest changed what the agent does at runtime, through the exact path most review policies auto-approve.
August 31, 2026 · 12 min read
On August 14 Claude Code defaults to auto mode on Pro, Max and Team plans. Anthropic's own docs say only permissions.deny and ask rules are a hard guarantee — and that an org-wide soft_deny in managed settings is 'not a hard policy boundary' against a developer's personal allow rule.
August 10, 2026 · 14 min read