16,893 measured sessions: Claude Code, Codex and Cursor pick the same tool only 42% of the time

Armature ran 16,893 coding sessions, 5,292 of which were valid, across 75 repositories, 10 languages, 1,163 prompt variations and 4 user personas, rotating E2B, Blaxel and Daytona sandboxes to kill provider bias. Nobody has published a controlled study at this scale before. Armature

Headline: the three agents converge on the same tool in only 42% of cells. Which agent your team standardizes on silently picks 58% of your dependencies.

They also decide differently. Codex uses web search in 94% of sessions. Cursor 67%. Claude Code about 30%, otherwise pulling from training data. So Codex reflects whatever ranks well right now and Claude Code reflects what was popular at its cutoff. Those are different failure modes, not different levels of quality. One of them will confidently install something abandoned eight months ago; the other will install whatever won SEO last quarter.

The mention-versus-selection gaps are the part I'd put in front of anyone marketing a dev tool. LangChain was cited 194 times and chosen 4. PayPal was mentioned 139 times and selected zero, with Stripe taking those decisions at a 90% win rate. Neon takes 66% of database picks despite Supabase getting 242 mentions.

Getting named in the model's output is not the same as getting installed. Your docs can be famous and your package can be dead in the actual decision.

Now connect that to what Bruce Schneier posted on September 4. An Israeli research team scanned 6,214 live domains belonging to defense contractors, Fortune 500 companies and tech firms, and found 120 unclaimed package names referenced in llms.txt files. They registered some of the names, hosted test packages, and got phone-home callbacks from Fortune 500 networks within an hour. Claude, Codex and Hermes agents had executed the code. Schneier's verdict: "The trust model is broken. Agents treat vendor docs as ground truth and don't question them, and neither do the humans supervising them." Schneier on Security

Armature says the agent picks your dependencies. Schneier says the picking mechanism can be poisoned by editing a text file on a vendor domain. Those are the same pipeline described from opposite ends.

Two things to do this week. Pin your dependency choices in CLAUDE.md or AGENTS.md so the agent stops making the call, because a 42% agreement rate across agents is an agreement rate with your future self too. And audit what your agent installs from vendor documentation, since llms.txt is now a supply-chain input that nobody's scanning.