Skip to content
What are you looking for?. Open searchSR

Tags

permissions

40 items
CLAUDE CODE2.1.294hooks written as instructions now block what t
Agentsmedium signal

Claude Code 2.1.294 fixes prompt hooks that let through the actions they were written to block

Anthropic released Claude Code 2.1.294 on October 8, 2026. It fixes prompt and agent hooks phrased as instructions, which could allow exactly the actions they were meant to stop. Version 2.1.295 followed the same day with an onFailure setting that makes a crashed or timed-out command or HTTP hook block the action. Releases 2.1.292 and 2.1.293 from earlier in the week closed several permission and sandbox gaps.

Claude Code Releases (GitHub)verified

Agentsmedium signal

GitHub Copilot ships a local sandbox for agent commands and lets its CLI pick models from Ollama

On October 7, 2026, GitHub made local sandboxing for Copilot generally available in the Copilot CLI, the GitHub Copilot app, and VS Code sessions that use Agent Host, at no extra cost. The sandbox limits what a command Copilot runs can read, write, and reach on the network, and it is off until you or your organization turn it on. The same day the CLI gained a picker for models served by a local Ollama instance, and Claude Haiku 5.5 joined the model list for paid plans.

GitHub Changelogverified

CLAUDE CODE2.1.291fixes a session-loss regression from 2.1.288
Agentsmedium signal

Claude Code 2.1.291 fixes a four-day-old bug that could lose the last messages of a session

Version 2.1.291, out on October 6, 2026, closes a regression that shipped in 2.1.288 on October 2, 2026 and could drop the last messages of a session when you quit. It also fixes a regression from 2.1.290, released on October 5, 2026, in cloud sessions. The day before, 2.1.290 had tightened several permission checks, including rules that were skipped after a hook rewrote a tool call. If you are on any version from 2.1.288 to 2.1.290, update.

Claude Code Releases (GitHub)verified

Agentsstrong signal

Claude Code mods are not sandboxed, and version 2.1.289 fixes a deny rule they could override

Anthropic introduced mods for Claude Code on October 1, 2026. They are TypeScript functions, shipped inside plugins, that can rewrite prompts, change tool calls, and redraw parts of the interface. The documentation says mods are not sandboxed and run with your permissions, which covers your files, environment variables, and API keys. On Team and Enterprise plans a built-in mod named sec-default loads first and restricts the mods that users install. Versions 2.1.288 and 2.1.289 fix several cases where permission rules did not hold.

Anthropicverified

Agentsmedium signal

Apple will add controls to Full Disk Access on macOS, citing risks from AI agents

Apple said on October 2, 2026, that it will add controls to Full Disk Access, the macOS permission that lets an app read nearly everything on a Mac. The company says some developers use the permission in ways that expose files, mail, messages, and browsing history without users fully understanding it. Apple expects the risk to grow as AI agents become more capable and autonomous. The post gives no date, no macOS version, and no description of the new controls.

Appleverified

Agentsstrong signal

Meta extends Muse to small businesses while the agent hands one user's home address to a stranger

Meta announced Muse for Small Business on September 29, 2026: the agent now connects to 15 named services, from Shopify and Stripe to QuickBooks and Slack, plus Facebook, Instagram and Meta ad accounts. It is free for most uses, with subscription plans the post does not price, and it is available in the United States and Canada. The same day, The Verge reported that Muse had given a YouTuber's home address to a stranger on Facebook Marketplace after he chose the permanent permission option. Meta says nothing publishes, sends, or spends without approval; the incident shows what one approval can cover.

Meta Newsroomverified

Agentsmedium signal

Claude Code 2.1.285 lets admins restrict API providers and fixes a token login that skipped org policy

Anthropic released Claude Code 2.1.285 on September 29, 2026. A new managed setting, allowedProviders, limits which API providers a machine may use. Two fixes matter for teams: sessions that authenticate with an auth token never loaded the organization's policy, and redacted logs could show a URL password. The release also adds a switch that turns off WebFetch and a command that opens the desktop app.

Claude Codeverified

Agentsstrong signal

OpenAI launches Dots, always-on agents with their own cloud computer, for Pro and Business Premium plans

A dot runs on GPT-6 Astra, has its own cloud computer and browser, and reaches more than 4,000 apps through plugins. It messages you with progress and questions in ChatGPT, Slack, or Teams, and keeps working while you are away. The first dot is included in a Pro or Business Premium plan, and talking to it does not count against ChatGPT limits. Enterprise workspaces get a beta that is off until an administrator turns it on.

OpenAIverified

Agentsmedium signal

Claude Code 2.1.284 stops plugins from pre-approving their own tools under managed permission rules

Anthropic released Claude Code 2.1.284 on September 28, 2026. The release closes a gap that let plugins from marketplaces, claude.ai, and npm pre-approve their own tools even when managed settings allowed only managed permission rules. It also validates a Foundry setting that went straight into a hostname, and adds Claude Sonnet 5.5.

Claude Codeverified

Connectorsmedium signal

Claude Tag can now use your own connectors when you ask it something in a Slack channel

Anthropic announced on September 24, 2026, that Claude Tag can use the connectors of the person who makes a request in a Slack channel. Until now it could reach only the connectors an administrator attached to the channel. The feature is rolling out on Team plans, with Enterprise to follow.

Claude Blogverified

Agentsmedium signal

Claude Code 2.1.282 stops repository settings from switching on telemetry export

Anthropic released Claude Code 2.1.282 on September 24, 2026. Project and local settings files can no longer turn on OpenTelemetry export, set where it goes, or capture content. The release also closes several ways a repository's files could weaken settings an administrator manages.

Claude Codeverified

Agentsmedium signal

Gemini CLI 0.61.0 asks before running a build it edited and keeps credentials out of its sandbox

Google released Gemini CLI 0.61.0 on September 23, 2026 with two security fixes. The agent now asks before it runs a build or test command after a build file changed in the same session, and before it uses flags that came from outside content. The sandbox no longer receives the host's configuration directory, API keys, or credential files. Setups that mount sensitive paths into the sandbox will now fail to start.

Gemini CLIverified

Toolsmedium signal

ChatGPT Voice can now use plugins and run Work tasks on the web and on phones

OpenAI changed two things in ChatGPT Voice on September 23, 2026. The Live voice mode can now call the plugins and connected apps on your account, on the web, iOS, and Android. Voice also works inside Work, where it can build documents, presentations, and spreadsheets or operate a browser. Approvals still happen on screen, because spoken approval is not supported.

OpenAIverified

Agentsmedium signal

Claude Code 2.1.280 and 2.1.281 fix four cases where permission checks let an action through

Two Claude Code releases on September 22 and 23, 2026 close four gaps in how the tool decides what needs your approval. A write through a symlink could land outside the project, and a recursive delete aimed at a command substitution ran without a prompt in auto mode. A rule containing a NUL byte matched everything. One behavior change also reaches every user: the y and n keys no longer answer dialogs.

Claude Codeverified

Agentsmedium signal

The GitHub Copilot app can now sandbox local sessions, but the setting is off by default

Since September 23, 2026, the GitHub Copilot app can limit what a local agent session reaches on your machine: folders, network access, and Git and GitHub CLI credentials. The feature is in public preview and has to be switched on for each project. A day earlier the app gained OpenTelemetry export for administrators, and Copilot code review settings reached every plan.

GitHub Changelogverified

Machines & local modelsmedium signal

llama.cpp stops handing the API key file to child servers in router mode

Build b11077, published on September 21, 2026, fixes an authentication bug in llama.cpp's router mode. When a server was started with both a key on the command line and a file of keys, the child instances it spawned validated against the file only, so a client using the command-line key could list models but got 401 on every chat request. The same change stops the key file path from reaching a child process at all. It is one line in one file, and it is the difference between a working deployment and one that looks healthy while refusing work.

llama.cppverified

Agentsstrong signal

Amazon has cut Meta's Muse agent off from shopping on its store

Amazon says it has blocked Meta's Muse from buying on its site for customers, after asking Meta to leave the store out of the product and getting nowhere. Shoppers who send Muse to the site are shown a notice calling it an unauthorized agent and citing Amazon's terms. The objection is not automation: it is that the agent arrived unannounced and does not say who it is while it browses. For anyone building an agent that acts on someone else's site, this is the first clear case fought over terms of service rather than over the federal anti-hacking law.

GeekWireverified

Agentsmedium signal

OpenClaw 2026.9.5 reloads plugins without stopping the Gateway and shares conversations read-only

Installing, reloading, updating, or removing a plugin no longer takes the whole installation offline. Session Share hands a chosen group of conversations to a teammate on another paired installation as text they can read but not continue. Updates now validate the next version against a private copy of the setup while the current Gateway keeps running. The conversation database changes in this release even with archiving switched off, so a verified backup before upgrading is the only way back.

OpenClawverified

Agentsstrong signal

Claude Code 2.1.278 moved auto mode's safety checks to the server, where they are not billed

In auto mode a classifier inspects shell commands and network requests before they run, and those checks were separate model requests charged as token usage. From this version Claude Code asks the server to perform them inside the session's own requests, and does not charge for them when the server answers. The default covers Enterprise plans, Claude API accounts, and the AWS, Bedrock, Agent Platform, and Foundry paths, subject to each platform's rollout. Where the server's checks cannot reach a session, the earlier billing returns and a one-time notice says so.

Claude Codeverified

Agentsmedium signal

Meta's Muse reached the Mac, where the agent acts inside your own files and apps

Meta announced Muse on September 8, 2026 as a personal agent that does things rather than answers questions, and named iOS, Android and the web, with AI glasses still to come. The Mac app arrived nine days later, announced by Alexandr Wang on X rather than through the company newsroom. The difference is not only the platform. Until now Muse worked inside a virtual machine Meta runs, watched by a second agent that has to approve anything leaving for the internet; the Mac app works in files, apps and browser tabs on a machine Meta does not run.

Metaverified

Agentsmedium signal

Google's CC agent gets an account of its own and admits six household members

Google Labs has turned CC, its experimental personal agent, into one that a household shares. The agent now holds its own verified Google account, admits up to six members, and reads only the mail and files each of them hands over. It writes a shared morning brief, keeps the group calendar and task list, and fills in registration PDFs. The experiment is open on web and mobile to people 18 and older in the United States.

Googleverified

Agentsmedium signal

Claude Code 2.1.275 stops running the install scripts inside a plugin from npm

Anthropic published the release on September 17, 2026. A plugin installed from npm is now fetched with packing that skips scripts and is integrity-verified, so the package's install scripts never execute. The same build stops printing a password or token that was stored in a git, ssh or marketplace address, and repairs a rewind that could restore a zero-filled or truncated file. A regression it introduced broke every request for anyone whose base URL points at a proxy or gateway, and 2.1.276 fixed that the next day.

Claude Code Releases (GitHub)verified

Agentsmedium signal

Claude Code 2.1.268 closes several ways a deny rule failed to apply

The release published on September 10, 2026 is mostly a permissions release. Deny and ask rules did not apply to symlinked directories when a path was spelled by its real location, and a deny rule on a file could be stepped over by putting an unparseable command on the same line. Two separate fixes stop secrets from being printed into plugin and MCP output. The same build also repairs third-party endpoints, which had been failing every turn with HTTP 400 since 2.1.265.

Claude Code Releases (GitHub)verified

Agentsmedium signal

Claude Code 2.1.261 changes what Ctrl+W does and stops auto-approving diagram-renderer links

The release that landed on September 4, 2026 is mostly fixes, but four entries change behavior that was already there. The prompt's word-editing keys now match Bash, and the setting that used to select a keybinding style has no effect at all. Auto mode now treats a link that packs your content into a public diagram renderer's URL as an upload to that site, so it is no longer approved without you. Two new settings raise how much command output reaches the model inline, up to 128,000 characters.

Anthropicverified

Connectorsmedium signal

Gemini Spark now runs multi-step jobs on your Google Photos, and it can schedule them to repeat

Google has started making Google Photos available inside Gemini Spark, the mode of the Gemini apps that carries out a task instead of answering a question. One prompt can find photos, enhance copies of them, put them in a new album, and draft an email with the link. The same job can be attached to a schedule and left running in the background. It needs a Google AI Pro or Ultra subscription and a personal account rather than a work or school one, and the Photos part is limited to people 18 or over in the United States, in English.

Googleverified

Agentsmedium signal

Claude Code 2.1.260 fixes four ways a permission rule quietly failed to apply

The release published on September 3, 2026 is mostly about permission rules that were written correctly and then did not do what they said. A path containing parentheses could be dropped as invalid, leaving a folder marked read-only writable. One malformed pattern could break every file edit. A zsh command could hide a command substitution inside a variable assignment and be auto-approved. And a rule with stray text after the closing parenthesis matched nothing at all, silently. If you rely on deny rules, the interesting part of this release is not what Claude Code can now do but what your settings were not doing.

Anthropicverified

Agentsmedium signal

OpenClaw 2026.8.2 adds a Linux desktop app and widens what sessions see by default

OpenClaw 2026.8.2 was published on September 1, 2026. Two entries in a long set of release notes matter more than the rest: a desktop application for Linux, and a change to what a session may reach by default. Sessions that do not run in a sandbox can now work with other sessions of the same agent unless an operator narrows that. The release also raises the managed Sharp dependency to 0.35.4 with libheif 1.23.2, fixing vulnerabilities in image decoding.

OpenClawverified

Agentsstrong signal

Gemini CLI 0.58.0 closes a sandbox escape that ran through the Docker socket

Gemini CLI runs untrusted work inside a macOS Seatbelt profile. Until 0.58.0 that profile did not stop a sandboxed process from talking to a container runtime on the same machine, and a container runtime will mount the host filesystem for whoever asks. The fix was merged on August 21, 2026 and reached a stable release on September 1, 2026. It covers the profile builder and all six built-in macOS profiles.

Gemini CLIverified

Agentsstrong signal

Claude Code 2.1.257 closes several ways a permission rule could be walked around

Anthropic shipped two Claude Code releases on September 1, 2026. Version 2.1.257 adds a containment-escape rule to auto mode and a prompt before the first file read outside the working directories, and it fixes five places where a differently written command slipped past a deny rule. A project settings file can no longer put a session into bypass mode. Version 2.1.258 restores launching on macOS 12, broken since 2.1.255.

Claude Code Releasesverified

Agentsmedium signal

Copilot can now approve a pull request, if an administrator lets it

GitHub added an approval assessment to every Copilot code review, and a separate setting that lets Copilot submit a real approval. That approval counts toward a repository's required-approvals rule, which means a machine can satisfy a gate that used to need a person. It is off by default and configurable at three levels, down to which file paths Copilot may sign off on. A second changelog entry the same day gives individual user budgets an expiry date.

GitHubverified

Agentsstrong signal

OpenClaw 2026.8.1 turns memory on by default and drops the bundled OpenProse plugin

The August release of the agent runtime enables three behaviors on its own: recall of earlier private conversations, background memory consolidation, and automatic application of skills its own scanner has approved. It also removes the bundled OpenProse plugin and the /prose command, and moves model routes named codex over to openai. Plugin authors face an SDK import gate on September 1, 2026.

OpenClawverified

Agentsmedium signal

Gemini CLI stops loading repository MCP servers in an untrusted workspace

A fix merged into Gemini CLI on August 28, 2026 changes the order in which workspace trust is decided, and it shipped the next day in the nightly build v0.59.0-nightly.20260829. Environment signals such as GEMINI_RESTRICTED_MODE are now read before local options, and an untrusted signal ends the check immediately. In the A2A server, MCP server definitions that come from the repository are dropped when the workspace is not trusted. The stated purpose is to keep the server from starting processes it should not start.

Gemini CLIverified

Agentsmedium signal

Copilot's CLI moved to a Rust runtime and kept its TypeScript terminal

GitHub's weekly Copilot roundup for August 28 carries one change that is structural rather than cosmetic: the command-line agent now runs on a native Rust runtime, while the terminal interface it draws stays in TypeScript. Around it sit smaller changes that all point the same way, toward deciding once how the agent behaves instead of deciding again every session. GitHub reports the speedup but publishes no figure for it.

GitHubverified

Agentsmedium signal

AgentCore Memory can now keep one tenant's memories out of another's

AWS shipped two changes to Amazon Bedrock AgentCore Memory on August 28. Fine-grained access control enforces per-user and per-tenant isolation through AgentCore Gateway, using Cedar policies over the caller's identity instead of authorization code you write yourself. Flexible namespace variables let you scope long-term memories along your own dimensions, up to five keys per memory resource. AWS says the namespace variables come at no additional cost wherever AgentCore Memory is generally available; the announcement about fine-grained access control makes no such statement.

AWSverified

Agentsmedium signal

Claude Code 2.1.251 closes six ways a project could widen its own permissions

Anthropic published the release on August 28. Six of its fixes share one shape: something declared inside the working directory — a symlink, a plugin entry, a workflow script, a settings file — reached past the boundary the session had approved. Several changes now stop managed or project settings from weakening the sandbox or injecting credential headers without an explicit approval. The same release adds hooks that fire around a model switch and a per-session prompt-cache line in the cost command.

Anthropicverified

Agentsmedium signal

Claude Code 2.1.248 adds a restricted mode and stops leaking credential leftovers

One flag now strips the tools that run code, keeps file access inside the working directory, refuses bypassPermissions and ignores every settings file. The same release stops cloud reviews from uploading tfvars files and editor backups of private keys. Version 2.1.250 followed hours later with fixes only.

Anthropicverified

Agentsstrong signal

The classifier let the malware start and then refused to let Claude kill it

Johann Rehberger chained benign-looking steps until Claude Code wrote its own loader for an attacker's Python module. Three variants succeeded in three, three and four runs out of five. In some runs Claude noticed the compromise and tried to stop the process, and Auto Mode denied that command. Anthropic closed the report as informative.

Embrace The Redverified