--- collection: coding-agents collection_name: Coding Agents week_start: 2026-11-02 title: Coding agents learn to speak, ship, and lock themselves down release_count: 9 generated: 2026-11-09 canonical: https://releases.sh/collections/coding-agents/digest/2026-11-02 --- # Coding agents learn to speak, ship, and lock themselves down Cursor gave its agents a voice and a hosting button, Claude Code closed a sandbox escape and tightened auto mode, and Devin opened enterprise SSO to self-serve setup. ### Agents you can talk to, and apps you can ship Cursor's biggest week in a while went in two directions at once. Its agents now take realtime voice calls in the Agents Window, the IDE, on web, and on iOS: describe a change out loud, ask what an agent is working on, and hear progress as the work moves — running on Grok Voice with selectable voices and zero data retention under Privacy Mode, per [Cursor's voice chat rollout](https://cursor.com/changelog/voice-chat). The more consequential addition is [live app building and hosting](https://cursor.com/changelog/build-live-apps). Cloud agents can scaffold a web app, provision Postgres, put auth behind Cursor SSO, and deploy to a link on a domain you pick — with deterministic and agentic checks for exposed secrets or credentials, and nothing going live until they pass. The pitch is pointed: most apps agents write never leave localhost, and Cursor wants to be the thing that gets them off it. ### Claude Code hardens its permission boundary Anthropic's week was mostly about who gets to run what. The headline is a pair of security fixes in [Claude Code's sandbox and auto-mode changes](https://code.claude.com/docs/en/changelog#2-1-319): a sandbox escape when creating a worktree, and a Bash permission bypass where a crafted environment prefix could hide part of a command from permission checks. Auto mode itself now errs toward asking or denying when telemetry or feature flags are off and the server can't check a call, rather than silently falling back to the built-in classifier — `CLAUDE_CODE_AUTO_MODE_SERVER=0` restores the old behavior, and Bedrock, Vertex, and Foundry are unchanged. Elsewhere it was trust and continuity. [Nested session IDs came back](https://code.claude.com/docs/en/changelog#2-1-317) for `claude -p` inside self-hosted runners, MCP servers stopped disconnecting after the first turn in some desktop sessions, and Claude Code now asks before a web or shell tool call sends your account email to the network. Sign-in expiry dates now surface in `claude auth status` and `-p` JSON output with a warning ten days out, as part of [fixes for config loss on shared home directories and a --continue regression](https://code.claude.com/docs/en/changelog#2-1-318). ### Devin takes the admin work out of enterprise setup Cognition spent the week removing tickets from the enterprise onboarding path. [Self-serve SSO](https://docs.devin.ai/release-notes/overview#october-30-2026) lets admins verify domain ownership with a DNS record and create, edit, and delete their own OIDC or SAML connections, while budgets now organize user and org spend into a hierarchy with sub-limits, and security connections ingest findings from SonarQube, Linear, and Vanta. Enterprises without a PAT policy now default to approval required. Governance followed: [session sharing defaults and a log-out-everywhere switch](https://docs.devin.ai/release-notes/overview#november-6-2026) let admins set visibility enterprise- or org-wide, limit sharing to the session's organization, and sign out of web, Desktop, CLI, and mobile at once, with Gerrit group and project access syncing into repo permissions. Scale also moved — [multi-repo scans now cap at 1,000 repositories](https://docs.devin.ai/release-notes/overview#november-2-2026) instead of 500, and MCP servers returning 401 mid-session trigger OAuth discovery. ### Codex's terminal becomes a control room Codex CLI's contribution is orchestration: [an agent command center via `codex agents --no-daemon`](https://developers.openai.com/codex/changelog/#github-release-435979892) that marks unread results, and a session picker that switches between connected backends while keeping your drafts, with saved chats surviving provider switches and network approval prompts closing when their requests end. ## Releases covered ### Anthropic - [Claude Code 2.1.319 changes auto mode fallback and fixes sandbox escape](https://code.claude.com/docs/en/changelog#2-1-319) - [Claude Code 2.1.317 restores nested session IDs and fixes MCP disconnects](https://code.claude.com/docs/en/changelog#2-1-317) - [Claude Code 2.1.318 adds sign-in expiry dates and fixes data-loss bugs](https://code.claude.com/docs/en/changelog#2-1-318) ### Cognition - [Devin adds self-serve SSO, budgets, and default PAT approval](https://docs.devin.ai/release-notes/overview#october-30-2026) - [Devin adds session sharing controls, sign-out everywhere, and Gerrit permission sync](https://docs.devin.ai/release-notes/overview#november-6-2026) - [Devin raises multi-repo scan cap to 1,000 repositories](https://docs.devin.ai/release-notes/overview#november-2-2026) ### Cursor - [Cursor adds realtime voice chat with coding agents across IDE, web, and iOS](https://cursor.com/changelog/voice-chat) - [Cursor adds live app building and hosting with shareable links](https://cursor.com/changelog/build-live-apps) ### OpenAI - [Codex CLI 0.167.0 adds agent command center and cross-backend session switching](https://developers.openai.com/codex/changelog/#github-release-435979892)