An issue filed against OpenAI's Codex command line this week reports that the installer leaves a persistent background process behind, one that updates itself on its own schedule, with no opt-in and no prompt. The thread is mostly plumbing detail: stray service units, a listening port, a version number that moves without anyone asking. The operator consequence fits in a sentence. Software nobody reviewed is executing on the machine that holds the company's production credentials, and the company cannot say which version of it ran last night.
The vendor matters less here than the category. Developer tooling is the last large class of software inside a company that never acquired an install-review regime. Browser extensions got galleries, permission disclosures, and enterprise allowlists. Phone apps got stores and per-permission prompts. Software bought as a service got procurement questionnaires, security reviews, and a signature on a page that assigns liability. Developer tooling got a shell command pasted out of a README.
I read the trade press through the browser-toolbar years of the mid-2000s as they happened, and the framing then was distribution: who owned the search box, who paid whom for the bundle, how many toolbars one consumer PC could stack before it stopped booting cleanly. The resident updater that shipped alongside each of them was treated as plumbing, beneath the story. The review regime showed up years later, and it came from the platform owner rather than any tool vendor. Google built an extension gallery and a permissions model because the tool vendors were never going to volunteer for one.
Agent command lines sit somewhere a toolbar never did. A toolbar lived in a browser next to webmail. An agent CLI lives next to deploy keys, cloud credentials, a local copy of customer data someone pulled while debugging, and an SSH config that reaches production. Jensen Huang, asked by Tom's Hardware why NVIDIA keeps writing software: "You sell a chip one time, but when you build software, you maintain it forever." A resident self-updater is that maintenance relationship, running on hardware the vendor does not own, inside a credential boundary the vendor cannot see.
Two other threads from this week push the same way. The model stack keeps relocating onto hardware the company owns. A configuration posted this week runs a 27-billion-parameter Qwen model with vision and a very long context window on a single 16 gigabyte consumer graphics card at usable speed, and Intel has now named its inference card the D-series with up to 480 gigabytes of memory, a bet on capacity over raw throughput. The question a security review was built to ask, what does the vendor do with our data after we send it to them, stops being the interesting one when the model is running on a workstation under somebody's desk.
The other thread is vertical. Z.ai shipped GLM-Legal this week, a domain-specialized open model, following clinical models from openmed and two code-specialized releases inside the same five days. Four verticals from four independent labs. The population that unblocks is the regulated-domain team that could never send documents to a general API in the first place, and the way that team will use it is self-hosting. Privileged model-serving software lands inside compliance boundaries, administered by people whose job description says nothing about software supply chain.
Three threads, and one unglamorous artifact at the end of them. A list with a name attached to it: which agent tools are installed on which machines, which of them keep a process alive after the terminal closes, which of them change their own version without telling anyone, and who said yes.
This lands as a procurement question rather than an engineering preference because of the split between who takes the benefit and who prices the risk. The engineer who installs an agent CLI gets a faster afternoon and has no way to price a supply-chain exposure. The person who would sign a breach notification prices that exposure for a living and never sees the install. The toolbar era lived in exactly that gap, and it closed only when the platform owner put a review surface between the two.
Auto-update has a real defense, and the Codex maintainers would make it: an agent CLI frozen at an old version with a known hole hurts most users more than one that quietly patches itself overnight. The argument is correct about which failure is more common. It is also an argument about whose risk model applies by default, and right now it applies silently, on machines whose owners were never asked.
The work this implies is small enough to be embarrassing. At five people it is one afternoon of asking each machine what it keeps running in the background and writing the answers down. At fifty it is the same afternoon plus a name attached to the list, because the version a company believes it is running and the version actually executing have come apart, and the install record is the only thing that closes the distance.
The Codex maintainers have the easier half. A flag, a default, and a line in the install output saying that a background process is being created would turn the install into a decision instead of a surprise. The harder half belongs to whoever runs engineering at a company with these tools on its laptops and cannot say today which of those laptops carries a resident agent process, or who approved it. The answer is already sitting on the machines. Somebody has to be given the afternoon it takes to go collect it.