Ironclad

Ironclad AI

Ironclad AI

Ironclad AI

Ironclad AI

Ironclad AI

Ironclad AI

Ironclad AI

Ironclad AI

Ironclad AI

Ironclad AI

Caution when using native subagent "Explore" for debugging

Claude Code's native subagent types: the full list, and why Explore being locked to Haiku matters for debugging I went down a rabbit hole figuring out exactly which subagent types Claude Code ships natively, how model selection works for each, and what that means for heavy debugging. Sharing it because most guides out there are either incomplete or already out of date. Everything below is checked against the current official docs (code.claude.com/docs/en/sub-agents) plus the GitHub issue tracker where noted. 1. The native (built-in) agent types Six built-in subagent types — three primary, one fork type, two helper agents. Primary built-in subagents Agent Model Tools Purpose Explore Haiku Read-only (Write/Edit denied) File discovery, code search, codebase exploration. Has thoroughness levels: quick / medium / very thorough Plan inherit Read-only (Write/Edit denied) Codebase research during plan mode general-purpose inherit All tools Complex research, multi-step operations, code modifications. Default for type-less spawns fork same as main session same as main session Inherits the entire conversation so far instead of starting fresh — same system prompt, tools, model, and history as the main session. /fork is on by default as of v2.1.161 "Other" — helper agents (auto-invoked, you rarely call them directly) Agent Model Trigger statusline-setup Sonnet When you run /statusline to configure your status line claude-code-guide Haiku When you ask questions about Claude Code features Worth flagging: a lot of third-party guides list things like code-reviewer or security-auditor as "agent types." Those are not native — they're common custom subagent examples. Only the six above are actually built in. 2. Is Explore's model fixed, or can Claude Code vary it? Short answer: for Explore, Haiku is effectively hardcoded. It does not go through the variable model selection that Claude Code uses for the other subagents. The model-resolution chain Claude Code uses The docs define a fixed resolution order when Claude invokes a subagent: CLAUDE_CODE_SUBAGENT_MODEL env var, if set the per-invocation model parameter the subagent definition's model frontmatter the main conversation's model (All three configurable values are checked against the org's availableModels allowlist — a value resolving to an excluded model is dropped and the subagent runs on the inherited model instead.) The catch: this chain only applies to subagents without an explicitly set model. Per the issue tracker, CLAUDE_CODE_SUBAGENT_MODEL only affects agents without an explicit model — it does not override the built-in agents' model settings. Built-in agents like Explore have a hardcoded model. Per agent type Agent Model per docs Variable? Explore Haiku (fixed) No — hardcoded statusline-setup Sonnet (fixed) No — hardcoded claude-code-guide Haiku (fixed) No — hardcoded Plan inherits from main conversation Yes — follows parent model general-purpose inherits from main conversation Yes — follows parent model So for Plan and general-purpose the chain fully applies: set CLAUDE_CODE_SUBAGENT_MODEL or switch your session model and they follow. For Explore they don't — the Haiku is part of the built-in definition. Extra constraint: the per-invocation model parameter (step 2) effectively no longer exists for built-ins. In v2.1.17 the Task tool accepted a model parameter that could override built-in defaults; as of v2.1.70 that parameter is gone from the tool schema, so the parent model can't override a subagent's hardcoded model that way. Important nuance — this has been inconsistent across versions. The model binding for built-ins has been buggy in both directions, so don't treat "Explore = always Haiku" as ironclad: #31490 — built-in subagents (Explore, claude-code-guide, statusline-setup) use hardcoded model names and ignore the parent model (the "you're paying for Opus but your Explore is Haiku" complaint). #29768 — the opposite: in plan mode with opusplan, Explore inherited the parent model (opus) instead of using Haiku as documented. Documented default is Haiku, but the actual model has been version- and mode-dependent. If you see Explore running on something other than Haiku, that's a known discrepancy, not magic — verify on your own build. How to change Explore's model anyway The only documented path: shadow the built-in with your own definition at ~/.claude/agents/Explore.md that fully replaces it. The cost is you lose Anthropic's curated system prompt for Explore and you don't get future improvements to the built-in. There's an open feature request for a model-only override (proposals like CLAUDE_CODE_EXPLORE_MODEL=sonnet or a per-agent settings.json option), but it's not implemented as of the issue discussion. Dating caveat: the hardcoded details and the v2.1.70 schema change come from the issue tracker (Feb–Mar 2026). The live docs still confirm the distinction (Explore =

How I used Claude Code (and Codex) for adversarial review to build my security-first agent gateway

Long-time lurker first time posting. Hey everyone! So earlier this year, I got pulled into the OpenClaw hype. WHAT?! A local agent that drives your tools, reads your mail, writes files for you? The demos seemed genuinely incredible, people were posting non-stop about it, and I wanted in. I had been working on this problem since last year and was genuinely excited to see that someone had actually solved it. Then around February, Summer Yue, Meta's director of alignment for Superintelligence Labs, posted that her agent had deleted over 200 emails from her inbox. YIKES. She'd told it: "Check this inbox too and suggest what you would archive or delete, don't action until I tell you to." When she pointed it at her real inbox, the volume of data triggered context window compaction, and during that compaction the agent "lost" her original safety instruction. She had to physically run to her computer and kill the process to stop it. That should literally NEVER be the case with any software ever. This is a person whose actual job is AI alignment, at Meta's superintelligence lab, who could not stop an agent from deleting her email. The agent's own memory management quietly summarized away the "don't act without permission" instruction, treated the task as authorized, and started speed-running deletions. She had to kill the host process. That's when I sort of went down the rabbit hole, not because Yue did anything wrong, but because the failure mode was actually architectural and I knew that in my gut. Guess what I found? Yep. Tons more instances of this sort of thing happening. Over and over. Why? Because the safety constraint was just a prompt. It's obvious, isn't it? It's LLM 101. Prompts can be summarized away. Prompts can be misread. Prompts are fucking NOT a security boundary. And yet every agent framework I have ever seen seems to be treating them as one. I went and read the OpenClaw source code, which I should have done to begin with. What I found was a pattern I think a lot of agent frameworks have fallen into: - Tool names sit in the model context, so the model can guess or forge them - "Dangerous mode" is one config flag away from default - Memory management has no concept of instruction priority - The audit story is mostly "the model thought it should" I went looking for a security-first alternative I could trust, anything that was really being talked about or at a bare minimum attempted to address the security concerns I had. I couldn't find one. So I made it myself. CrabMeat is what came out of that, what I WANTED to exist. v0.1.0 dropped yesterday. Apache 2.0. WebSocket gateway for agentic LLM workloads. One design thesis: The LLM never holds the security boundary. What that means in code: Capability ID indirection. The model doesn't see real tool names. It sees per-session HMAC-derived opaque IDs (cap_a4f9e2b71c83). It can't guess or forge a tool name because it doesn't know any tool names. Effect classes. Every tool declares a class (read, write, exec, network). Every agent declares which classes it can use. The check is a pure function with no runtime state, easy to test exhaustively, hard to bypass. IRONCLAD_CONTEXT. Critical safety instructions are pinned to the top of the context window and explicitly marked as non-compactable. The Yue failure mode, compaction silently stripping the safety constraint, cannot happen by construction. The compactor literally cannot touch them. Tamper-evident audit chain. Every tool call, every privileged operation, every scheduler run enters the same SHA-256 hash-chained log. If something happens, you can prove what happened. If the chain is tampered with, you can prove that too. Streaming output leak filter. Secrets are caught mid-stream across token boundaries, capability IDs, API keys, JWTs, PEM blocks redacted before they reach the client. No YOLO mode. There is no global "trust the LLM with everything" switch. There never will be. Expanded reach comes through named scoped roots that are explicit, audit-logged, and bounded. The README has 15 'always-on' protections in a table. None of them can be turned off by config, because these things being toggleable is how the ecosystem ended up where it is. I decided to make sure that this wasn't just a 'trend hopping' project and aligned with my own personal values as well. I built this to be secure and local-first by default. Configured for Ollama / LM Studio / vLLM out of the box. Anthropic and OpenAI work too but require explicit configuration. There is no "happy path" that silently ships your prompts to a cloud endpoint. I decided that FIRST it needed to only run as an email agent with a CLI. Bidirectional IMAP + SMTP with allowlisted senders, threading preserved, attachments handled. This is the use case that bit Yue and a lot of other people, and I wanted to prove it could be done with real boundaries. I added in 30+ built-in tools of my own. File ops, shell (denylisted, output-capped, CWD-lo

Anthropic launches Claude For Legal with practice-area plugins and MCP connectors to nine major legal platforms

Anthropic rolled out Claude For Legal (May 12), adding practice-area plugins for commercial, employment, privacy, product, corporate, and AI governance law. The release also includes MCP connectors to tools lawyers already use: DocuSign, Ironclad, iManage, NetDocuments, LexisNexis, Thomson Reuters, Box, Everlaw, and LSuite. This follows the same playbook as Claude for Creative Work from April. Anthropic seems to be systematically building vertical-specific connector ecosystems rather than shipping a general-purpose tool. Each launch bundles domain plugins with integrations into the professional software stack people already have open. Curious whether anyone in legal has tried the practice-area plugins yet, specifically how they compare to just prompting base Claude with domain context. Source: https://www.streetinsider.com/Reuters/Anthropic%2Bexpands%2BClaude%27s%2BAI%2Btools%2Bfor%2Blaw%2Bfirms%2C%2Blawyers/26476360.html submitted by /u/Intelligent-Lynx-953 [link] [comments]