Agents get faster models, safer sandboxes, and a phone in the loop

Faster inference, cheaper defaults

The week's biggest shift was on the model side. OpenAI's Ultrafast mode brings GPT-6.1 Sol to Codex and ChatGPT Work, trading raw token-generation speed for a plan requirement: it's limited to Pro $500 and eligible Enterprise and Edu workspaces, with enterprise access off until a workspace owner flips it on, and inference residency restricted to the US and Europe. Codex CLI followed by making GPT-6.1 Sol the default model in both the bundled and Amazon Bedrock catalogs, while pulling Daybreak behind an explicit opt-in flag so its controls and automatic Cyber routing no longer appear unless you ask for them. The same CLI work added MCP server sign-in from a live terminal, per-turn Cyber access program selection, and saved voice input/output device preferences. Anthropic answered on the cost side: Claude Haiku 5.5 is now the default Haiku model with a 1M context window at $0.10/$0.50 per Mtok, which quietly lowers the floor for subagent work and other high-volume delegation. Codex for iOS got in on the mobility theme too, rendering page previews inline and opening Codex task links directly, with a clearer approval picker and desktop-matching worktree support.

Sandbox and permission hardening

Claude Code's week reads as a security sweep. v2.1.292 closed several sandbox and permission bypasses, among them sandboxed commands reading staged upload file copies, managed read-deny paths failing to drop project grants, network-path reads skipping the permission prompt, and a tampered settings cache disabling the policy plugin — plus a --marketplace <source> option for claude plugin install that runs under the same policy checks as a manual marketplace add. Hook failures can now be made fail-closed via onFailure: "block", so a hook that can't start or times out blocks the action instead of waving it through, and gateway upstreams accept a model allowlist that holds across failover. Anthropic also fixed prompt and agent hooks written as instructions allowing what they should block, tightened judgment of Stop and SubagentStop prompts so Claude is less likely to quit early, and stopped managed PreToolUse hooks from approving blocked calls while refusing Edit and NotebookEdit writes that would corrupt non-UTF-8 files. Earlier in the week proxies rejecting beta headers, image-heavy sessions, and WebFetch's 100,000-character silent truncation were all fixed, mod hooks got richer turn and permission context, and two regressions that dropped permission answers and lost a session's final messages were patched.

Remote control and the local workspace

Cursor took the most interesting bet: Remote Control lets the iOS app display and message agents running on your own machine, with computers pairing to the account automatically, agents continuing to run locally, and Enterprise admins gating it from Org settings. Devin spent the week deepening its session workspace — a Terminal tab for running commands on Devin's machine that, like the Files tab, wakes a sleeping session, plus a keyboard shortcuts page available to everyone and new API and MCP paths for fetching code scans. A notification inbox with a sidebar bell and per-channel delivery settings arrived alongside a ⌘K palette that mirrors sidebar pages and surfaces PR review actions, with private keys in saved secrets now redacted line by line in command output. And long-session transcript flicker, missing skill content, and Teams access settings that never took effect were cleaned up, with Perforce snapshot builds given three hours instead of ten minutes to sync.

Smaller but pointed: Cursor-adjacent work aside, Grok Build made grok worktree rm refuse to delete worktrees in use or with unsaved changes without -f, and stopped disconnecting long sessions that exceed 4 MiB — a reminder that agent sessions are now long enough that the plumbing has to keep up. On Codex, multiline async questions crashing the TUI and startup failures from background-server feature mismatches were fixed, while managed Git worktrees, transcript copy navigation, and configurable mouse scrolling rounded out the CLI's tooling.