--- collection: coding-agents collection_name: Coding Agents week_start: 2026-10-19 title: Sandbox escapes, oncall GA, and the week agents learned to tidy up after themselves release_count: 14 generated: 2026-10-26 canonical: https://releases.sh/collections/coding-agents/digest/2026-10-19 --- # Sandbox escapes, oncall GA, and the week agents learned to tidy up after themselves Claude Code closed a set of sandbox escapes that let Bash commands and auto-accepted edits reach outside their boundaries, while Devin's oncall agent went generally available and Devin began replacing Playbooks with Skills. ### Security work in the sandbox The week's most consequential changes came from Claude Code, which spent it tightening the boundaries around what agents are allowed to touch. Its sandbox hardening closed a set of real escapes: [macOS and Linux Bash commands no longer run shell startup files outside the sandbox](https://code.claude.com/docs/en/changelog#2-1-309), `denyWrite` globs now apply at a symlink's real path, and neither sandboxed commands nor auto-accepted edits can modify the MCP config passed with `--mcp-config`. The same release repaired a compaction loop triggered by large nested CLAUDE.md files. Elsewhere the product kept [fixing cleanup that deleted recent files like pasted images](https://code.claude.com/docs/en/changelog#2-1-310) when `cleanupPeriodDays` is set very large, added a Monitor tool and plugin monitors across Bedrock, Vertex, and Foundry, and brought Enterprise custom roles to cloud sessions and Remote Control. Providers that reject the tool-search capability got a fix for [every request failing on Vertex, Bedrock, and other gateways](https://code.claude.com/docs/en/changelog#2-1-305) — a regression from the prior week — with a new `sandbox.allowNestedUserNamespaces` option for Linux commands. Teams debugging permissions can now [emit a `claude_code.safety_event` for each stopped or prompted tool call](https://code.claude.com/docs/en/changelog#2-1-308), alongside an HTTP MCP fix that stops duplicate tool calls on dropped connections, plus a `/claude-api api-version` migration helper. Two smaller stories round out the week: [`claude -p` inside cloud sessions no longer reports "Not logged in"](https://code.claude.com/docs/en/changelog#2-1-306) when started without session environment variables, and [worktrees no longer get removed silently at exit](https://code.claude.com/docs/en/changelog#2-1-304) when HEAD is detached or on another branch, which could previously lose commits. That release also added `/auto-mode-setup`, a guided setup that reads your project and recent sessions so auto mode understands your environment. A routine bug-fix release filled in the gaps. ### Devin moves from Playbooks to Skills and goes on call Cognition had a structural week. [Devin Oncall reached general availability](https://docs.devin.ai/release-notes/overview#october-19-2026), letting responders watch Slack, Microsoft Teams, and PagerDuty, triage alerts, and post root-cause analysis, with enterprise admins classifying Teams attachments by Microsoft sensitivity label. The bigger migration, though, is [Playbooks becoming Skills](https://docs.devin.ai/release-notes/overview#october-23-2026): accounts move one at a time, each playbook becomes a skill with the same instructions, and the Playbooks API keeps reading and writing the skill so automations, `@playbook` mentions, and `!playbook` macros keep working. Accounts created from October 24 start with Skills only. Settings also gained a Default agent preference for new web and Slack sessions. Reviewers on Bitbucket Cloud are no longer left out: [Devin Review now supports Bitbucket Cloud](https://docs.devin.ai/release-notes/overview#october-21-2026), installing review webhooks automatically and posting as the linked member. Note that analytics now count a finding as resolved only when it's fixed in code, so resolution numbers will read lower. ### Interactive polish in Codex and Grok Build The CLIs focused on the small frictions of daily use. [Codex added ten numbered `/presets` slots](https://developers.openai.com/codex/changelog/#github-release-421457270) for reusable prompts and slash commands, with inline arguments for `/model` and `/permissions` so you can set model, reasoning effort, speed, and permission profile without a menu. Grok Build, meanwhile, made [worktrees inherit "always allow" approvals from the main checkout](https://x.ai/build/changelog#v1-0-67) so you aren't re-asked for tools you already allowed, and stopped headless `grok -p` runs from hanging when a background task or subagent finishes in the same turn. Its [theme picker now restores your previous theme on cancel](https://x.ai/build/changelog#v1-0-66) and keeps selected rows readable on every theme, while [plan mode actually starts in plan mode](https://x.ai/build/changelog#v1-0-65) and `/resume` search reaches sessions in other folders, tolerates typos, and matches commands, paths, and replies. ## Releases covered ### Anthropic - [Claude Code v2.1.309 fixes sandbox escapes and macOS startup-file leak](https://code.claude.com/docs/en/changelog#2-1-309) - [Claude Code v2.1.310 fixes background cleanup deleting recent files](https://code.claude.com/docs/en/changelog#2-1-310) - [Claude Code v2.1.305 fixes Vertex and Bedrock requests failing on tool search rejection](https://code.claude.com/docs/en/changelog#2-1-305) - [Claude Code v2.1.308 bug fixes and reliability improvements](https://code.claude.com/docs/en/changelog#2-1-308) - [Claude Code v2.1.306 fixes cloud session login and spurious prompt-too-long errors](https://code.claude.com/docs/en/changelog#2-1-306) - [Claude Code 2.1.304 fixes worktree removal losing commits and adds auto-mode setup](https://code.claude.com/docs/en/changelog#2-1-304) ### Cognition - [Devin Oncall reaches GA alongside Teams sensitivity-label attachment classification](https://docs.devin.ai/release-notes/overview#october-19-2026) - [Devin adds default agent setting and moves Playbooks to Skills](https://docs.devin.ai/release-notes/overview#october-23-2026) - [Devin adds Bitbucket Cloud support to code review](https://docs.devin.ai/release-notes/overview#october-21-2026) ### OpenAI - [Codex CLI Release: 0.164.0](https://developers.openai.com/codex/changelog/#github-release-421457270) ### xAI - [Grok Build 1.0.67 inherits main checkout approvals in worktrees](https://x.ai/build/changelog#v1-0-67) - [Grok Build 1.0.66 restores previous theme on picker cancel and fixes selected-row readability](https://x.ai/build/changelog#v1-0-66) - [Grok Build 1.0.65 fixes --permission-mode plan and expands /resume search](https://x.ai/build/changelog#v1-0-65)