Claude Code Seals Its Sandbox Leaks, Codex v0.164 Masks Credentials, and Copilot Fills In the Settings You Never Set

At a glance

• Claude Code's newest build stops your shell startup files from running outside its sandbox and closes several permission gaps, but stable has not picked it up yet.
• The same build makes claude ultrareview ask for workspace trust and stops /rewind from undoing sed -i edits.
• Codex adds numbered prompt presets, inline permission switching and credential masking for remote Bash.
• Copilot Business and Enterprise features you never configured are about to be set by your global default.

Yesterday was about recording what your agents were told no. Today is about whether the walls were solid, and who sets the defaults. Treat today as a check the fences day: move sandboxed Claude Code machines to the new build, find the scripts that call claude ultrareview, save one tight Codex preset, and confirm your Copilot default policy before the rollout reaches you.

Top Stories

1. Claude Code v2.1.309 closes sandbox gaps, and two habits change

Claude Code v2.1.309 was published to npm at 4:34 PM ET Thursday 22 October, and at our 6:01 AM ET check it served latest and next, while stable stayed on v2.1.308. The security fixes matter most. Sandboxed Bash commands on macOS and Linux had been running the shell's startup files outside the sandbox before each command. Sandboxed commands and auto accepted edits could modify the MCP config file passed with --mcp-config. An Edit(path) deny rule did not always block a Bash redirect to that path when the command also held a subshell.

Two changes alter behavior you may rely on. claude ultrareview now requires workspace trust: it asks on a terminal and refuses otherwise. Scripts can pass --trust-workspace, which takes no value, so put any PR number or base branch before it, or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1. And sed -i now gets the standard Bash prompt and runs as written instead of showing a simulated edit preview, so like other Bash edits it is no longer restored by /rewind. In the Desktop app and VS Code, a dangerous rm or rmdir in bypass permissions mode is now denied at once with a rewrite hint, so unattended sessions keep going.

Practical dev impact: If your team leans on the Claude Code sandbox, the startup file fix is reason enough in our view to move those machines to v2.1.309 rather than wait for stable, since anything in your shell profile was running unsandboxed. Then check CI jobs that call claude ultrareview, and stop counting on /rewind after sed -i.

2. Codex v0.164.0 reaches latest with presets and credential masking

OpenAI published Codex v0.164.0 on GitHub at 12:48 AM ET Friday, and npm latest moved from v0.163.0 to v0.164.0 at 12:52 AM ET. You can now save reusable prompts and slash commands in ten numbered /presets slots with a keyboard menu, and set model, reasoning effort, speed and permission profiles directly with inline /model and /permissions arguments. Codex now masks credentials during supported remote Bash commands and Zsh snapshot sessions, including credentials from custom providers. Enterprise MCP connections can now sign in through eligible Codex account grants or a dedicated sign in.

Among the fixes, a failed compaction no longer leaves partial summaries behind, resumed sessions restore their saved thread settings instead of global defaults, and queued prompts wait for pending permission choices. Sandbox checks were also hardened on macOS and against replaceable symlinks used to locate executables.

Practical dev impact: Presets plus inline /permissions make it quick to drop a session into a tighter profile, so in our view this is a good moment to save one preset for read only review work. Resumed threads should now keep the model and permissions you chose.

3. Copilot's global default starts filling in unset features

At 4:44 PM ET Thursday, GitHub said it is gradually rolling out enforcement of the global default policy for generally available Copilot features on Copilot Business and Enterprise through October 26, so it may land at different times for different enterprises and organizations. Eligible features and capabilities left Unconfigured will be set to your selected default of Enabled, Disabled or Let organizations decide. It covers eligible settings under "Features & clients" and "MCP servers in Copilot." It is a one time change, explicit choices are preserved, and preview features stay opt in.

At 6:19 PM ET, GitHub added that Copilot usage metrics now show the configured names of your own skills, custom agents, MCP servers, slash commands and plugins instead of grouping them under other or custom, with up to 25 entries per list, up from five. Names appear only for report days processed after the release.

Practical dev impact: If your organization never touched individual Copilot feature or MCP server settings, your global default now decides them, so check AI Controls, then Copilot, then Default policy for new features before Monday. Teams that ship internal MCP servers can now see which ones get used.

Practical Impact Analysis

All three stories are about the boundaries around an agent rather than what it can write. In our view the Claude Code release is the most urgent, because a sandbox that ran your shell profile outside its walls was weaker than its settings suggested, and the fix sits only on latest and next today. The ultrareview trust prompt is the change most likely to break something quietly: the changelog says it refuses when there is no terminal, so in our reading a CI job that ran yesterday without --trust-workspace will now refuse. The Copilot rollout is an admin task with a hard date, so put it on someone's calendar today.

Elsewhere, Copilot CLI v1.0.103 reached npm latest at 12:21 PM ET Thursday, which means the retirement of the --remote and --no-remote startup flags we flagged yesterday on the prerelease now reaches everyone on latest. GitHub's Copilot in Visual Studio September update carries a breaking change: Bring Your Own Model now requires the new Agent (Preview), and previously configured Ollama models must be added again. VS Code v1.143.1 is out as a fix update to v1.143. At our check, Gemini CLI and Cursor had nothing new beyond a Gemini nightly.

Tutorial

Read this script before you run it. Every search prints file names only.

1. Run step 1 on each machine that uses Claude Code with its sandbox.
2. Run steps 2 and 4 from the folder that holds your CI and automation scripts.
3. Run step 3 if you use Codex, then try /presets in a test repo.
4. For Copilot Business or Enterprise, open AI Controls, then Copilot, then Default policy for new features, and confirm the setting by hand.

# We have not run this script end to end on every platform. It only prints and searches unless you uncomment a line.
# 1. Claude Code. At 6:01 AM ET Fri 23 Oct npm showed latest and next on v2.1.309, stable on v2.1.308.
npm view @anthropic-ai/claude-code dist-tags --json
if command -v claude >/dev/null; then claude --version; else echo "claude not on PATH"; fi
#    Optional, npm installs only. Pinned at 6:01 AM ET Fri 23 Oct, latest and next channel:
# npm install -g @anthropic-ai/claude-code@2.1.309

# 2. Files that call ultrareview, which now needs workspace trust. File names only.
if grep -rl -e "claude ultrareview" . --include="*.sh" --include="*.yml" --include="*.yaml" --include="*.json"
then echo "check these files for --trust-workspace"; else echo "no ultrareview calls found here"; fi

# 3. Codex. npm latest moved to v0.164.0 at 12:52 AM ET Fri 23 Oct.
npm view @openai/codex dist-tags.latest
if command -v codex >/dev/null; then codex --version; else echo "codex not on PATH"; fi
#    Optional, npm installs only. Pinned at 6:01 AM ET Fri 23 Oct, latest channel:
# npm install -g @openai/codex@0.164.0

# 4. Copilot CLI startup flags retired in v1.0.103, now on latest. File names only.
if grep -rl -e "copilot .*--remote" -e "copilot .*--no-remote" .
then echo "these files start Copilot CLI with a retired flag"; else echo "no --remote or --no-remote calls found here"; fi
if command -v copilot >/dev/null; then copilot --version; else echo "copilot not on PATH"; fi
#    Optional, npm installs only. Pinned at 6:01 AM ET Fri 23 Oct, latest channel:
# npm install -g @github/copilot@1.0.103

If step 2 finds an ultrareview call in CI, add --trust-workspace after any PR number or base branch. Step 4 only catches calls where copilot and the flag sit on one line, and the notes do not name the replacement flags, so check copilot --help rather than guessing. If you installed Claude Code natively, update it the native way and do not mix npm and native installs on one machine.

Sources:

• Claude Code changelog
• Codex v0.164.0 release
• Global default for Copilot features generally available
• Custom skills, agents, and MCP servers in usage metrics API
• Copilot CLI v1.0.103 release notes
• GitHub Copilot in Visual Studio, September update
• Visual Studio Code v1.143 release notes
• Gemini CLI releases
• Cursor changelog
• Cursor CLI changelog

Recommended AI prompt

Copy this paragraph into ChatGPT, Claude, Gemini, Grok, or whatever AI you use.