TAG
#sandboxing
Stories connected through a shared idea, actor, technology or theme.
Codex CLI 0.164.0 adds enterprise MCP authentication and reusable presetsThe release adds ten numbered /presets slots, richer /model and /permissions arguments, terminal image previews and a default Amazon Bedrock setup wizard. It also masks credentials in supported remote shell operations and strengthens session recovery and sandbox checks.→GitHub Copilot CLI adds agent-scoped hooks and safer autopilot handlingThe release adds agent-scoped declarative hooks, inline image rendering and more robust sandbox settings. It also changes unattended autopilot behavior so a pre-tool hook asking for approval is denied instead of leaving an invisible permission prompt.→GitHub Agentic Workflows defaults read-only runs to no network accessThe release disables network access by default for read-only workflows. It also records richer session provenance, plugin installations and MCP configuration, improving auditability of agent-driven automation.→Claude Code 2.1.290 adds richer agent hooks and safer plugin controlsThe release adds tool-call and subagent identifiers to plugin hooks, introduces named-session attach and log commands, and expands managed-agent onboarding. It also fixes MCP attribution, symlink escapes, sandbox approvals, scheduled-task recovery and several remote-session failure modes.→GitHub Copilot CLI 1.0.89 expands model choice and MCP resilienceThe release adds GPT-6 Sol, GPT-6 Luna and Claude Opus 5.5 to the model picker when available, and reads Claude Code rule files as custom instructions. It also improves MCP OAuth scope handling, tolerates invalid neighbouring MCP entries, follows repository pull-request templates, and strengthens sandbox and session behaviour.→Codex CLI 0.158 hardens MCP, sandboxing and terminal approvalsThe release adds support for pre-registered MCP OAuth clients and bearer-token authentication for exec-server WebSocket connections. It also strengthens approval behaviour and fixes Windows, Linux and macOS sandbox and path-handling issues.→Qwen Code 0.24.2 adds a Linux sandbox foundation and durable workflow controlsQwen Code 0.24.2 introduces an internal bwrap-based Linux sandbox foundation with structured process supervision and confined workers. The release also adds persisted workflow retry and rerun, concurrent browser-use sessions sharing a Chrome profile, and explicit trust for undecided workspaces.→Claude Code v2.1.273 adds gateway telemetry hints and safer agent-session recoveryThe release adds request headers for gateway routing and observability, MCP disconnect notifications, and the ability to fork remote-control sessions into local background sessions. It also fixes permission-analysis bypasses, managed MCP settings, background-agent result delivery, context accounting and artifact publishing.→Gemini CLI 0.60 hardens MCP OAuth, sandboxing and extension boundariesGemini CLI 0.60 enforces RFC 9207 issuer identification in MCP OAuth and improves web-fetch destination validation and connection routing. It also isolates macOS sandbox directories, validates extension paths and workspace boundaries, checks configuration ownership, sanitises environment changes and preserves provenance metadata for untrusted tool output.→Claude Code 2.1.271 adds remote fast mode and tighter agent controlsThe release applies fast mode to permitted cloud and self-hosted Remote sessions, adds per-command allowed domains in sandboxed auto mode and introduces hash-specific approval for plugin installation and updates. It also fixes MCP OAuth registration handling, session resumption, permission checks and background-command duplication.→Qwen Code nightly hardens local-file bridges and agent process controlsThe release closes trust-gate and bystander gaps in the local-files bridge, rejects an unlimited cgroup sentinel for ACP child heaps and adds transient network retries. It also adds an explicit VS Code session-source switch, improves hook handling and reaps surviving Windows hook process trees.→Qwen Code 0.23.2 adds resumable multi-agent controls and safer remote sessionsThe release carries budget and progress guidance into continuation prompts, journals failed agents, adds browser-task notifications and separates planning from execution permissions. It also adds token-based remote starts with QR pairing, same-origin shell access and improved content filtering.→OpenAI Agents Python 0.22.2 adds image-tool support and closes a sandbox raceVersion 0.22.2 adds support for current image-generation tool options and prevents symlink races in the UnixLocal file API. It also resets the compaction response chain correctly after session history is modified.→Gemini CLI preview strengthens MCP OAuth, sandboxing and path boundariesThe preview adds destination validation for web-fetch utilities and enforces RFC 9207 issuer identification in MCP OAuth flows. It also isolates temporary directories, tightens extension and symlink boundary checks, requires consent for environment changes and removes a hard-coded CrUX API key.→GitHub Copilot CLI adds model fallback and proxy-bound Linux sandboxesThe v1.0.83-2 pre-release lets custom agents declare an ordered list of models and enforce a required model policy, and adds support for Claude Fable 5.1. It also restricts Linux sandbox network egress to a configured proxy, with additional host requirements for proxy mode.→Claude Code adds restricted execution and cross-session messagingThe release adds --restricted mode, which removes command-running tools and WebFetch unless explicitly allowed, confines file tools to the working directory, refuses bypassPermissions, and ignores local settings files. It also adds cross-session SendMessage and ListAgents support on Bedrock, Vertex, and Foundry, alongside self-hosted runner labels and prompt-cache fixes.→Codex CLI 0.150 makes cross-task coordination and trust controls first-classCodex CLI 0.150 lets users reference other tasks with @ mentions and ask agents to read, create or message tasks from the terminal; it also adds a copy picker, automatic task titles, clickable Markdown links and interrupt hooks. The release says untrusted projects no longer provide project-level AGENTS.md instructions, managed deny-read rules persist after permission changes, and app-server diagnostics improve credential redaction.→