Permission hardening and mode control across the agent toolchain

Permission patches and auto-mode discipline at Anthropic

Three Claude Code releases in rapid succession tightened the agent's security posture. The most critical was v2.1.214, which fixed a permission-check bypass in Windows PowerShell 5.1 sessions and made Bash permission checks fail closed on file-descriptor redirect forms that Bash parses differently than the permission analyzer. The same release also added permission prompts for Docker daemon-redirect flags and fixed unbounded memory growth from oversized settings files. For teams that rely on the /verify and /code-review skills, v2.1.215 changed the default behavior: Claude no longer runs these skills automatically — they must now be invoked explicitly with /verify or /code-review. This gives developers more control over when Claude audits their work, reducing noise in fast-moving sessions.

A day earlier, v2.1.212 redesigned /fork so it copies your conversation into a new background session while you keep working — the old in-session subagent is now /subtask. It also added a claude auto-mode reset command to restore default auto-mode configuration, and fixed a plan-mode permission bypass that allowed file-modifying Bash commands to run without a prompt or SDK callback. Two additional releases hardened the agent further: v2.1.211 neutralized bidirectional-override and look-alike quote characters in permission previews that could visually alter approval messages, while v2.1.210 fixed isolation: 'worktree' subagents being able to run git-mutating commands against the main repo checkout instead of their own isolated worktree. For accessibility, v2.1.208 added an opt-in screen reader mode with plain-text rendering, alongside fixes for memory leaks in long sessions.

Claude Platform: mid-conversation system messages and admin API

Beyond the agent, the Claude Platform made mid-conversation system messages available on Claude Fable 5, Claude Mythos 5, and Claude Opus 4.8 across the API, Amazon Bedrock, and Google Cloud — no beta header required. This means developers can now dynamically adjust system instructions mid-turn without restarting a conversation, which is particularly useful for multi-step workflows where the context or constraints shift. Separately, a new Admin API beta for Claude Enterprise lets organizations list members, change roles, and manage groups and custom roles programmatically, reducing manual overhead for large teams.

ChatGPT desktop: one switcher to rule them all

On the OpenAI side, the story this week was about consolidation. The ChatGPT desktop app was redesigned with a global switcher for Chat, Work, and Codex modes, unified Recents across all conversation types, native Projects support, and cloud Work syncing across web, mobile, and desktop. The same update landed for ChatGPT Business and Enterprise & Edu users. On the enterprise side, ChatGPT Enterprise & Edu expanded admin APIs with workspace-scoped Admin keys and up to 120 days of credit and Codex analytics history in the Global Admin Console. Separately, ChatGPT supercharged search across chats, projects, and files on all platforms, with filters by content type — a small but meaningful improvement for navigating the growing volume of agent conversations.

OpenAI SDKs and Codex incremental updates

The OpenAI Python SDK and Go SDK both added a new endpoint for managing service account API keys under /organization/projects/{project_id}/service_accounts/{service_account_id}/api_keys, with the Python version also adding an owner_project_access filter on API key listing. The Node SDK added the same endpoint plus flickered async event iterators, streaming file uploads, and context to runTools callbacks. On the Codex front, v0.144.6 refreshed bundled instructions for GPT-5.6 Sol, Terra, and Luna, and corrected their context windows to 272,000 tokens, while v0.144.5 expanded dangerous-command detection with more rm forms and clearer rejection reasons.