Model routing, voice, and sandbox hardening dominate the week

Smarter execution, smarter routing

The most consequential shift this week is how agents decide what does the work. Cursor's intelligent model router for Auto mode — Cursor Router — analyzes each request and sends it to the appropriate model, with three optimization modes (Intelligence, Balance, Cost) that let teams control the cost-intelligence tradeoff. Admin controls add per-team enablement, mode restrictions, and model allow/block lists, making this practical for organizations.

Meanwhile, Claude Code v2.1.219 introduces Claude Opus 5 as the default Opus model with 1M context, and subagents can now spawn nested subagents up to depth 3 (was 1). The combination of a larger context window and deeper nesting allows more complex multi-step workflows without round-tripping to the top-level agent. The same release also adds a sandbox.network.strictAllowlist setting that denies non-allowlisted hosts without prompting, a significant security hardening step.

Voice, projects, and cross-tool portability

Codex enters the voice era with ChatGPT Voice, powered by GPT-Live, available in the ChatGPT desktop app for Chat, Work, and Codex. You can start a chat or task in voice mode, then ask ChatGPT to coordinate work in other threads — a natural extension of the agent-as-orchestrator pattern. On macOS, Screen context shares an appshot of your frontmost window. Voice is available with all paid plans.

The same release adds multi-folder local projects, with a primary folder for new chats, Git operations, and automatic discovery. This addresses a longstanding pain point for projects that span multiple directories.

The Codex CLI 0.145.0 adds experimental paginated thread history with efficient resume, search, and persisted names. More notably, its /import command now migrates Cursor and Claude Code settings, MCP servers, and plugins — a practical step toward interoperability that reduces switching costs between tools.

Reliability and security fixes across the ecosystem

Claude Code had a particularly busy week of fixes. v2.1.216 fixed a quadratic slowdown in long sessions where message normalization cost grew with the number of turns, and an OAuth token expiry race that caused false "HTTP 401" errors. v2.1.217 fixed an MCP memory leak where truncated tool outputs kept the full untruncated result in memory, and reversed the default on subagent nesting (it's now off by default, re-enabled with CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH). v2.1.218 fixed a Windows path corruption bug where \u-prefixed segments were mangled into CJK characters, and a data-loss bug where the left arrow key could discard the conversation. The patchedit Unicode corruption fix alone is a critical fix for Windows users.

Devin's July 24 release redesigned the model picker into a single organized menu, added OIDC identity tokens for cloud authentication, playbook previews, and Windows sessions with network access approvals from Slack. The July 21 release brought centralized plugin management for Skills, multi-repo code scans with per-repo details, and chained attack paths for related findings. The July 23 release added Devin Outposts for self-hosted workloads and smarter Linear thread handling.

A note on what didn't make the cut

Several smaller releases — Claude Code v2.1.220 (bug fixes only), Devin July 10 (UI polish), and Devin July 8 (comment composer redesign) — represent routine maintenance and incremental improvements. They're worth noting for completeness but don't change the week's narrative.