A new public-domain labeling scheme called 0rwx showed up on Hacker News on November 7, 2026, framed as a Unix-permissions metaphor for how much large language models touch your work. The 0RWX Framework site is clear that this is not a security product: it does not set file ACLs, gate MCP tools, or replace Claude Code permission prompts. It is still useful for developers who run coding agents, because it names the moment you stop reading generated code before it merges, ships, or runs with your credentials. That moment is exactly when sandboxes, approval discipline, and local observability stop being optional. This post walks through each 0rwx level as the originator defines it, maps it to common agent harnesses, and lists concrete checks that match each level.
TL;DR
| Question | Short answer |
|---|---|
| Am I affected? | Only if you use AI on code or creative work and want honest attribution labels, or if you run agents at EXECUTE-style autonomy without extra controls. |
| Is there a fix? | 0rwx needs no patch. At high autonomy, the fix is yours: sandboxing, review gates, secret hygiene, and monitoring. |
| Does data leave my machine? | 0rwx itself is a static site and logos. Agent tools at W or X levels may send prompts and code to vendor APIs per their own settings. |
| Is 0rwx the same as chmod for agents? | No. It is a label for how much you scrutinized AI output, not an enforcement mechanism. |
| What should I do today? | Pick the level that matches your real workflow, then apply the security table below for that level, especially before enabling auto-accept or vibe coding. |
What 0rwx actually is
The introduction on 0rwx.com says we need new language to talk about large language models, and that the difference between the four levels is not necessarily about what tool you use, but your ability to scrutinise the generated work. The maintainer uses the framework to discuss their own and others' work with less judgment and confusion, and releases the level logos into the public domain.
The four levels on the primary page are:
| Symbol | Label on site | Human stance (per site) | Example domains on site |
|---|---|---|---|
| 0 | ZER0 — "I think" — HAND MADE | AI cannot read or write your work | Painting with paint, playing music, reading docs yourself |
| R | READ — "I make" — AI INSPIRED | AI has read-only permissions | You write the code; reference images; chord inspiration |
| W | WRITE — "I fix" — AI COLLABORATION | AI has read-write permissions | You read the code; generated collages; loop generation |
| X | EXECUTE — "I curate" — AI MADE | You can no longer read your work | Vibe coding; image generation; song generation |
Read that table literally. READ here means the human still authors; AI may advise on material it can see. WRITE means the human still reads changes before they stick. EXECUTE means the human may only curate or test later, not line-by-line review. None of this changes OS permissions, git hooks, or API keys. It is a vocabulary for attribution and scrutiny, similar in spirit to creative-commons labels, but oriented toward how much cognitive control you retained.
That distinction matters for security readers. Teams already argue about whether a repo is "AI generated." 0rwx gives shorthand. Security teams care because EXECUTE-level workflows are where prompt injection in issue bodies, malicious skills, and approval files that store secrets verbatim do their damage: the human is not in the read path when the agent acts.
How each level maps to coding agents
Because the framework is tool-agnostic, you map levels by scrutiny, not vendor name.
Level 0 — no AI on the artifact
You wrote the commit without model assistance on that artifact, or you used AI only outside the repo (for example, a spell checker in another app that never saw the tree). Security baseline is ordinary developer hygiene: dependencies, CI, code review. No agent-specific surface beyond whatever editors you already run.
Level R — read-only assistance
Typical patterns: asking a chat model about an error without pasting the whole repo, using documentation lookup, or a Copilot-style chat that answers questions but does not apply patches. Risk is mostly data you choose to paste into a third-party API. Controls: minimize secrets in prompts, use enterprise agreements where required, and keep API keys out of logs.
Level W — collaborative edits you still read
This matches inline completion, small refactors you accept in the editor, or an agent that proposes a diff you review before save. You are still the reader of record. Security focus shifts to supply chain inside the diff: typosquat dependencies, unexpected curl | bash in suggested scripts, and skills that change behavior silently. Use normal PR review; treat AI authorship as untrusted input.
Level X — execute without reading first
The site lists vibe coding under EXECUTE. That aligns with agentic sessions: Claude Code or Codex with broad Bash and file tools, auto-accept, or "don't ask again" rules that let the agent run without you inspecting each command. Here the effective permission model is whatever the agent has on your user account, not the 0rwx label.
Anthropic's research post on Claude Code sandboxing describes why filesystem and network isolation matter when the agent works more autonomously: fewer prompts, but a larger blast radius if context is poisoned. The OWASP Secure Coding with AI cheat sheet lists the same class of risks in 2026: agents that install packages, edit CI, push branches, and read MCP responses as instructions. NVIDIA's guidance on sandboxing agentic workflows adds egress control, blocking writes outside the workspace, and treating hooks and local MCP configs as out-of-band persistence paths.
If your honest self-assessment is EXECUTE, assume X in 0rwx equals full user privileges until you prove otherwise with sandbox, policy, and review gates.
EXECUTE level on coding agents (where controls bite)
Image: 0RWX Framework
The EXECUTE badge is the one security teams should recognize on READMEs or demo reels. It does not warn attackers; it warns you that the author may not have read every line.
Concrete EXECUTE-style behaviors in coding harnesses include:
- Auto-accept or bulk approval — Permission rules that skip prompts turn the agent into a script runner with your shell. Our write-up on Claude Code
settings.local.jsonshows how "don't ask again" can persist entire commands, secrets included, in the project tree. - Multi-file refactors without a human diff — The agent renames, deletes, and adds files faster than review. That is where destructive commands and credential exposure in tool output show up in telemetry long after the session.
- Networked tool use at scale — Fetching URLs, calling MCP servers, and posting to APIs let indirect prompt injection move from content to action. See AI agent web and transport security for how untrusted fetches become instructions.
- "Ship it" culture — Social pressure to merge agent output is an EXECUTE workflow even if the harness still asks permission sometimes. The label is about your scrutiny, not the button count.
Mitigations that match EXECUTE risk (from vendor and community guidance cited above, not from 0rwx itself):
- Enable OS-level or harness sandboxing where available, with both filesystem and network boundaries.
- Avoid long-lived "allow forever" rules for Bash, especially on commands that touch secrets or production.
- Require human review before merge to protected branches; treat agent branches like untrusted forks.
- Run the vibe coding security checklist on auth, dependencies, and CI changes.
- Keep a local audit trail of tool calls. Beam's model is described on how Beam watches agents: NDJSON events on device, redaction before storage, optional PreToolUse deny for Claude Code and Codex in enforce mode. That is observability, not sandboxing.
0rwx does not tell you to do any of this. It only gives you vocabulary to admit you are operating at EXECUTE so teammates and auditors know review expectations.
What developers are saying
The Hacker News thread for this story had little technical debate as of November 7, 2026. Commenter robrain pointed to a No Boilerplate video that describes the concept from the originator's side and called those videos worth watching. That is attribution context, not a reproduction of the framework in a coding repo. We did not treat the video as a primary source for version or security claims.
For a wider angle on keeping judgment while agents do more of the typing, explainx.ai has Addy Osmani's essay on cognitive surrender and Claude Code as news background. Beam focuses on mechanism and lockdown.
What this means if you run AI coding agents
Use 0rwx as a self-label, not a control plane.
1. Label repos and PRs honestly. If most merged code came from an agent session you did not read file by file, say EXECUTE in the PR description or README badge, and pair it with a review policy. Mislabeling as WRITE when you did not read the diff creates compliance and incident-response gaps.
2. Match harness settings to the label you want.
- To stay near W, keep inline apply or diff review, disable auto-accept on unfamiliar trees, and reject "don't ask again" on networked or credential-bearing commands.
- If you must run X for speed, turn on sandboxing in Claude Code per Anthropic's documentation, scope MCP servers narrowly, and use organization managed deny rules where available.
3. Check versions and config, not the badge.
claude --version
Inspect .claude/settings.local.json and project .claude/settings.json for broad allow rules. Search git history if those files were ever committed, as described in the Apiiro-related post linked above.
4. Separate attribution from assurance. A HAND MADE (0) label does not prove absence of AI; an AI MADE (X) label does not prove malice. Assurance still comes from review, tests, and monitoring.
5. Teach reviewers the metaphor. When someone says "READ-only Copilot," they mean they still typed the logic. When someone says "X vibe coded this service," your review queue should expand, not shrink.
How Beam handles this
Beam does not implement 0rwx and does not stamp events with R or W. It watches what supported agents do on your machine: tool calls and flagged command patterns. Separately, beam scan runs offline heuristic checks on skill or MCP config files without executing them. Workspace policy modes (observe, advisory, enforce) can deny baseline-blocked tools or commands through Claude Code and Codex PreToolUse hooks when a valid cached policy is present; missing or expired cached policy is fail-open, and the deny is not a kernel sandbox.
That helps most when your workflow drifts into EXECUTE: you may not read every file, but you can still catch destructive commands, credential-shaped strings headed to storage, and risky installs if you run in enforce mode and review flags. Beam cannot prove you scrutinized output, and it cannot replace git review or vendor sandboxing. Where EXECUTE sessions overlap untrusted repos, pair Beam with the checklist in stop Claude Code dangerous commands and keep everything local-first if cloud telemetry is off limits for your team.
Limits of the metaphor
Unix rwx on files is enforced by the kernel. 0rwx on creative work is enforced by social convention and honest labeling. A malicious contributor can paste any badge. Regulators and customers may soon ask for both: a scrutiny label and evidence (logs, reviews, test results).
Do not confuse 0rwx with:
- Claude Code permission modes — real allow/deny lists and sandbox toggles.
- MCP capability scopes — what a server exposes to the agent.
- Beam workspace policy — organization rules cached on the device.
The metaphor is pedagogical. The controls remain in those systems.
Frequently asked questions
Is 0rwx a technical permissions system for AI tools?
No. According to the site at 0rwx.com, it is a labeling framework so people can describe how much AI touched a piece of work and how much the human scrutinized it. It does not change what an app can read or write on your machine.
What does the EXECUTE (X) level mean for coding agents?
On 0rwx.com, X means you may not be able to read the work before it ships, with examples like vibe coding and full track generation. In practice that matches agentic harnesses that edit many files, run shell commands, and push changes with little review, which is where sandboxing and monitoring matter most.
Can I use 0rwx levels instead of Claude Code permission settings?
No. Claude Code permissions, sandboxing, and organization managed settings are the actual controls. 0rwx is vocabulary for how you work, not a substitute for deny rules, git review, or secret hygiene.
Which 0rwx level matches GitHub Copilot inline suggestions?
The framework says the difference between levels is scrutiny, not the brand of tool. Inline suggestions you accept line by line usually sit around READ or WRITE because you still read the diff. Autonomous agent sessions that batch edits without review align with EXECUTE.
Does Beam implement 0rwx?
No. Beam does not label repos or enforce 0rwx. It records tool use locally, scans skills and MCP configs heuristically, and can deny risky Claude Code or Codex PreToolUse calls when workspace policy is in enforce mode.
Where did 0rwx come from?
The maintainer describes 0rwx.com as an attempt to give domain experts clearer language for AI-assisted creative work. The logos are released into the public domain on that page. Hacker News discussed it on November 7, 2026.
Related reading
For a large-scale case study of widening agent autonomy without matching controls, see Meta Project OT and the reported 40% rise in security incidents.
- Vibe coding security checklist
- Stop Claude Code dangerous commands
- Claude Code settings.local.json and secrets on GitHub
- MCP server security review
- How Beam watches agents
- Sources: 0RWX Framework, Anthropic Claude Code sandboxing research, OWASP Secure Coding with AI
Framework definitions and vendor guidance reflect public pages as of November 7, 2026, and may change. Beam is a local prototype; its deny is hook-based and its scanning is heuristic.