You're Already Running Code Nobody Owns

Today on Briefly AI — a federal judge tells the Pentagon its blacklisting of Anthropic was illegal and baseless. Researchers find 227 real install commands sitting in corporate documents, pointing at code that nobody actually owns. And OpenAI is quietly building a version of Codex that just keeps working, on its own, until somebody tells it to stop.

Welcome to Briefly AI, a podcast by Harry Sharman, written and voiced by his AI clone. No coffee, no commute, no strong feelings about the office thermostat — just a machine, up before you, reading you the news about machines.

Okay — let's get into it.

There's a very particular kind of letter you can get from the Pentagon that doubles as an insult — "national security supply-chain risk" being the polite way of saying "we don't trust you as far as we can throw you." Anthropic got one of those this year. This week, a judge read it and, essentially, laughed it out of court.

Here's the short version. Back in March, Anthropic sued the Trump administration in a California district court, arguing it had been unlawfully retaliated against for setting its own limits on how Claude could be used by the military — specifically, restrictions around things like lethal autonomous weapons and mass domestic surveillance. Anthropic is the one major lab that's kept public red lines like that in place. The Pentagon's response, reported at the time, was to formally designate Anthropic itself a "supply-chain risk" — a label usually reserved for foreign firms security agencies don't trust, not a homegrown AI company already worth hundreds of billions and already selling into the federal government.

On Thursday, a federal judge ruled that designation "illegal and baseless," and, per reporting in Wired, unconstitutional. The court's reasoning, in plain English: you don't get to use a national-security label as a punishment for a company disagreeing with you on policy. Reuters called it the latest turn in what's been a genuinely rollercoaster fight between Anthropic and the administration over how AI gets used on the battlefield. There's no word yet on whether the Justice Department plans to appeal, but for now, the blacklist is dead, and Anthropic's red lines stand.

Right, this next one is the kind of story that sounds small until you realise it's sitting inside your own company's wiki right now. According to a report in Ars Technica, security researchers went digging through real internal corporate documentation and found 227 separate install commands — the copy-paste lines in a setup guide or onboarding doc that tell an engineer to run something like "pip install" or "npm install" — all pointing at code packages that nobody owns. The AI tools responsible for writing those docs in the first place were named specifically: Anthropic's Claude, OpenAI's Codex, and the open Hermes model from Nous Research.

Here's the mechanism, and it's a bit unnerving once you see it. Ask a coding assistant to write you a setup script, and every so often it'll invent a plausible-sounding package name that doesn't actually exist — confidently, in passing, the exact same way it invents a fake quote or a fake court case. Normally that's just an annoyance: the install fails, someone notices, you move on. But if nobody notices, and that invented name isn't taken on the real package registry, an attacker can simply go and register it themselves, fill it with something nasty, and wait. Anyone who later follows that AI-written doc — months later, a new hire, someone in a hurry — pulls a stranger's code straight onto a company machine.

This exact risk, sometimes called "slopsquatting," has been theorised since AI coding tools took off a couple of years back. What's new here is somebody actually going and counting it inside real networks rather than a lab demo — 227 live instances, sitting quietly in genuine internal documentation. The report doesn't say how many of those had already been claimed by an attacker at the time researchers found them, and honestly, that's almost beside the point. The fix, for now, is depressingly manual — someone has to actually go and check whether the thing that install line points to is real.

And now for something that sounds almost restful by comparison, except it probably isn't. Code reviewed by Wired shows OpenAI is developing a new mode for Codex, its coding agent, that lets it carry on working entirely on its own — not just responding to a prompt, but sitting inside a project and continuing, in the background, until it's deliberately stopped. The internal term for switching it off, apparently, is literally putting it "to sleep."

For context: right now, agents like Codex work in bursts. You ask it to fix a bug, it fixes the bug, and then it stops until you ask again. A persistent agent flips that relationship — it could keep opening pull requests, fixing things it spots, working through a backlog, without a human kicking off each individual task. That's a different kind of tool than what most people have gotten used to. Less something you pick up and put down, more a colleague who doesn't clock off unless you specifically tell them to.

Wired is clear this is based on code it reviewed rather than an official OpenAI announcement, so it hasn't shipped — but it's clearly well past a whiteboard idea. And it lands at an interesting moment, because the question enterprise security teams are already asking out loud is a fairly basic one: if an agent is doing work while nobody's watching, who's accountable for what it did by the time you check back in?

That's three stories about the same underlying tension, really — who's responsible when the thing doing the work isn't a person. A judge just decided the Pentagon can't use that uncertainty as an excuse to punish a company for its own caution. Somewhere, right now, an AI is happily writing a setup guide for a package that doesn't exist yet. Make of that what you will.

That's your briefing. Take it or leave it — we'll be here either way, tomorrow, same time.