Agents break out of the cloud as Codex retires its MCP server

Agents move onto your own infrastructure

The week's biggest shift is about where agents are allowed to run. Cursor introduced self-hosted machines that execute tool calls entirely inside your network: codebases, build outputs, and secrets stay on internal hardware while the agent drives the work. Team pools scale worker capacity up and down with demand and hibernate idle machines, cloud agents can now target AWS Lambda, Coder, Cloudflare, Daytona, Modal, Namespace, Vercel, and E2B, and computer use works on self-hosted Linux and Mac workers. For teams that have been waiting for a plausible answer to "where does our source code actually go," this is that answer.

Codex sheds its MCP server and rolls out GPT-6-Astra

OpenAI's week was defined by a removal. The codex mcp-server command and standalone binary are gone after their August 24 deprecation, so any integration that launches either one breaks on upgrade — the migration path is the Codex app server, while connecting out to external MCP servers through codex mcp still works.

The rest of Codex's week was Astra plumbing. Codex added GPT-6-Astra to the Amazon Bedrock model picker for Mantle and Runtime routes, then made Astra visible and default in the bundled picker while gating its asynchronous clarification questions on the tool actually being available in the session. An earlier build had already enabled Astra configuration through the API without disturbing the default model, and the displayed Fast-tier description was corrected to "2x speed, increased usage".

Deeper in the CLI, vim undo and redo landed alongside remote plugin marketplaces, with TUI sessions reconnecting after app-server drops without losing drafts. Vim users also got in-draft / and ? search with highlighted matches, per-tool output_token_limit truncation, and a security fix that disables redirects on cloud task requests to protect saved credentials. Codex for iOS got a Priority view plus host-wide attachments spanning Windows, Linux, and Photo Library videos, and Guardian approval reviews now honor Node REPL policies from model metadata.

Claude Code tightens auto-mode containment

Claude Code's headline was Fable 5.1, now the default Fable model with a 1M context — but the security work matters more. A new Containment Escape rule stops auto mode from approving cloud metadata-credential fetches, egress evasion, and cross-tenant reach, and the same release plugs unbounded memory growth from piped non-JSONL input and an OAuth credential leak risk.

A follow-up closed several sandbox permission holes, including Edit/Write/Read rules with parentheses being silently dropped and leaving read-only folders writable, and reverted a change that had wrongly applied Read() deny rules to Bash arguments. Organizations can now push managed HTTP/SSE MCP servers to every user via managedMcpServers, alongside fixes for concurrent sessions clobbering each other's config. Elsewhere: bash and task output limits up to 128K with a new /skill-doctor, a macOS 12 launch regression fixed, and Bash "task output swap refused" failures resolved on affected Macs.

Grok Build and Devin grind through polish

Grok Build shipped a dense run of terminal and session fixes: built-in tools now win over user MCP servers on name collisions and edit_file diffs show real line numbers; permission mode stays visible in plan mode; scheduled /loop tasks moved to the background with --worktree for headless runs; MCP tools can pause mid-call to ask for input; and an MCP OAuth deadlock was fixed with task output waits extended to an hour.

Devin added sidebar grouping by pull request or repository plus a cleanup scan type that hunts dead code, and rolled out multi-select tag filters and VS Code-style editor splits with Gmail, Calendar, Gamma, and Supabase MCP servers in the marketplace.