Claude Code 2.1.309 hardens its sandbox, OpenCode patches Bun, Hermes ships a 620-PR rollup

The headline fixes are about containment. Sandboxed Bash on macOS and Linux no longer runs the shell's startup files outside the sandbox before each command; sandboxed commands and auto-accepted edits can no longer modify the file passed with --mcp-config; a disabled MCP server is no longer reconnected by a later permission prompt in print and SDK sessions; and several Bash permission checks that could be skirted — cd-prefixed git commands, an Edit(path) deny rule beaten by a redirect inside a subshell command — now prompt or block as intended. Worktree-isolated sessions also stop accepting some locale-prefixed and zsh arithmetic commands the isolation guard should refuse.

Why it matters now: this is the unglamorous half of “let the agent run unattended.” Auto mode, routines and cloud sessions all lean on the sandbox and permission rules being the actual boundary rather than a suggestion, and a release that fixes a dozen ways around them is a reminder to pin to recent builds on any runner that executes untrusted repos. The release also makes Claude stop writing role names and placeholders as GitHub mentions — a small fix that quietly stops notifying strangers.

claude ultrareview now asks for workspace trust on a terminal and otherwise refuses; scripts must pass --trust-workspace (or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1). In bypass-permissions mode in the Desktop app and VS Code, dangerous rm/rmdir commands are now denied immediately with a rewrite hint instead of prompting — so unattended sessions keep going rather than stalling on a prompt nobody will answer. sed -i now gets the standard Bash prompt and runs as written, and is no longer restored by /rewind.

The notable ecosystem line is buried: the bundled /claude-api skill now builds Managed Agents subagent teams on multiagent_20261001 with dynamic workflows on by default, instead of coordinator. That is a tell about where Anthropic expects multi-agent orchestration to live — in the platform API rather than in client-side glue — and it will shape the code the skill generates for everyone who asks it to scaffold an agent.

The release's one improvement: Bun 1.4.4, which the notes say carries security fixes for Brotli, TLS, HTTP/1.1, HTTP/2, HTTP/3, WebSocket and fetch, plus root certificates updated to NSS 3.131.1. There is no feature in it — and that is the point.

Coding agents ship their own JavaScript runtime and then talk to model providers, MCP servers and package registries from it, so the runtime's HTTP stack is part of the agent's attack surface. Expect the “we bumped the embedded runtime” release to become a routine line item for every self-contained agent CLI.

According to The Hacker News, a flaw in the OpenCode coding agent let a malicious MCP server run code on Windows and WSL machines during the OAuth sign-in step; its maker, Anomaly, fixed it in version 1.18.33 on September 28. Spotlight could not fetch the article body this run, so details beyond that summary are omitted.

The pattern is the story: the dangerous moment in MCP is increasingly not a tool call but the connection handshake — discovery, auth redirects, server-supplied URLs — which happens before any permission prompt exists. Treat adding an untrusted remote MCP server like installing software, not like pasting a URL.

Since the last edition's alpha.10 and 0.163.0-alpha.11.1, OpenAI has tagged 0.164.0-alpha.11, 0.163.0-alpha.11.2 and 0.164.0-alpha.12 in a single day. All five most recent entries on the releases page are pre-releases and none carries the Latest label; the release notes are bare (“Release 0.164.0-alpha.12.”).

What changed is the shape of the hold: the stable branch is now being patched through a second alpha-numbered backport while the next minor keeps iterating, which reads like a team shipping fixes to users on 0.163 while holding 0.164 for a larger gate. If you pin Codex in CI, the practical advice is unchanged — pin the stable tag, not the alpha stream.

7.0.149 processes only the first approval response per tool call, so repeated or conflicting approvals can no longer run a tool twice or both run and deny it; forwards toolChoice: 'none' to the Hugging Face Responses API; and adds an interrupted finish reason for streams that end without a completion signal — which the release itself warns can break type-checking, since exhaustive switches over FinishReason need a new case. 7.0.150 adds experimental_streamSpeech for streaming speech audio from text. The approval and tool-choice fixes were backported to 6.x within hours.

Human-in-the-loop approval is a security control, and double-execution on conflicting responses is exactly the bug a malicious or buggy client would exploit. The interrupted reason is the subtler win: agents that treat a silently truncated stream as success are a common source of half-finished side effects.

The release requires Node 24.22.1+ or 26.12.1+, which reject TLS chains signed with compromised certificate keys, and openclaw update now refuses to install on older Node. The rest is described as reliability fixes only: safer updates with data-preserving migrations and backups, more dependable delivery across restarts, and fixes for model providers, Windows, iOS and the WhatsApp, Telegram, Slack and Discord channels.

A personal agent that holds your messaging accounts is a high-value TLS client; making the updater refuse to run on a vulnerable runtime is the right trade of convenience for safety. Note the numbering oddity worth watching: a stable 2026.10.6 shipping alongside 2026.10.10 betas.

v0.22.3 is an uncurated rollup of about 620 merged PRs since v0.22.2 across the CLI and installer, the Microsoft Store app, Docker and Hermes Cloud; the maintainers say detailed notes will come with v0.23.0. Mentioned changes include live MCP progress notifications, a refreshed classic CLI layout, OAuth support for plugins, and a return to opt-in session auto-pruning. v0.22.4 removes the Desktop composer's MCP-setup suggestion pills, skips the empty consent prompt for dependency-free plugins, and adds catalog entries including bubblewrap, Singularity/Apptainer, mcp-serve and an agent-importers entry with Cursor support.

Reverting auto-pruning to opt-in is the telling detail — a self-improving agent's memory is its product, and silently deleting sessions was the wrong default. The sandbox-runtime catalog entries (bubblewrap, Apptainer) show the project pulling isolation into the plugin surface.

Per search-indexed coverage, Figma announced 20 new MCP partners at its first Config conference in India — including Amp, ClickUp, Dia, JetBrains' Junie, Linear, Meta Muse, Mistral, Notion, OpenCode and Sarvam Agents — while Field said MCP is not a perfect protocol and that unrestricted data access could raise security risks. We rely on those headlines and have not read the full interview.

The pairing is the signal: the company that sits on the design side of the agent loop is simultaneously the most enthusiastic integrator and publicly nervous about permissions. Combine it with this week's OpenCode and Claude Code sandbox fixes and the consensus forming is that MCP's next phase is about scoping, not reach.

Qlik announced that its MCP server is now listed in Claude's directory, so Claude users can connect governed Qlik business context and analytics workflows. The press release headline is the only part we could verify this run.

Directory listings are becoming the enterprise distribution channel for MCP: the buyer asks which governed data source Claude can reach, and the vendor with a listing answers first. The open question is how much of Qlik's governance model survives the hop through a general-purpose agent.

SiliconANGLE reports that Mave Security Ltd. raised $34 million, combining two rounds, for an agentic platform that connects an enterprise's existing security tools and handles threats from first alert through response.

The thesis is agents-as-glue rather than agents-as-replacement: leave the SIEM and EDR where they are and let an agent do the swivel-chair triage. It joins a crowded field of agent-security raises this autumn, which is itself a sign of where buyers think the risk sits.

Silicon Republic reports a $250 million Series E for Paris-based planning platform Pigment, with the pitch centered on its patent-pending Graphite compute engine and the AI agents that run on it. Investors and valuation are not stated in what we could verify.

Not an agent-native company, which is exactly why it matters: incumbents in finance planning are rebranding their engines as agent substrates, and a quarter-billion-dollar round says investors will fund that story.