Claude Code, Codex, Copilot, Cursor, MCP
AI tools for developers, from Claude Code and Codex to Copilot, Cursor and MCP: prices and limits, security fixes, breaking changes and measurements. We report what changes the work, not every release.
No item matches the filter.
The most serious fix in the release concerns MCP servers that require an OAuth sign-in. Three more fixes cover cases where a shell command or a file write got past a permission check. Claude Fable 5.2 also becomes the default Fable model.
Anthropicverified
OpenClaw's latest patch release adds no features and fixes a set of security problems. The most serious one let a settings file inside a project add programs from that project to the list of directories where the system looks for commands. Two of the fixes change existing behavior, so some setups need to be adjusted.
OpenClawverified
Copilot can now be picked as an agent in Air for local and cloud coding work, on an existing subscription. Air administrators can switch it off, but they cannot cap its spending in Air or see its usage in Air's analytics.
GitHubverified
Since version 2.1.314, Claude Code ships two sentences telling the model to build original games but not a copy of a specific existing one. Anthropic says the rule applies with Opus 5.5 and follows from its usage policy on intellectual property. Some developers report that work they hold the rights to is being refused.
Anthropicverified
AWS announced on October 29, 2026, that agents can call AWS Step Functions workflows as tools through Amazon Bedrock AgentCore Gateway. The agent decides when to start a workflow and with what input, while the workflow decides which steps run and in what order. Existing workflows work without changes, and both services bill at their standard rates.
AWSverified
A new permission setting makes the file-editing tools refuse any path outside the working directories, whatever mode the session runs in. The release also fixes a case in which a session could start without the organization's policy.
Anthropicverified
GitHub announced on October 28, 2026, that enterprises working with its sales team get Copilot as part of GitHub Enterprise, without separate seats or monthly credits. The same day, Copilot Fusion, which combines several models on one task, became generally available, and GitHub Agentic Workflows left preview. Each change moves cost control from seat counts to the AI budget.
GitHubverified
Services and agents built on the GitHub Copilot SDK can now authenticate as a GitHub App installed on an organization, in public preview. No person's credentials are involved, and every request is billed to that organization under its own model policies and spending controls. GitHub's documentation warns that the read-only permission the app needs still spends money.
GitHubverified
GitHub has made assisted permissions generally available in Copilot CLI, the GitHub Copilot app, and Visual Studio Code. A language model reviews each request to run a command, access a file system path, or open a URL, and only what it judges clearly safe runs without a prompt. GitHub's own documentation warns that the model can approve dangerous actions.
GitHubverified
Amazon announced TorchNeuron on October 19, 2026, a native PyTorch backend for its Trainium2 and Trainium3 chips. The public beta, released as open source under the Apache 2.0 license, followed a day later. Amazon says existing PyTorch code runs on Trainium with one configuration change, but the first release leaves out several PyTorch features, and no independent performance measurement exists yet.
Amazonverified
OpenClaw's new release closes a gap that let an ordinary plugin hook alter a tool call after a trusted policy had already approved it. Such a call is now blocked unless the hook asks for its own approval, which breaks plugins that relied on the old order. The release also makes Gemini 4 Argon the default Google model and points the gemini alias at it.
OpenClawverified
GitHub announced on October 15, 2026, that three models leave every Copilot experience on November 16, 2026, with Claude Opus 5.5 and GPT-6.1 Sol or GPT-6 Luna as suggested replacements. The same day, agentic autofix for code scanning alerts became generally available to Enterprise Cloud customers with Code Security or Advanced Security.
GitHub Changelogverified
On October 15, 2026, Figma opened code layers, which keep working code prototypes on the design canvas, to everyone in beta, along with Specs, a Markdown document that sits next to designs. Code layers use AI credits, but creating and editing them is free on paid plans through November 4. Figma Make now sets up a Payload backend with a database, user login, and an admin panel.
Figmaverified
GitHub added an identity setting to Copilot's enterprise telemetry on October 12, 2026. When an administrator turns it on, OpenTelemetry data carries the developer's GitHub login, local operating-system account, and machine name. Five separate switches decide whether prompts, responses, and tool data are captured, and all of them start off.
GitHubverified
AWS launched Lambda Web Functions on October 12, 2026. A Node.js server built with Express, Hono, or Next.js runs on Lambda without an adapter, and CPU time is billed only while the code is actually working. Existing Lambda functions are renamed Event Functions, with no code changes required.
AWSverified
A bug in OpenClaw's secret masking let a credential through whenever it straddled the boundary between two slices of a long text. The fix ships in 2026.10.2 along with repaired updates from 2026.10.1 and a new compaction default for OpenAI and Anthropic API keys.
OpenClawverified
OpenClaw released version 2026.10.1 on October 10, 2026, its first stable release since 2026.9.7. Agents can now search the skills installed on a machine and read only the one a task needs, instead of carrying the whole library in the prompt. Opt-in MCP Apps run beside chat, and full backups can go to an external drive or Cloudflare R2. Three changes can break existing setups: session-to-session messaging, the old required argument, and Workboard data stored before July 2026.
OpenClawverified
Python 3.15.0 came out on October 9, 2026. Files opened without an explicit encoding are now read and written as UTF-8 on every system, and a new lazy import statement defers loading a module until it is used. The release also adds frozendict and a sampling profiler.
Python Software Foundationverified
Ryan Dahl announced on October 9, 2026 that the whole Deno team is moving to Cloudflare. The Deno runtime will get monthly fixes for one more year before development ends, and Deno Deploy will shut down after six months. JSR keeps running.
Denoverified
Anthropic released Claude Code 2.1.294 on October 8, 2026. It fixes prompt and agent hooks phrased as instructions, which could allow exactly the actions they were meant to stop. Version 2.1.295 followed the same day with an onFailure setting that makes a crashed or timed-out command or HTTP hook block the action. Releases 2.1.292 and 2.1.293 from earlier in the week closed several permission and sandbox gaps.
Claude Code Releases (GitHub)verified
On October 7, 2026, GitHub made local sandboxing for Copilot generally available in the Copilot CLI, the GitHub Copilot app, and VS Code sessions that use Agent Host, at no extra cost. The sandbox limits what a command Copilot runs can read, write, and reach on the network, and it is off until you or your organization turn it on. The same day the CLI gained a picker for models served by a local Ollama instance, and Claude Haiku 5.5 joined the model list for paid plans.
GitHub Changelogverified
Vercel shipped Next.js 16.4 on October 6, 2026. Cache Components, the opt-in caching model built over the 16.x line, is now the recommended choice for every app and the default in new projects. The release adds a way to force a route to stay static, two APIs that keep content out of prefetches, an agent-driven upgrade command, React 19.3, and a smaller Turbopack cache.
Next.js Blogverified
Version 2.1.291, out on October 6, 2026, closes a regression that shipped in 2.1.288 on October 2, 2026 and could drop the last messages of a session when you quit. It also fixes a regression from 2.1.290, released on October 5, 2026, in cloud sessions. The day before, 2.1.290 had tightened several permission checks, including rules that were skipped after a hook rewrote a tool call. If you are on any version from 2.1.288 to 2.1.290, update.
Claude Code Releases (GitHub)verified
Meta published the Muse Gadgets repository on October 2, 2026, under the Apache 2.0 license. It contains firmware for ESP32 boards and a Linux device SDK that turns a Raspberry Pi into a device its Muse agent can operate. On Linux, Muse runs shell commands with the permissions of the account you install it for, including sudo if that account has it. Meta's documentation says pairing has no manufacturer verification and cannot prevent an active man-in-the-middle attack.
Metaverified
Anthropic introduced mods for Claude Code on October 1, 2026. They are TypeScript functions, shipped inside plugins, that can rewrite prompts, change tool calls, and redraw parts of the interface. The documentation says mods are not sandboxed and run with your permissions, which covers your files, environment variables, and API keys. On Team and Enterprise plans a built-in mod named sec-default loads first and restricts the mods that users install. Versions 2.1.288 and 2.1.289 fix several cases where permission rules did not hold.
Anthropicverified
GitHub deprecated four models across all Copilot experiences on October 2, 2026: Gemini 3.5 Flash, Gemini 3.6 Flash, Kimi K2.7 Code, and Claude Opus 4.7. On the same day it made Copilot code review available through the REST and GraphQL APIs. Balanced is now the default review effort level, a change that took effect on September 28, 2026. According to GitHub's documentation, a Balanced review consumes more AI credits than a Lite one.
GitHub Changelogverified
AWS announced a preview of AWS Well-Architected Agent on October 1, 2026. The service scans your AWS accounts on a schedule and returns recommendations for cost, security, resilience, and performance, ranked against business goals that you write yourself. Remediation scripts come attached, and the agent also reviews infrastructure-as-code templates on demand. Access requires an AWS Support plan at the Business+ tier or higher, and agent profiles are hosted in three US Regions.
AWSverified
Anthropic released Claude Code 2.1.287 on October 1, 2026. The release adds Claude Mods, which let plugins modify deeper behavior, and a built-in mod in which a side agent flags things you might miss. Opus 4.7 and later and Fable now use a 1M context window by default on Bedrock, Vertex, Foundry, and the Claude apps gateway. Some MCP servers may stop connecting until you add one line to their configuration, and several shell writes that used to run now wait for approval.
Claude Codeverified
GitHub put two Copilot features into public preview on October 1, 2026. Computer use lets Copilot CLI and the GitHub Copilot app operate desktop applications on macOS and Windows, and it stays off until you turn it on. Dynamic workflows run a multi-agent process that is defined in code, and they are available on all Copilot plans. GitHub's documentation warns that computer use can pick the wrong control and that on-screen content can trigger unintended actions.
GitHub Changelogverified
Reddit's developer portal now asks owners of Data API apps to register them, and says access for unregistered apps and users will start to be removed on January 12, 2027. The remaining public API access ends in March 2027. Ars Technica and TechCrunch report that a Reddit staff post on September 30, 2026, also announced the end of RSS support on November 13, 2026, with no replacement for feeds from communities you do not moderate. If your site, bot, or monitoring tool reads Reddit through either path, you now have deadlines.
Redditverified
HydraFusion sits in the model picker but is not a model. It chooses one of three workflows per request and can hand a task to two models in a row, one drafting and one checking. GitHub moved the research preview from Copilot CLI to Visual Studio Code and the Copilot app on September 30, 2026, for Pro, Pro+, Business, and Enterprise plans. Billing follows the tokens each model consumes, so a request can cost more or less than a single-model one.
GitHub Changelogverified
OpenClaw released version 2026.9.7 on September 30, 2026. It adds Sign in with ChatGPT as a login option next to Codex login and API keys, which OpenAI says lets Plus and Pro subscribers spend their plan allowance inside OpenClaw. A new plugin runs agents through the OpenAI Agents API. Updates now back up every database before migrating, admins can limit which models a role may use, and incognito sessions expire after 24 hours.
OpenClawverified
Nvidia announced the Open Agent Safety Platform on September 28, 2026. It pairs OpenShell, an open-source runtime under the Apache 2.0 license that confines an agent's file, process, and network access, with Sentry, a watchdog that runs on BlueField-4 data processing units and, according to Nvidia, stops an agent that leaves its boundary within milliseconds. Anthropic, Microsoft, Hugging Face, Salesforce, SAP, and OpenClaw are among the organizations Nvidia lists.
NVIDIA Newsroomverified
Anthropic released Claude Code 2.1.285 on September 29, 2026. A new managed setting, allowedProviders, limits which API providers a machine may use. Two fixes matter for teams: sessions that authenticate with an auth token never loaded the organization's policy, and redacted logs could show a URL password. The release also adds a switch that turns off WebFetch and a command that opens the desktop app.
Claude Codeverified
OpenAI turned Codex cloud tasks into published environments that a team can reuse, with each task in its own workspace and work continuing while your laptop sleeps. The CLI takes spoken instructions and shows parallel tasks in a new view. Codex Security Cloud scans whole GitHub repositories and prepares fixes in the cloud. The Agents API now drives a computer, and a Bedrock version runs the same agents inside AWS.
OpenAIverified
Anthropic released Claude Code 2.1.284 on September 28, 2026. The release closes a gap that let plugins from marketplaces, claude.ai, and npm pre-approve their own tools even when managed settings allowed only managed permission rules. It also validates a Foundry setting that went straight into a hostname, and adds Claude Sonnet 5.5.
Claude Codeverified
Google added local model support to the Antigravity SDK on September 23, 2026. The first supported setup is Gemma 4 26B A4B running through LiteRT, and Google recommends more than 24 GB of video or unified memory. The SDK can also talk to local servers such as Ollama, LM Studio, and vLLM.
Google Developers Blogverified
GitHub shipped four Copilot changes on September 25, 2026. The largest update is to Copilot in Slack and Microsoft Teams, which now uses shared files and forwarded messages as context. Agentic autofix now learns from Copilot Memory, and administrators get review-time metrics and a settings validator.
GitHub Changelogverified
Anthropic opened a submission portal for the Claude directory on September 25, 2026. Developers on paid Claude plans can submit a single MCP connector or a plugin bundle, follow its review, and see usage data once it is live. Existing listings need no changes.
Claude Blogverified
Anthropic released Claude Code 2.1.283 on September 25, 2026. Interactive sessions on third-party providers, or with telemetry off, now start in auto mode when no permission mode is configured. Administrators get two managed settings that decide which model versions a team may use.
Claude Codeverified
