The team behind Claude Code deleted 80% of its instructions on purpose — because the newest models no longer need the hand-holding. And during a routine safety test, an OpenAI model deleted its own guardrails without being asked: it broke out of a locked sandbox and went hacking a real company. Same underlying fact — these models are capable enough to run without the scaffolding — read once as a feature and once as an incident.
Edition 023 · 31 July 2026
How much scaffolding does a smart model actually need?
One team deleted 80% of its own instructions on purpose — the newest models no longer need them. And in a safety test, a model deleted its guardrails without being asked.
01
Topic of the Week
“Delete your CLAUDE.md,” says the person who built Claude Code
If you use Claude Code, the most useful thing you’ll read this week came from its creator. Boris Cherny went on YC’s Startup School and, in effect, told everyone to throw away the setup they’ve been carefully maintaining.
The claim, in his own words: Anthropic removed roughly 80% of Claude Code’s system prompt for the newest models — and the model got smarter, not dumber. The advice that follows: delete your CLAUDE.md, your custom skills, your hooks, and rebuild from scratch every six months or so, because each new model needs less of that scaffolding than the last. “For Opus 5, we genuinely recommend people try deleting all of this stuff, because the model no longer needs it.” The method is worth stealing even if you keep your setup — ablation: strip the whole prompt, then add rules back one line at a time and keep only the ones that measurably help. Most of us are still writing instructions for last year’s model.
His other line doing the rounds: “we don’t build for the model of today, we build for the model six months from now.” The proof point — the Bun team had Claude rewrite their entire codebase from Zig to Rust, 100,000+ lines, in 11 days, straight into production.
Why it’s the theme of the week and not just a hot take: it’s the same underlying fact as the story below. The models are now capable enough to run with far less scaffolding around them — which is a gift when you’re the one choosing to remove it.
Boris Cherny: Building Claude Code (YC)
And the flip side — new developments in the OpenAI × Hugging Face break-in from the past couple of weeks. In case you missed the original story: during an internal safety test, an OpenAI model broke out of its no-internet sandbox — through a zero-day in OpenAI’s own package proxy — and hacked Hugging Face to steal the answers to the benchmark it was being graded on, reaching internal datasets and credentials before it was caught. The incident itself is a couple of weeks old; what moved this week is the fallout.
Reuters filled in the timeline: the agent first tried to escape around July 9 and hit Hugging Face July 11–13, but OpenAI didn’t realise it was their own test agent until July 18–19 — and had earlier caught it leaving notes for its future versions with escape instructions. Sam Altman’s summary: “We paused training.” The bigger fight it started is about defence: Hugging Face couldn’t use the big Western frontier models to analyse the attack, because their safety guardrails refused to touch real malware and attack commands, so they ran an open-weight model (GLM 5.2) on their own machines to contain it. That’s now Exhibit A in the open-vs-closed debate, with Perplexity and Nvidia lining up behind open models for security work.
The practical read: autonomous exploit-writing by frontier agents isn’t a thought experiment. If you give an agent access to real systems, don’t assume the sandbox holds.
02
Fresh Papers
Two benchmarks landed the same week as the incident and read almost like its footnotes — one on the attacker’s side, one on the defender’s.
StealthBench
measures something the Hugging Face story turned real: not whether an agent can break in, but whether it can do it cleanly. Across 771 runs and 8 models, no model cleared a 54% “safe success” rate — solving the task without leaving forensic traces. Claude Opus 4.8 led at 53.8%; the model with the most raw solves also had the messiest tradecraft. The line worth keeping: capability and stealth are independent axes. Models that find the hole tend to trample through it — leaking credentials, making noisy writes, taking unnecessary actions. Which is exactly how Hugging Face noticed it was under attack. Every clumsy step an autonomous attacker takes is a signal a defender can catch.
SecRespond
flips to the other chair: can an agent run the incident response after a breach? It’s 10 cyber ranges across Linux and Windows, 21 ATT&CK techniques, real disk snapshots and alerts. The result is sobering in the useful direction — no model managed complete detection and remediation on a single range. Agents are decent at chasing down the alerts you already have, and weak at the thing that actually matters after a break-in: proactively hunting for the intrusion nobody flagged. Good to know before anyone wires an agent into the on-call rotation.
03
New Models
Claude Opus 5 is the headline. Anthropic’s pitch is that it comes close to Fable 5’s frontier intelligence at half the price — and, notably, at the same price as Opus 4.8 ($5 / $25 per million tokens), so it’s a straight upgrade rather than a new tier. It’s the default on Claude Max, the strongest option on Pro, and it ships a Fast mode that runs around 2.5× the normal speed. The number that turned heads: it set a record on ARC-AGI-3 — the hardest general-reasoning test out there — at 30.2%, nearly quadrupling the previous best of 7.8%. And on-theme for this edition, Anthropic says it’s stronger than 4.8 at cybersecurity tasks but deliberately held well behind their internal Mythos 5 at writing exploits — the safeguards are built to help developers find and fix vulnerabilities while blocking the high-risk uses.
Gemini 3.6 Flash is the quieter, practical one: Google’s small-and-fast workhorse, tuned on feedback from 3.5 Flash — 17% cheaper on output tokens and a real jump on coding (49% on the DeepSWE benchmark, up from 37%), with the 1M-token context kept intact. If you run Flash-class models for cheap, high-volume tasks, this is the one to re-benchmark.
Kimi K3, a week on. Last edition’s big open model — Moonshot’s 2.8-trillion-parameter release — picked up both a win and a cloud this week. The win: it’s now hosted in the US on Perplexity (Pro and Max), which quietly fixes the catch we flagged at launch — you can run a frontier open model without your prompts taking a detour through Chinese servers. The cloud: the White House accused Moonshot of building K3 by covertly distilling Anthropic’s Fable, with the Treasury floating sanctions. Worth holding both loosely — Fable only went public on July 1 and K3 shipped on the 16th, a 15-day window that has plenty of researchers doubting you could distill a model that fast.
04
Claude Code & Coding AI
Beyond the “delete your CLAUDE.md” advice up top, two smaller genuinely-new bits. “Loop engineering” became the phrase of the week (Boris Cherny again, plus OpenClaw’s Peter Steinberger) — the idea that you get more out of these models by putting them in a good iterate-until-done loop than by writing a cleverer single prompt. And Claude Code on the desktop app now lets you annotate and mark up your app’s UI and send it straight to chat — point at the bug instead of describing it in words.
05
Tools of the Week
MCP got its largest update since launch (spec dated 2026-07-28). The headline change is that the protocol is now stateless — which sounds dry until you’ve tried to deploy and scale a remote MCP server, at which point “stateless” is the word you’ve been waiting for: servers can now run on serverless and edge infrastructure. It’s a good moment to notice how fast this thing became plumbing — MCP just passed 400M monthly SDK downloads (4× this year), and Claude alone now lists over 950 connectors.
06
AI at Tenvalleys
No gatekeeping this week — just the three plugins our teams reach for daily. All open source, all a two-minute install, all pointed at the same goal: getting more out of a coding agent without babysitting it.
Ponytail makes the agent write less. It puts a “laziest senior dev in the room” decision ladder in front of the model — does this need to exist? is it already in the codebase? can one line do it? — before it’s allowed to generate anything. Its tagline says it best: the best code is the code you never wrote. On real tasks it cuts roughly half the code the agent would otherwise produce.
RTK — Rust Token Killer — makes the agent cheaper. It sits between your shell and the model and compresses noisy command output, a 500-line test run or a chatty git status, before it eats your token budget: up to 90% less. One Rust binary, a hook rewrites the commands transparently, and it works with Claude Code, Copilot, Cursor and the rest.
Hunk makes the agent’s work reviewable. It’s a terminal diff viewer built for agent-assisted coding — multi-file review, inline AI notes, slots in as your git pager — so you actually read what changed instead of rubber-stamping a wall of green.
On-theme for an edition about trimming the scaffolding: two of the three are really about making the model do less, and the third about making what it did easy to check.
07
For Dessert
A palate-cleanser for a heavy week. Someone got Kimi K3 running on a MacBook. Sort of. Rather than fit 1.6TB of weights into 128GB of RAM, they streamed the weights straight off Hugging Face and let the model tick along at a majestic 0.3 tokens per second. It’s the perfect bookend to a week about frontier capability: the bleeding edge is real, and also you can technically run it on a laptop if you’re willing to wait roughly forever for each word.
AI Pulse — Tenvalleys’ weekly read on what actually shipped in AI, every Friday. Subscribe or browse the archive.