Self-hosted agents and a security hardening spree

Keeping the code on your side of the firewall

The week's biggest story is Cursor's self-hosted machines, a significant step for teams that have been hesitant to let cloud agents handle proprietary code. The feature keeps codebases, build outputs, and secrets entirely on internal infrastructure while the agent handles tool calls locally — no more shipping your source tree to a third party just to get agentic help. Cursor also broadened its cloud-agent runtime support to AWS Lambda, Coder, Cloudflare, Daytona, Modal, Namespace, Vercel, and E2B, and brought computer use to self-hosted Linux and Mac workers. Team pools can scale worker capacity with demand and hibernate idle machines, which should keep the cost story reasonable.

This lands alongside Anthropic's quieter infrastructure play. Claude Code's managed MCP servers let organizations push HTTP/SSE MCP servers to every user via the managedMcpServers setting — same entry shape as local .mcp.json files, centrally administered. Combined with Cursor's move, the picture is clear: agentic tooling vendors are racing to give enterprises control over where code executes and which tools agents can reach.

Claude Code grows a brain and a spine

Anthropic shipped two consequential Claude Code updates. Claude Code v2.1.257 introduces Claude Fable 5.1 (claude-fable-5-1) as the new default Fable model with 1M context, and — more interesting for security-conscious users — a Containment Escape rule that blocks auto-approval of cloud metadata-credential fetches, egress evasion, and cross-tenant reach in auto mode. That's a meaningful hardening step: the most dangerous auto-mode failure modes are now gated by default. The same release fixes an OAuth credential leak risk and unbounded memory growth from piped non-JSONL data.

The follow-up v2.1.260 plugged several sandbox bypasses, including Edit/Write/Read rules with parentheses being silently dropped (which left supposedly read-only folders writable) and zsh environment assignments that auto-approved command substitutions. It also reverted a 2.1.259 change that applied Read deny rules to Bash arguments — a reminder that security tightening sometimes needs walking back when it breaks legitimate workflows. The fullscreen /diff panel and text-form /advisor are nice quality-of-life additions for headless sessions.

Codex rounds out Astra and repairs its editor

OpenAI's Codex crew spent the week polishing GPT-6-Astra availability. Codex CLI 0.153.1 added API-level support without changing the default model, then 0.153.2 corrected the Fast tier description ("2x speed" not "1.5x"), 0.153.3 put Astra in the Amazon Bedrock picker, and 0.153.4 finally made it visible in the bundled model picker and the default when unset. Four releases to land one model — the Astra rollout was evidently more awkward than the changelog tone suggests.

More substantive: Codex CLI 0.153.0 brought vim mode undo/redo (u and Ctrl+R) and a plugin CLI that can list, install, and remove plugins from remote marketplaces. TUI sessions now reconnect after app-server drops preserving drafts, and Guardian reviews survive compaction and restarts. The earlier 0.152.0 added vim search (/ and ?), per-tool output_token_limit for MCP tools, and — importantly — fixed a security issue where cloud task requests rejected untrusted backend URLs and disabled redirects to protect saved credentials. The planning tool defaults to off now; you'll need tools.update_plan.enabled = true to bring it back.

Devin tidies up, everyone else patches

Cognition's Devin got a pair of organizational releases. Devin's latest adds sidebars grouped by PR status or repository, a cleanup scan type for dead code, scheduled code scans via a /scan composer command, and a redesigned findings tab. The earlier release brought multi-select tag filters, VS Code-style split editor groups, and Gmail, Google Calendar, Gamma, and Supabase MCP servers to the marketplace. For a product chasing enterprise adoption, the triage and navigation improvements matter more than the editor cosmetics.

Claude Code's other patches are worth a mention: v2.1.261 added bash output limits (up to 128K chars) and /skill-doctor; v2.1.258 restored macOS 12 launch support broken in 2.1.255; and v2.1.252 fixed Bash failures on Macs with moved tasks directories. Devin's iOS companion also gained a Priority view and cross-host attachments. The one-sentence Claude Code v2.1.263 — "bug fixes and reliability improvements" — rounds out a week that felt less feature-forward than security-consolidation.