Your Subagents Fork by Default, Cursor Agents Hand You a Canvas, and GitHub Checks the License First

At a glance

• Claude Code can now fork subagents by default in scripts, the SDK, the desktop app and VS Code.
• Standalone Claude Design is closing, and Claude Code now warns you.
• Cursor cloud agents can hand back a canvas your team opens from a link.
• GitHub can block a merge on license policy, and agents can check a package first.

Friday was quiet on the surface, but each change moves a default that decides how an agent hands its work back to you. Treat today as a weekend defaults audit: rerun one scripted Claude Code job on the new defaults, ask one Cursor cloud agent for a canvas, and ask whoever owns dependency policy whether license compliance belongs in your rulesets.

Top Stories

1. Claude Code forks more of its work and moves some headless defaults

Anthropic published Claude Code v2.1.302 to npm at 12:48 PM ET Friday, and it holds both latest and next, while stable still read v2.1.292 at our 5:54 AM ET check Saturday. Fork subagents, requested as subagent_type: "fork", are now on by default in claude -p, the Agent SDK, the desktop app and VS Code, as they already were in the terminal. Setting CLAUDE_CODE_FORK_SUBAGENT=0 turns them off, and claude mcp serve never offers them.

Claude Code's subagents docs, in a copy we saved on Oct 14 and did not fetch again today, describe a fork as a subagent that inherits the entire conversation so far, with the same system prompt, tools, model and message history, and only its final result comes back.

Other defaults moved too. The desktop app and VS Code now always run the main conversation's subagents in the background, as the terminal does, while a subagent's own Agent calls in claude -p, the SDK, the desktop app and VS Code run in the foreground by default. On third party providers, claude -p and Agent SDK sessions that set no permission mode now start in default mode with telemetry off or on a fresh install, and the changelog says --permission-mode auto keeps auto. Prompt and agent hooks now run at most 12 of one event at a time, and the rest wait.

Separately, /design-sync and /design-login now warn that standalone Claude Design at claude.ai/design closes by Monday 14 December 2026.

Practical dev impact: If you run Claude Code from scripts, CI or the SDK, the same prompt can now spread across forked subagents, and on third party providers under those telemetry conditions it may start in default mode, which in our reading can mean permission prompts in an unattended run. Our advice is to rerun one representative job and pin the behavior you want with the environment variable or an explicit mode, and Claude Design users should calendar the December date.

2. Cursor cloud agents can hand back a canvas instead of a wall of text

Cursor's changelog entry dated Friday 16 October says cloud agents can now build interactive canvases as part of their work, and you can share a finished canvas with your team by sending its link. The sharing rules come from Cursor's canvas docs, not the changelog. They describe a canvas as a standalone view with sections, stats and tables that you can reopen and rerun, and a published link gives teammates a read only live snapshot in the browser. Sharing needs a paid plan, a team and a privacy mode that allows data storage, and team admins can switch it off.

The same entry puts an Environments API in beta for creating and managing the cloud environments agents run in, and Cursor's API reference lists create, list, get, update and delete endpoints under /v1/environments. Environments now hold up to 300 repositories, and Cursor says large ones load five times faster. The Cursor CLI changelog had nothing new and still tops out at v2026.10.08 at our 5:54 AM ET check Saturday.

Practical dev impact: In our view a canvas is a better handoff for audits and test reports than a chat transcript, because a reviewer can open the result without reading the agent's reasoning, but a shared link carries data out of the chat, so check your privacy mode first. Platform teams can now script environments, though the API is beta.

3. GitHub makes license policy a merge gate that agents can query

GitHub's changelog announced at 10:00 AM ET Friday that open source license compliance is generally available for GitHub Enterprise Cloud, including data resident customers, on repositories with GitHub Code Security enabled. It extends the dependency review action with an enterprise wide license policy that a ruleset condition, Require license compliance results before merging, switches on. Pull requests that add or change dependencies get an annotation for each noncompliant package, cleared by removing or replacing it, amending the policy, or a package exception that a new Enterprise Open-Source License Manager role approves.

Since the June preview, GitHub added audit log events for policy changes, endpoints to download, update and replace the policy, and an endpoint that checks whether packages comply, which GitHub says lets coding agents avoid adding packages that break license rules. The post does not name that endpoint's path, so neither do we.

Practical dev impact: In our reading, agents that add dependencies on their own are where license slips go unnoticed, so a merge gate plus a check the agent can call first should mean fewer late rejections. Teams without Enterprise Cloud and Code Security do not get this.

Practical Impact Analysis

All three stories sit where an agent hands work back, so in our view the weekend move is to check your defaults before Monday. Claude Code v2.1.302 is the one that can change running work unannounced: a nightly job could fork more parallel work than you expect, or, on a third party provider with telemetry off or on a fresh install, wait in default mode on a prompt nobody watches. Individuals can take it from latest, while cautious teams can stay on stable at v2.1.292 until one headless job reruns cleanly. Cursor's canvases are opt in, and license compliance is a call for whoever owns your rulesets.

Elsewhere, at our 5:54 AM ET check Saturday, Copilot CLI latest held at v1.0.98 while prerelease moved to v1.0.100-1 at 6:46 PM ET Friday with no changelog notes, Codex latest held at v0.163.0 with alpha at v0.164.0-alpha.3 from 12:14 AM ET Saturday, and Gemini CLI held at v0.64.0 with preview at v0.65.0-preview.0 and a v0.66.0 nightly at 9:43 PM ET Friday. GitHub also made the Xcode 27 runner image generally available at 12:36 AM ET Friday, on Apple Silicon runners only.

Tutorial

We have not run this script end to end on every platform, so read it before you run it. It prints channel pointers, your local version and one setting, and every line that installs or changes behavior is commented out and labeled.

#!/usr/bin/env bash
# We have not run this script end to end on every platform. Nothing below installs or changes anything unless you uncomment it.
# 1. Channel pointers. At 5:54 AM ET Sat 17 Oct npm showed Claude Code
#    stable v2.1.292, latest and next v2.1.302.
npm view @anthropic-ai/claude-code dist-tags --json

# 2. What this machine runs
claude --version

# 3. Is fork mode switched off in this shell? Prints one variable only.
echo "CLAUDE_CODE_FORK_SUBAGENT=${CLAUDE_CODE_FORK_SUBAGENT:-unset}"

# 4a. Optional, Claude Code latest and next channel, npm installs only, at 5:54 AM ET Sat 17 Oct:
# npm install -g @anthropic-ai/claude-code@2.1.302

# 4b. Optional, Claude Code stable channel, npm installs only, at 5:54 AM ET Sat 17 Oct:
# npm install -g @anthropic-ai/claude-code@2.1.292

# 5. Optional, documented in the v2.1.302 changelog: keep fork subagents off for this shell
# export CLAUDE_CODE_FORK_SUBAGENT=0

# 6. Optional, untested by us. The changelog says --permission-mode auto keeps auto.
# claude -p "summarize the open TODO comments in this repo" --permission-mode auto

# 7. Optional: time the same headless job before and after step 5 and compare output
# time claude -p "summarize the open TODO comments in this repo" > run-after.txt

Run step 7 with and without step 5 and compare run time, output and permission prompts. We did not execute step 6, so treat it as untested and use it only where you already trusted auto mode. Do not mix npm and native installs of the same tool on one machine.

Recommended AI prompt

Copy this paragraph into ChatGPT, Claude, Gemini, Grok, or whatever AI you use.