Agents get triggers, guardrails, and faster starts

Agents that start from nothing and finish faster

The week's most consequential shift came from Cursor, where cloud agents no longer need a connected SCM provider to get going. Pick "Start from scratch" in the repo picker, prompt the agent, and Cursor quietly creates an Origin repo behind the scenes; you can save work there later, port-forward the agent's live environment into the browser for preview, or publish straight to a live URL through Vercel. It removes the last bit of setup friction between having an idea and having an agent working on it.

xAI spent the week making Grok Build feel lighter. Across a run of updates it moved model-connection setup and expired-token refresh into the background so first replies and signed-in startup arrive faster, and deferred memory consolidation to the next launch instead of blocking session close. Reliability got equal attention: truncated responses and tool calls now continue automatically rather than failing the turn, with transient stalls, dropped connections, and 5xx errors retried; flaky MCP server connections retry instead of staying dead; and subagent sessions stopped leaking threads and file descriptors when a parent is busy. Headless runs are also easier to manage now, with a configurable default permission mode and browsable headless sessions in the resume picker.

Event-driven work and deeper tool access

Codex's biggest addition is that scheduled tasks can now fire on events from Gmail, Slack, and GitHub — filter mail by sender or subject, watch specific channels, or react to pull request reviews, comments, and merges. Event-triggered tasks trade the cron schedule for reactive runs, and matching events may be folded into a single execution. Codex also widened browser support and added site tools via WebMCP, letting agents work with web pages directly in the built-in browser, plus cloud sign-in on eligible plans.

On the CLI side, Codex lets extensions inspect or replace MCP tool results before they reach the model, with a configurable grace period for discovering tools from optional servers. Terminal workflows got more social: tasks can be referenced with @ mentions so agents can read, create, or message one another, Interrupt hooks now run when a turn is cut short, and untrusted projects no longer inject project-level AGENTS.md instructions. Remote compaction also counts retained images toward its token budget, trimming older ones as needed. iOS picked up task search, a reasoning-effort gauge, and Home Screen shortcuts.

Security hardening and cost visibility

Claude Code's week was dominated by safety and spend. The headline addition is a restricted mode that strips command, code, and fetch tools, keeps file tools inside the working directory, refuses bypassPermissions, and ignores settings files entirely — a real option for running an agent against untrusted code. It also fixed a nasty long-session bug: a prompt-cache miss roughly once an hour, with lost extended-thinking context, caused by tool definitions re-rendering after OAuth token refresh.

Elsewhere Claude Code stopped leaking gateway API keys to Anthropic's telemetry endpoints, patched a startup crash on glibc 2.44 distros like Arch and Fedora Rawhide, and added a cost-optimize command for profiling project spend alongside hardening of the plugin marketplace. A later update brought PreModelSwitch hooks, live subagent tool streaming, and a spend limit bar in /usage, plus fixes for file tools following swapped symlinks and path-traversal in plugin commands, with general bug fixes and reliability improvements rounding out the run.

Devin kept pace on the collaboration front, routing Slack @mentions to the subscribed session and moving code scanning to a /security home with batch remediation API routes.