Sandbox escapes, oncall GA, and the week agents learned to tidy up after themselves

Security work in the sandbox

The week's most consequential changes came from Claude Code, which spent it tightening the boundaries around what agents are allowed to touch. Its sandbox hardening closed a set of real escapes: macOS and Linux Bash commands no longer run shell startup files outside the sandbox, denyWrite globs now apply at a symlink's real path, and neither sandboxed commands nor auto-accepted edits can modify the MCP config passed with --mcp-config. The same release repaired a compaction loop triggered by large nested CLAUDE.md files.

Elsewhere the product kept fixing cleanup that deleted recent files like pasted images when cleanupPeriodDays is set very large, added a Monitor tool and plugin monitors across Bedrock, Vertex, and Foundry, and brought Enterprise custom roles to cloud sessions and Remote Control. Providers that reject the tool-search capability got a fix for every request failing on Vertex, Bedrock, and other gateways — a regression from the prior week — with a new sandbox.allowNestedUserNamespaces option for Linux commands. Teams debugging permissions can now emit a claude_code.safety_event for each stopped or prompted tool call, alongside an HTTP MCP fix that stops duplicate tool calls on dropped connections, plus a /claude-api api-version migration helper.

Two smaller stories round out the week: claude -p inside cloud sessions no longer reports "Not logged in" when started without session environment variables, and worktrees no longer get removed silently at exit when HEAD is detached or on another branch, which could previously lose commits. That release also added /auto-mode-setup, a guided setup that reads your project and recent sessions so auto mode understands your environment. A routine bug-fix release filled in the gaps.

Devin moves from Playbooks to Skills and goes on call

Cognition had a structural week. Devin Oncall reached general availability, letting responders watch Slack, Microsoft Teams, and PagerDuty, triage alerts, and post root-cause analysis, with enterprise admins classifying Teams attachments by Microsoft sensitivity label. The bigger migration, though, is Playbooks becoming Skills: accounts move one at a time, each playbook becomes a skill with the same instructions, and the Playbooks API keeps reading and writing the skill so automations, @playbook mentions, and !playbook macros keep working. Accounts created from October 24 start with Skills only. Settings also gained a Default agent preference for new web and Slack sessions.

Reviewers on Bitbucket Cloud are no longer left out: Devin Review now supports Bitbucket Cloud, installing review webhooks automatically and posting as the linked member. Note that analytics now count a finding as resolved only when it's fixed in code, so resolution numbers will read lower.

Interactive polish in Codex and Grok Build

The CLIs focused on the small frictions of daily use. Codex added ten numbered /presets slots for reusable prompts and slash commands, with inline arguments for /model and /permissions so you can set model, reasoning effort, speed, and permission profile without a menu. Grok Build, meanwhile, made worktrees inherit "always allow" approvals from the main checkout so you aren't re-asked for tools you already allowed, and stopped headless grok -p runs from hanging when a background task or subagent finishes in the same turn. Its theme picker now restores your previous theme on cancel and keeps selected rows readable on every theme, while plan mode actually starts in plan mode and /resume search reaches sessions in other folders, tolerates typos, and matches commands, paths, and replies.