--- collection: coding-agents collection_name: Coding Agents week_start: 2026-08-31 title: Self-hosted agents and a security hardening spree release_count: 19 generated: 2026-09-07 canonical: https://releases.sh/collections/coding-agents/digest/2026-08-31 --- # Self-hosted agents and a security hardening spree Cursor wades into data-sovereignty territory with self-hosted machines for in-network tool execution, while Claude Code ships a new Fable 5.1 model and tightens auto-mode security. Codex continues its GPT-6-Astra rollout with availability fixes. ### Keeping the code on your side of the firewall The week's biggest story is [Cursor's self-hosted machines](/release/rel_AhjEjm3QB_F6RlOO5vdLb-cursor-launches-self-hosted-machines-for-in-network-tool-execution), a significant step for teams that have been hesitant to let cloud agents handle proprietary code. The feature keeps codebases, build outputs, and secrets entirely on internal infrastructure while the agent handles tool calls locally — no more shipping your source tree to a third party just to get agentic help. Cursor also broadened its cloud-agent runtime support to AWS Lambda, Coder, Cloudflare, Daytona, Modal, Namespace, Vercel, and E2B, and brought computer use to self-hosted Linux and Mac workers. Team pools can scale worker capacity with demand and hibernate idle machines, which should keep the cost story reasonable. This lands alongside Anthropic's quieter infrastructure play. [Claude Code's managed MCP servers](/release/rel_pfnMz4wxb_vH1dDLEmfxO-claude-code-v2-1-259-fixes-multi-session-state-loss-and-adds-managed-mcp-servers) let organizations push HTTP/SSE MCP servers to every user via the `managedMcpServers` setting — same entry shape as local `.mcp.json` files, centrally administered. Combined with Cursor's move, the picture is clear: agentic tooling vendors are racing to give enterprises control over where code executes and which tools agents can reach. ### Claude Code grows a brain and a spine Anthropic shipped two consequential Claude Code updates. [Claude Code v2.1.257](/release/rel_3jZrNXfAz2Usqdaoc0rEs-claude-code-v2-1-257-adds-fable-5-1-model-and-hardens-auto-mode-security) introduces Claude Fable 5.1 (`claude-fable-5-1`) as the new default Fable model with 1M context, and — more interesting for security-conscious users — a Containment Escape rule that blocks auto-approval of cloud metadata-credential fetches, egress evasion, and cross-tenant reach in auto mode. That's a meaningful hardening step: the most dangerous auto-mode failure modes are now gated by default. The same release fixes an OAuth credential leak risk and unbounded memory growth from piped non-JSONL data. The follow-up [v2.1.260](/release/rel_ZllkGAM_udtDFz5AkJYVX-claude-code-v2-1-260-fixes-sandbox-permission-bypasses-and-reverted-bash-deny) plugged several sandbox bypasses, including Edit/Write/Read rules with parentheses being silently dropped (which left supposedly read-only folders writable) and zsh environment assignments that auto-approved command substitutions. It also reverted a 2.1.259 change that applied Read deny rules to Bash arguments — a reminder that security tightening sometimes needs walking back when it breaks legitimate workflows. The fullscreen /diff panel and text-form /advisor are nice quality-of-life additions for headless sessions. ### Codex rounds out Astra and repairs its editor OpenAI's Codex crew spent the week polishing GPT-6-Astra availability. [Codex CLI 0.153.1](/release/rel_0J-xvwccQNUyoMmXW3VV1-codex-cli-0-153-1-adds-gpt-6-astra-api-support-without-changing-default-model) added API-level support without changing the default model, then [0.153.2](/release/rel_w4FpeI4JWge0DRsYZ2RCW-codex-cli-0-153-2-corrects-gpt-6-astra-fast-tier-description) corrected the Fast tier description ("2x speed" not "1.5x"), [0.153.3](/release/rel_G7qBQG0e5ukoWzwzIJOSo-codex-0-153-3-adds-gpt-6-astra-to-amazon-bedrock-model-picker) put Astra in the Amazon Bedrock picker, and [0.153.4](/release/rel_pY_Lt6akXEXwhGtYR693a-codex-cli-0-153-4-fixes-astra-model-picker-visibility-and-async-question-gating) finally made it visible in the bundled model picker and the default when unset. Four releases to land one model — the Astra rollout was evidently more awkward than the changelog tone suggests. More substantive: [Codex CLI 0.153.0](/release/rel_qCX2lXzs0V3-kplAFgEqY-codex-cli-0-153-0-adds-vim-undo-plugin-marketplace-support) brought vim mode undo/redo (`u` and `Ctrl+R`) and a plugin CLI that can list, install, and remove plugins from remote marketplaces. TUI sessions now reconnect after app-server drops preserving drafts, and Guardian reviews survive compaction and restarts. The earlier [0.152.0](/release/rel_CTppmkVZeILm4ukuyQvxj-codex-cli-0-152-0-adds-vim-mode-search-mcp-tool-token-limits) added vim search (`/` and `?`), per-tool `output_token_limit` for MCP tools, and — importantly — fixed a security issue where cloud task requests rejected untrusted backend URLs and disabled redirects to protect saved credentials. The planning tool defaults to off now; you'll need `tools.update_plan.enabled = true` to bring it back. ### Devin tidies up, everyone else patches Cognition's Devin got a pair of organizational releases. [Devin's latest](/release/rel_x2rnwREvxjJDxVxADcBYd-devin-release-adds-sidebars-grouped-by-pr-repo-and-cleanup-code-scans) adds sidebars grouped by PR status or repository, a cleanup scan type for dead code, scheduled code scans via a `/scan` composer command, and a redesigned findings tab. The earlier [release](/release/rel_yHvKdT_mIRyoYaVHciIFK-devin-adds-multi-select-tag-filters-vs-code-style-editor-splits-and-mcp) brought multi-select tag filters, VS Code-style split editor groups, and Gmail, Google Calendar, Gamma, and Supabase MCP servers to the marketplace. For a product chasing enterprise adoption, the triage and navigation improvements matter more than the editor cosmetics. Claude Code's other patches are worth a mention: [v2.1.261](/release/rel_9jMcdiPxGjvPr3c7ZJ04i-claude-code-v2-1-261-adds-bash-output-limits-and-skill-doctor-fixes-remote) added bash output limits (up to 128K chars) and `/skill-doctor`; [v2.1.258](/release/rel_AohN9_t26HFbHJXibuN0F-claude-code-v2-1-258-restores-macos-12-launch-and-fixes-remote-session-errors) restored macOS 12 launch support broken in 2.1.255; and [v2.1.252](/release/rel_zmAew1u4Tt9cGOPTMbeRZ-claude-code-v2-1-252-fixes-bash-command-failure-on-some-macs) fixed Bash failures on Macs with moved tasks directories. Devin's iOS companion also gained a Priority view and cross-host attachments. The one-sentence [Claude Code v2.1.263](/release/rel_3Nj_rsY-_F0GMWEwpsF_P-claude-code-v2-1-263-ships-bug-fixes-and-reliability-improvements) — "bug fixes and reliability improvements" — rounds out a week that felt less feature-forward than security-consolidation. ## Releases covered ### Anthropic - [Claude Code v2.1.259 fixes multi-session state loss and adds managed MCP servers](https://releases.sh/release/rel_pfnMz4wxb_vH1dDLEmfxO-managed-mcp-servers-for-orgs-state-loss-fixed) - [Claude Code v2.1.257 adds Fable 5.1 model and hardens auto-mode security](https://releases.sh/release/rel_3jZrNXfAz2Usqdaoc0rEs-fable-5-1-lands-containment-escape-rule-tightens-auto-mode) - [Claude Code v2.1.260 fixes sandbox permission bypasses and reverted Bash deny rule](https://releases.sh/release/rel_ZllkGAM_udtDFz5AkJYVX-sandbox-permission-bypasses-closed-bash-deny-reverted) - [Claude Code v2.1.261 adds bash output limits and /skill-doctor; fixes Remote Control stale states](https://releases.sh/release/rel_9jMcdiPxGjvPr3c7ZJ04i-bash-output-caps-and-skill-doctor-added-remote-control-stale-state-fixed) - [Claude Code v2.1.258 restores macOS 12 launch and fixes remote session errors](https://releases.sh/release/rel_AohN9_t26HFbHJXibuN0F-macos-12-launch-restored-remote-session-errors-fixed) - [Claude Code v2.1.252 fixes Bash command failure on some Macs](https://releases.sh/release/rel_zmAew1u4Tt9cGOPTMbeRZ-bash-task-output-swap-fix-session-stalls-resolved) - [Claude Code v2.1.263 ships bug fixes and reliability improvements](https://releases.sh/release/rel_3Nj_rsY-_F0GMWEwpsF_P-claude-code-v2-1-263-ships-bug-fixes-and-reliability-improvements) ### Cognition - [Devin release adds sidebars grouped by PR/repo and cleanup code scans](https://releases.sh/release/rel_x2rnwREvxjJDxVxADcBYd-cleanup-scan-finds-dead-code-sidebar-groups-by-pr-repo) - [Devin adds multi-select tag filters, VS Code-style editor splits, and MCP marketplace servers](https://releases.sh/release/rel_yHvKdT_mIRyoYaVHciIFK-tag-filters-and-editor-splits-land-mcp-marketplace-expands) ### Cursor - [Cursor launches self-hosted machines for in-network tool execution](https://releases.sh/release/rel_AhjEjm3QB_F6RlOO5vdLb-self-hosted-machines-keep-tool-execution-in-your-network) ### OpenAI - [Codex CLI 0.153.1 adds GPT-6-Astra API support without changing default model](https://releases.sh/release/rel_0J-xvwccQNUyoMmXW3VV1-gpt-6-astra-configurable-via-api-default-model-unchanged) - [Codex CLI 0.153.2 corrects GPT-6-Astra Fast tier description](https://releases.sh/release/rel_w4FpeI4JWge0DRsYZ2RCW-gpt-6-astra-fast-tier-description-corrected) - [Codex 0.153.3 adds GPT-6-Astra to Amazon Bedrock model picker](https://releases.sh/release/rel_G7qBQG0e5ukoWzwzIJOSo-gpt-6-astra-lands-in-bedrock-model-picker) - [Codex CLI 0.153.4 fixes Astra model picker visibility and async-question gating](https://releases.sh/release/rel_pY_Lt6akXEXwhGtYR693a-codex-cli-0-153-4-astra-bundled-model-async-questions-gated-on-tool-availability) - [Codex CLI 0.153.0 adds vim undo, plugin marketplace support](https://releases.sh/release/rel_qCX2lXzs0V3-kplAFgEqY-vim-undo-redo-lands-plugin-marketplace-cli-added) - [Codex CLI 0.152.0 adds vim mode search, MCP tool token limits](https://releases.sh/release/rel_CTppmkVZeILm4ukuyQvxj-vim-mode-search-mcp-tool-token-limits-planning-tool-opt-in)