Coding agents learn to speak, ship, and lock themselves down

Agents you can talk to, and apps you can ship

Cursor's biggest week in a while went in two directions at once. Its agents now take realtime voice calls in the Agents Window, the IDE, on web, and on iOS: describe a change out loud, ask what an agent is working on, and hear progress as the work moves — running on Grok Voice with selectable voices and zero data retention under Privacy Mode, per Cursor's voice chat rollout.

The more consequential addition is live app building and hosting. Cloud agents can scaffold a web app, provision Postgres, put auth behind Cursor SSO, and deploy to a link on a domain you pick — with deterministic and agentic checks for exposed secrets or credentials, and nothing going live until they pass. The pitch is pointed: most apps agents write never leave localhost, and Cursor wants to be the thing that gets them off it.

Claude Code hardens its permission boundary

Anthropic's week was mostly about who gets to run what. The headline is a pair of security fixes in Claude Code's sandbox and auto-mode changes: a sandbox escape when creating a worktree, and a Bash permission bypass where a crafted environment prefix could hide part of a command from permission checks. Auto mode itself now errs toward asking or denying when telemetry or feature flags are off and the server can't check a call, rather than silently falling back to the built-in classifier — CLAUDE_CODE_AUTO_MODE_SERVER=0 restores the old behavior, and Bedrock, Vertex, and Foundry are unchanged.

Elsewhere it was trust and continuity. Nested session IDs came back for claude -p inside self-hosted runners, MCP servers stopped disconnecting after the first turn in some desktop sessions, and Claude Code now asks before a web or shell tool call sends your account email to the network. Sign-in expiry dates now surface in claude auth status and -p JSON output with a warning ten days out, as part of fixes for config loss on shared home directories and a --continue regression.

Devin takes the admin work out of enterprise setup

Cognition spent the week removing tickets from the enterprise onboarding path. Self-serve SSO lets admins verify domain ownership with a DNS record and create, edit, and delete their own OIDC or SAML connections, while budgets now organize user and org spend into a hierarchy with sub-limits, and security connections ingest findings from SonarQube, Linear, and Vanta. Enterprises without a PAT policy now default to approval required.

Governance followed: session sharing defaults and a log-out-everywhere switch let admins set visibility enterprise- or org-wide, limit sharing to the session's organization, and sign out of web, Desktop, CLI, and mobile at once, with Gerrit group and project access syncing into repo permissions. Scale also moved — multi-repo scans now cap at 1,000 repositories instead of 500, and MCP servers returning 401 mid-session trigger OAuth discovery.

Codex's terminal becomes a control room

Codex CLI's contribution is orchestration: an agent command center via codex agents --no-daemon that marks unread results, and a session picker that switches between connected backends while keeping your drafts, with saved chats surviving provider switches and network approval prompts closing when their requests end.