Summary
The preview adds destination validation for web-fetch utilities and enforces RFC 9207 issuer identification in MCP OAuth flows. It also isolates temporary directories, tightens extension and symlink boundary checks, requires consent for environment changes and removes a hard-coded CrUX API key.
Why it matters
Security boundaries around tools, extensions and local files are becoming foundational requirements for practical coding agents.
Related coverage
- Qwen Code 0.23.2 adds resumable multi-agent controls and safer remote sessions
- OpenAI Agents Python 0.22.2 adds image-tool support and closes a sandbox race
- GitHub Agentic Workflows 0.88.7 tightens agent output and MCP policy handling