---
collection: coding-agents
collection_name: Coding Agents
week_start: 2026-05-25
title: Run mode security and agent orchestration shape the week
release_count: 24
generated: 2026-07-11
canonical: https://releases.sh/collections/coding-agents/digest/2026-05-25
---

# Run mode security and agent orchestration shape the week

Codex CLI hardened command safety against repository-supplied Git hooks and browser-based websocket exploits, while Cursor introduced an Auto-review run mode and Claude Code debuted dynamic workflows for orchestrating tens to hundreds of background agents.

### Hardening agent execution across the tools

Three separate releases this week tightened the boundaries around what an agent can do without explicit approval, signaling a maturing focus on safe autonomous operation. [Codex CLI's command-safety hardening](/release/rel_EFzm-vhA0vPPaZdCKyZku-codex-cli-0-136-0-hardens-command-safety-and-adds-session-archiving) in 0.136.0 prevents `/diff` from executing repository-provided Git helpers and hooks, blocks PowerShell parser execution on non-Windows hosts, and rejects browser-origin websocket handshakes to the exec server — addressing attack vectors that could escape the TUI sandbox. Cursor introduced [Auto-review](/release/rel_CKUKVIG-gOOnIpjk0uC_x-cursor-introduces-auto-review-run-mode-for-safer-agent-execution), a new run mode that classifies Shell, MCP, and Fetch tool calls: allowlisted calls run immediately, sandboxed ones execute in isolation, and everything else goes to a classifier subagent that decides whether to allow, retry, or ask for approval. Grok Build shipped an ["always approve" mode](/release/rel_vBYizckGnxnLOxGT6V6dU-grok-build-0-2-3) (the bluntest of the three approaches) and separately made [tool permission choices persistent across sessions](/release/rel_BWKFsBwA4NIFA1tiR_pTb-grok-build-0-2-15-remembers-tool-permission-choices) with a configurable first-prompt default, reducing friction while maintaining the permission model.

### Claude Code goes big with dynamic workflows

The most architecturally significant release this week is [Claude Code v2.1.154](/release/rel_XGh7kYsinjYzcQTu8fTyF-claude-code-v2-1-154-introduces-dynamic-workflows-and-opus-4-8-with-lean-system), which introduces dynamic workflows — ask Claude to create a workflow and it orchestrates work across tens to hundreds of background agents for larger tasks, viewable through a new `/workflows` command. This is paired with Opus 4.8 support (defaulting to high effort, with fast mode at 2x the standard rate for 2.5x speed) and a lean system prompt that's now the default for all models except the older generation. Meanwhile, [v2.1.152](/release/rel_Dhff4j5XtozUFM53CGTva-claude-code-v2-1-152-applies-code-review-findings-and-adds-skill-reload-hooks) makes `/code-review --fix` actionable by applying findings to your working tree, and skills can now declare `disallowed-tools` in frontmatter to remove tools while the skill is active. A new [`/reload-skills`](/release/rel_Dhff4j5XtozUFM53CGTva-claude-code-v2-1-152-applies-code-review-findings-and-adds-skill-reload-hooks) command re-scans skill directories without a restart, and [v2.1.157](/release/rel_z8lES6cxgbHIIeNk0jW8k-claude-code-v2-1-157-auto-loads-plugins-from-claude-skills-and-fixes-worktree) auto-loads plugins from `.claude/skills` directories (no marketplace required) with a `claude plugin init` scaffolding command. The bugfix releases [v2.1.156](/release/rel_nDR8q1Mtp-bQNpnpBnefN-claude-code-v2-1-156-fixes-opus-4-8-thinking-block-api-errors) and [v2.1.153](/release/rel_VhU5hGQwIGoE7hGibMi_5-claude-code-v2-1-153-fixes-mcp-server-reconnect-loop-and-api-gateway-credential) respectively fixed Opus 4.8 thinking block API errors, an MCP server reconnect loop, and a credential leak where a custom API gateway could receive the user's Anthropic OAuth token.

### Cross-platform expansion and workflow improvements

Codex made two major platform moves: [Computer Use now works on Windows](/release/rel_WXQUAFgt0BAAHDFFrEs1M-codex-now-supports-computer-use-and-remote-control-on-windows), letting the agent operate desktop apps by seeing, clicking, and typing, and remote control supports Windows devices so you can start work on a Windows machine and check progress from ChatGPT on mobile or a Mac. Codex also [integrated with Amazon Bedrock](/release/rel_IEuo0N6G7GzZMlOc694NN-codex-now-integrates-with-amazon-bedrock-for-aws-managed-deployment) for AWS-managed deployment, adding authentication, account controls, and billing to local Codex workflows. On the TUI side, [Codex CLI 0.135.0](/release/rel_UWvRjUzC_3PAwUgdkGcTs-codex-cli-0-135-0-adds-richer-diagnostics-vim-text-objects-and-tui-rendering) enriched `codex doctor` diagnostics and added vim text-object editing, while [0.134.0](/release/rel_4j8ifjBYdZDIvWUClL8K5-codex-cli-0-134-0-adds-search-across-conversation-history-and-makes-profile) added search across local conversation history with case-insensitive matches and made `--profile` the primary profile selector.

Grok Build's rapid iteration continued with fixes for [session state leaking into subagent conversations](/release/rel_NW82YQvNRqe7JJQTox33F-grok-build-0-2-16-fixes-session-state-leaking-into-subagent-conversations), the ability to [open generated images and videos from the terminal](/release/rel_iRdeJLMPQi9yB4OIyb5ER-grok-build-0-2-14-opens-generated-images-and-videos-from-terminal), and improved [tab bar navigation and WSL image paste support](/release/rel_gyQmt3XUlLNxILlLkCUgx-grok-build-0-2-11). Several Grok builds focused on polish: wrapping slash menu navigation, subagent UI restoration on resume, and Windows drag-and-drop image input. Devin gained a [redesigned command palette](/release/rel_cBRjI2KgYgo2SpTYZsoPV-may-29-2026) with improved search and keyboard navigation, plus a files-changed trigger for automations so GitHub push events can fire only when specific files or directories are modified.

## Releases covered

### Anthropic

- [Claude Code v2.1.154 introduces dynamic workflows and Opus 4.8 with lean system prompt by default](https://releases.sh/release/rel_XGh7kYsinjYzcQTu8fTyF-dynamic-workflows-launch-opus-4-8-defaults-to-lean-system-prompt)
- [Claude Code v2.1.152 applies code review findings and adds skill reload hooks](https://releases.sh/release/rel_Dhff4j5XtozUFM53CGTva-code-review-auto-fix-skills-reload-mid-session-vim-reverse-search)
- [Claude Code v2.1.157 auto-loads plugins from .claude/skills and fixes worktree orphaning](https://releases.sh/release/rel_z8lES6cxgbHIIeNk0jW8k-plugins-auto-load-from-claude-skills-worktree-orphaning-fixed)
- [Claude Code v2.1.156 fixes Opus 4.8 thinking block API errors](https://releases.sh/release/rel_nDR8q1Mtp-bQNpnpBnefN-opus-4-8-thinking-blocks-no-longer-cause-api-errors)
- [Claude Code v2.1.153 fixes MCP server reconnect loop and API gateway credential leak](https://releases.sh/release/rel_VhU5hGQwIGoE7hGibMi_5-mcp-servers-no-longer-reconnect-loop-api-gateway-credential-leak-fixed)

### Cognition

- [May 29, 2026](https://releases.sh/release/rel_cBRjI2KgYgo2SpTYZsoPV-may-29-2026)

### Cursor

- [Cursor introduces Auto-review run mode for safer agent execution](https://releases.sh/release/rel_CKUKVIG-gOOnIpjk0uC_x-auto-review-mode-reduces-approval-prompts-classifier-decides-unsafe-calls)

### OpenAI

- [Codex CLI 0.136.0 hardens command safety and adds session archiving](https://releases.sh/release/rel_EFzm-vhA0vPPaZdCKyZku-command-safety-hardened-sessions-now-archivable)
- [Codex now supports computer use and remote control on Windows](https://releases.sh/release/rel_WXQUAFgt0BAAHDFFrEs1M-computer-use-remote-control-now-work-on-windows)
- [Codex now integrates with Amazon Bedrock for AWS-managed deployment](https://releases.sh/release/rel_IEuo0N6G7GzZMlOc694NN-amazon-bedrock-integration-ships)
- [Codex CLI 0.135.0 adds richer diagnostics, vim text objects, and TUI rendering fixes](https://releases.sh/release/rel_UWvRjUzC_3PAwUgdkGcTs-doctor-command-gets-environment-diagnostics-vim-mode-gains-text-objects-tui)
- [Codex CLI 0.134.0 adds search across conversation history and makes --profile primary](https://releases.sh/release/rel_4j8ifjBYdZDIvWUClL8K5-search-conversation-history-profile-becomes-primary-selector)

### xAI

- [Grok Build 0.2.3](https://releases.sh/release/rel_vBYizckGnxnLOxGT6V6dU-grok-build-0-2-3)
- [Grok Build 0.2.15 remembers tool permission choices](https://releases.sh/release/rel_BWKFsBwA4NIFA1tiR_pTb-tool-permissions-now-persist-across-sessions)
- [Grok Build 0.2.16 fixes session state leaking into subagent conversations](https://releases.sh/release/rel_NW82YQvNRqe7JJQTox33F-parent-session-state-no-longer-leaks-to-subagents)
- [Grok Build 0.2.14 opens generated images and videos from terminal](https://releases.sh/release/rel_iRdeJLMPQi9yB4OIyb5ER-generated-images-and-videos-open-directly-from-terminal-ui)
- [Grok Build 0.2.11](https://releases.sh/release/rel_gyQmt3XUlLNxILlLkCUgx-grok-build-0-2-11)