This Week in Coding Agents: October 12, 2026

Week 42, 2026 · Published

Claude Code2.1.296
Codex CLI0.162.1
Gemini CLI0.63.0

The short version

  • Claude Code’s changelog lists 2.1.296 as the top release. npm latest is 2.1.296 (October 9). 2.1.293 makes Claude Haiku 5.5 (claude-haiku-5-5) the default Haiku on the Anthropic API: 1M context, $0.10/$0.50 per Mtok ($0.50/$2.50 for prompts over 100K). /cost and --max-budget-usd now price Sonnet 5.5 cache reads at $0.10 per million tokens (was $0.20).
  • Codex CLI 0.162.1 (October 9, tag rust-v0.162.1) is the current stable. 0.162.0 adds managed Git worktree tools when the worktrees feature is on. 0.161.0 adds /mcp login <name> and makes Daybreak opt-in (--enable cli_daybreak or features.cli_daybreak=true; daybreak=true alone is not enough). The releases list shows 0.163.0-alpha.5 as a prerelease above that stable tag.
  • Cursor has no version number. Remote control for local agents shipped October 6: watch and reply to agents on your computer from the Cursor iOS app. It is on by default except for Enterprise.
  • GitHub Copilot has no version number. Local sandboxing is generally available in Copilot CLI, the Copilot app, and VS Code Agent Host. Claude Haiku 5.5 is generally available. /model in CLI 1.0.94-0 discovers models from a running Ollama instance.
  • Gemini CLI 0.63.0 shipped October 6. The notes I read are mostly fixes. PR #29539 lets Plan Mode in a non-interactive run draft and execute without waiting for you.

Claude Code

2.1.290 (October 5) through 2.1.296 (October 9). I opened the live CHANGELOG.md. The first heading is 2.1.296. npm publish times match those dates.

2.1.296 (October 9). Claude apps gateway policies get a code key (same settings as cli, also applied in Claude Desktop’s Code tab; next to desktop it turns on Desktop gateway mode). Subagent frontmatter and --agents accept autoCompactWindow. CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL pins every workflow agent to one model. CLAUDE_CODE_OVERLOADED_RETRY_MAX_DELAY_MS raises the 529 backoff cap. Read gains allow_large for an oversized text file when context has room. /cost, the status line, --max-budget-usd, and the SDK now price Sonnet 5.5 cache reads at $0.10 per million tokens. MCP tool descriptions sent up front and MCP server instructions default to 4,096 characters (was 2,048). Bash permission checks now prompt on commands that assign BASH_ARGV0 and then use it. Edit and NotebookEdit refuse files that are not valid UTF-8 instead of rewriting non-ASCII bytes. Headless sessions no longer start a folder .mcp.json or plugin MCP server that you switched off for that folder.

2.1.295 (October 8). Command and HTTP hooks accept onFailure: "block": a hook that cannot start, times out, or exits unexpectedly blocks the action. Terminals that implement Program Status Protocol (OSC 7501) can show working, waiting, or done. claude -p prints on stderr what it is waiting for when it stays open after the last turn. forceLoginMethod: "gateway" and forceLoginGatewayUrl work in your own user settings when the machine has no managed settings. CLAUDE_CODE_RETRY_WATCHDOG_MAX_WAIT_MS caps how long unattended retry mode waits out 429 and 529 errors. If a gateway, Bedrock, Vertex, or Foundry refuses the context-1m beta, Claude Code resends without it. Remote MCP in headless and SDK sessions backs off after a long outage instead of reconnecting in a tight loop. --tools and --restricted now apply to built-in tools that register after launch. MCP tool descriptions loaded through tool search are cut at 16,384 characters (was 2,048). Subagents preload at most 32 skills from the skills field.

2.1.294 (October 8). prompt and agent hooks written as instructions (the changelog’s example: “Block commands that…”) no longer allow what they should block. Instruction-style Stop and SubagentStop prompt hooks are less likely to stop early.

2.1.293 (October 7). Claude Haiku 5.5 (claude-haiku-5-5) is the default Haiku on the Anthropic API: 1M context, $0.10/$0.50 per Mtok ($0.50/$2.50 for prompts over 100K). agentType lands on the subagentStatusLine payload. Mods can set isDeferred: false on $.tool.register to list a tool in the prompt from the start. Path-scoped rules and nested CLAUDE.md files now load when Claude views a file with a single-file cat, head, tail, sed -n, or grep in Bash, not only through Read. claude purge deletes what it can, lists the rest, and exits 1 instead of stopping silently. The 2.1.281 auto mode denial message that treated a denial as covering the outcome (not only the exact command) is reverted. The 2.1.290 cloud-session /loop wakeup notice after a container restart is also reverted.

2.1.292 (October 6). claude plugin install --marketplace <source> adds the marketplace (same policy checks as marketplace add) and then installs the plugin. The Agent tool accepts an effort parameter. CLAUDE_CODE_OVERLOADED_RETRY_BASE_DELAY_MS sets the 529 backoff base. Security: PreToolUse hook approvals and auto mode no longer skip the permission prompt for file reads from network (UNC) paths. NO_PROXY is honored for Claude Code’s own API requests when HTTPS_PROXY is set. One-shot claude -p and Agent SDK runs wait for a background command and a scheduled wakeup instead of cutting them off after 5 seconds. Plan mode is restored on resume from the claude --resume picker or /resume. Local stdio MCP connections negotiate protocol version 2026-07-28 by default, including Bedrock, Vertex, and Foundry; MCP_PROTOCOL_NEGOTIATION=legacy opts out.

2.1.291 (October 6). Two regressions: cloud sessions could drop answers to permission prompts (2.1.290), and quitting could lose the last messages of a session (2.1.288).

2.1.290 (October 5). claude attach <name> and claude logs <name> accept part of a session name. WebFetch no longer drops page text past 100,000 characters silently; it reports how much was unread and takes an offset. A project CLAUDE.md, rule, or AGENTS.md symlinked outside the working directories no longer loads under permissions.blockReadsOutsideWorkingDirectories or a Read deny rule. Read deny rules now apply to image paths pasted or dragged into the prompt. Claude in Chrome can no longer be turned on from a project’s settings files; use --chrome, /chrome, or user settings. CLAUDE_CODE_DISABLE_ATTACHMENTS can no longer be set from a repository .claude/settings.json or .claude/settings.local.json. Bash now asks before pyright (no longer treated as read-only) and asks on more forms of ps. The interactive WebSearch budget refills over time (100 calls/hour; CLAUDE_CODE_WEB_SEARCH_REFILLS_PER_HOUR sets the rate, 0 turns it off) instead of ending after 200 calls. A subdirectory AGENTS.md is attached when you @-mention a file under it.

I also opened the memory docs and the permissions page. Memory docs still say Claude Code reads AGENTS.md on its own when there is no CLAUDE.md or CLAUDE.local.md in the working directory or above it (v2.1.277+; default claude-md-or-agents-md). CLAUDE.local.md counts as a CLAUDE.md and blocks direct AGENTS.md load unless you set Project instructions to claude-md-and-agents-md. Permissions still say to set permissions.defaultMode if you do not want the built-in start mode.

Codex CLI

0.160.1 (October 5) through 0.162.1 (October 9). I opened each rust-v* release page. The releases list shows 0.163.0-alpha.5 as a prerelease above the current stable tag rust-v0.162.1. src/data/tool-versions.json records latest as 0.162.1.

0.162.1 (October 9). TUI no longer crashes when an asynchronous question has multiple lines; line breaks and hyperlink destinations stay intact. Startup no longer fails when a running background server’s feature settings differ from CLI defaults. Compatibility checks apply only to explicit command-line feature overrides.

0.162.0 (October 8). When the worktrees feature is enabled, Codex can create and list managed Git worktrees from trusted local projects. Pin tasks in the agent Command Center with p (shared Pinned group when the server supports it). /copy navigates and copies transcript blocks; Ctrl+Insert copies a selection; tui.mouse_scroll_speed tunes mouse-wheel scrolling. URLs are clickable in approval headers, questions, MCP prompts, warnings, banners, and verification prompts, including when a link wraps. Custom Responses-compatible providers can set live web access and remote compaction. Code Mode gets JavaScript helpers for streaming promise results as they settle, plus opt-in ranked tool search. New TUI threads respect server model and reasoning-summary defaults unless you override them at launch. apply_patch keeps existing CRLF line endings without an opt-in. Windows releases include a signed PowerShell installer.

0.161.0 (October 7). The notes restate GPT-6.1 Sol as the default model in the bundled catalog and in Amazon Bedrock catalogs (same claim as 0.159.1 last week). Bedrock gets multi-agent V2 and Ultra reasoning on compatible models; Bedrock Mantle accepts AWS GovCloud regions. Sign in to an MCP server from the TUI with /mcp login <name>. Voice conversations let you pick microphone, speaker, and input channels, saved locally. Daybreak is opt-in through --enable cli_daybreak or features.cli_daybreak=true. daybreak=true alone is not enough. By default, Daybreak controls and indicators stay hidden, /daybreak is unavailable, and automatic Cyber routing is omitted, including for saved Daybreak threads. Opt-in routing needs an eligible ChatGPT sign-in, the OpenAI provider, and advertised model or program support. codex exec --cyber-access-program (TypeScript SDK: cyberAccessProgram) selects a Cyber access program for one turn and stays available with cli_daybreak off. Approved filesystem escalation can grant broader writes while denied reads and network restrictions stay. Auth docs now mention keyring storage instead of implying credentials always live in auth.json.

0.160.1 (October 5). Remote stdio MCP servers keep SYSTEMROOT, TEMP, and TMP when you set remote environment variables, so a Unix host can still pass the Windows executor’s startup environment.

Cursor

No version number. I opened the changelog and the October 6 post.

Remote control for local agents (October 6). See and reply to local agents from the Cursor iOS app. Remote Control is on by default for everyone except Enterprise organizations. Download the iOS app, sign in, tap the computer, and approve the pairing request in the desktop app. Agents stay on your computer. The computer has to stay on and online. “Keep this computer awake” lives under Remote Control in desktop settings; the page says the machine needs to be plugged in with the lid open. Enterprise admins turn it on in Org settings > Security and identity > Remote control. It does not require cloud agents.

GitHub Copilot

No version number. I opened each changelog URL below.

New controls and chat improvements in Copilot for JetBrains (October 10). Enterprise admins can set any available Copilot agent model as the default for new conversations through managed settings. Diagnostic intention menus gain a Fix action (agent mode when available, otherwise ask). A new MCP setting disables automatic server startup for Copilot and Claude. Chat groups messages by turn and lets you copy or edit a user message. JetBrains IDE 2025.1 is no longer supported; you need 2025.2 or later.

GitHub Copilot weekly releases, October 5 (October 9). Recap: Haiku 5.5 for Pro through Enterprise; local sandboxing generally available in CLI, the app, and VS Code Agent Host; the app can use separate GitHub accounts for the Copilot license and for repositories; CLI /model discovers local Ollama models; VS Code 1.141 shows agent sessions side by side and adds “Open worktree cleanup” in chat.

Copilot code review: organization billing and controls (October 8). Organization owners can bill a licensed member’s code reviews to the organization’s cost center (needs AI Credits paid usage) instead of that member’s quota. Organization owners and repository admins can require that review requests come from a license the org or enterprise issued. Turned on at the organization level, repository admins cannot turn it off.

Claude Haiku 5.5 (October 7). Generally available to Pro through Enterprise. Picker coverage: VS Code, Visual Studio, Copilot CLI, coding agent, the Copilot app, github.com, GitHub Mobile, JetBrains, Xcode, Eclipse. Provider list pricing under usage-based billing. New models stay enabled unless an admin turned off the global default or disabled this one.

Purpose-built model for leaked secret detection (October 7). Existing AI-detected Password alerts move to the new model at no extra charge for GHSP and GHAS. AI-detected secrets in push protection is private preview. /security-review secret checks in Copilot CLI and the Copilot app are coming in private preview and will consume GitHub AI Credits. Those new checks stay off until you opt in. Agents should not enable credit-consuming features without authorization.

Local sandboxing generally available (October 7). Copilot CLI, the Copilot app, and VS Code Agent Host. Powered by Microsoft eXecution Container (MXC). Limits files, network, Git credentials, and GitHub CLI credentials. Enterprise-managed settings can require it. Included with Copilot at no extra cost.

Discover local models in Copilot CLI (October 7). Starting in CLI 1.0.94-0, /model lists supported models from a running local Ollama instance next to configured and cloud models. Discovery does not install a runtime or download a model. The model must already be installed and must support tool calling and streaming. Choosing a local model does not turn on offline mode. Offline mode stays COPILOT_OFFLINE=true. A remote provider can still receive prompts over the network, even in offline mode.

Update your IDE to restore agent activity in Copilot usage metrics (October 6). SDK-based agent sessions stopped identifying which IDE they came from, so usage metrics dropped agent activity or counted some of it as Copilot CLI. Billing was not affected. The fix is in VS Code 1.139.0 and later. Visual Studio 18.12, JetBrains, Eclipse, and Xcode are still rolling out, expected through November 2026. Missing data cannot be backfilled. Copilot CLI users do not need to update.

Gemini CLI

0.63.0 (October 6). I opened the v0.63.0 release. The releases list shows that tag as the current stable release. Nightly v0.65.0-* tags and v0.64.0-preview.1 sit above it.

The notes I read are mostly fixes: a retry progress indicator during connection recovery, a clearer error when MCP enablement config is missing versus malformed JSON, paused stdin restored after capability detection, bounded tool output in long agent loops, temp-directory cleanup when a background shell exits, and an auth-loop fix. PR #29539 changes Plan Mode in non-interactive runs (gemini -p "..." -y is the example on the PR): the agent drafts and executes the plan instead of stopping to wait for confirmation.

What this means for your setup

  • If you type /model haiku in Claude Code after 2.1.293, you get Haiku 5.5. Multi-model routing still prices Haiku 4.5 at $1/$5 and Sonnet 5, and does not name Haiku 5.5 or Sonnet 5.5.
  • Claude Code’s /cost and --max-budget-usd now count Sonnet 5.5 cache reads at $0.10 per million tokens. Recheck any budget you set against that figure.
  • Instruction-style prompt and agent hooks that were failing open are fixed in 2.1.294. If you wrote hooks as English instructions, retest them.
  • onFailure: "block" (2.1.295) is the hook setting I would put on a deny hook in CI. Without it, a hook that times out still lets the action through.
  • --bare still skips auto-discovery. After 2.1.292, --tools and --restricted also cover built-in tools that register late. Keep --permission-mode dontAsk on CI jobs. Permissions and unattended runs still says -p starts in Manual. Unattended agents in CI already passes dontAsk.
  • Project settings can no longer turn on Claude in Chrome or set CLAUDE_CODE_DISABLE_ATTACHMENTS (2.1.290). Put those in user or managed settings, or pass --chrome.
  • Claude Code already reads AGENTS.md when no CLAUDE.md or CLAUDE.local.md sits in the working directory or above it. One AGENTS.md, New repo agent setup, and Context is a budget still describe a required @AGENTS.md bridge. A CLAUDE.local.md you add for personal notes will hide AGENTS.md unless you set claude-md-and-agents-md.
  • If you want Codex Daybreak or Cyber routing, set --enable cli_daybreak or features.cli_daybreak=true. daybreak=true is not enough.
  • Codex MCP sign-in from a running TUI is /mcp login <name> (0.161.0). Worktree create and list tools need the worktrees feature on (0.162.0).
  • Cursor Remote Control is already on unless you are on Enterprise. Pair the iOS app if you want it. Enterprise admins who want it go to Org settings > Security and identity > Remote control. Leave it off there if phones should not reach local agents.
  • Copilot Business and Enterprise admins: enable Haiku 5.5 if your model policy does not pick up new models. Turn on local sandboxing, or require it in managed settings, before you give agents a wider allowlist. JetBrains users need IDE 2025.2 or later. VS Code users who care about agent usage metrics need 1.139.0 or later; earlier SDK agent activity is gone.
  • Gemini CLI users who run Plan Mode with -p and -y should expect the agent to execute the plan after 0.63.0 instead of stopping for a confirmation.

Pages we updated this week

None this week.

Sources