# This week in Claude Code, Codex and Gemini CLI (week of October 25, 2026)

> Source: <https://dev.to/aicoding-guide/this-week-in-claude-code-codex-and-gemini-cli-week-of-october-25-2026-1jjf>
> Published: 2026-10-24 19:08:18+00:00

*Originally published at [https://aicoding-guide.com](https://aicoding-guide.com/en/posts/weekly-2026-10-25/).*

This was a **security fix week**. Claude Code 2.1.309 carries more than ten fixes for routes around the sandbox and the permission checks. Codex 0.164.0 hardened its own sandbox checks and added credential masking.

Codex also shipped features. `/presets` stores prompts and slash commands in ten slots, and `/model` and `/permissions` now take their settings as arguments.

**Key point**

This week in brief

- Claude Code 2.1.309 concentrates fixes for sandbox and permission-check bypasses
- Codex 0.164.0 adds
`/presets` and masks credentials in remote Bash- Claude Code gained the
`claude_code.safety_event` OpenTelemetry event

Eight releases this week, 2.1.303 through 2.1.310.

This release is lopsided: it is largely a list of routes that worked when they should not have.

| Route | What was wrong | 
|---|---|
| Shell startup files | On macOS and Linux, every sandboxed Bash command ran the shell's startup files **outside** the sandbox first | 
| Symbolic links | macOS `denyWrite` glob patterns did not apply at a path's real location when the pattern's folder was reached through a symlink | 
| MCP config file | Sandboxed commands and auto-accepted edits could modify the config passed with `--mcp-config` | 
| Redirects | The Bash permission check trusted a variable set by a command whose redirect can fail to open | 
| Compound commands | A `cd` that was wrapped or prefixed before a git command did not prompt, as a plain`cd` does | 
| Deny rules | An `Edit(path)` deny rule did not block a Bash redirect to that path in some commands holding a subshell | 
| Worktree isolation | Locale-prefixed commands, and some zsh arithmetic commands, passed the isolation guard | 

On Windows, PowerShell permission checks were auto-approving some `Set-Location` and `cd` commands that carry extra arguments. 2.1.310 adds another: with Git Bash missing, `PreToolUse` and `PermissionRequest` hooks let a tool call through when the hook's command was only quoted strings.

**Upgrade if you depend on deny rules or the sandbox**

These are "configured but not actually enforced" fixes. If your setup assumes `.env` cannot be read or writes are confined, move to 2.1.310 and then review the rules themselves. [Claude Code permissions in settings.json](https://aicoding-guide.com/en/posts/claude-code-settings-json-permissions/) covers the syntax.

`claude_code.safety_event`` sandbox.allowNestedUserNamespaces``CLAUDE_CODE_RETRY_WATCHDOG_USAGE_LIMIT_RECHECK_MS`` CLAUDE_CODE_AUTO_COMPACT_WINDOW=200k` silently set a 100K window. The variable now accepts `k` and `M` suffixes and warns when a value is out of range`cleanupPeriodDays` made background cleanup delete some recent files, such as pasted images`claude --worktree` removed the worktree and its branch without asking at exit when HEAD was detached or on another branch, which could lose commits
v0.164.0 is a feature release.

| Addition | What it does | 
|---|---|
| `/presets` | Saves reusable prompts and slash commands in ten numbered slots, recalled from a keyboard menu | 
| `/model` and`/permissions` arguments | Set model, reasoning effort, speed and permissions inline as arguments | 
| Image preview | Shows viewed and generated images in the fullscreen transcript on Kitty or Sixel terminals | 
| Enterprise MCP auth | Authenticates through Codex account grants or a dedicated sign-in, including OAuth clients that need secrets | 
| Credential masking | Masks credentials in remote Bash commands and zsh snapshot sessions, custom provider credentials included | 
| Bedrock setup | The Amazon Bedrock setup wizard is now on by default | 

On the security side, sandbox checks were hardened for case-variant metadata paths on macOS and for replaceable symlinks used to find executables — the same direction as Claude Code's symlink fixes this week.

Among the fixes, two stand out: a failed compaction no longer leaves a partial summary in history, and Windows HTTPS and WebSocket connections now handle proxy authentication with the signed-in user's Negotiate or NTLM credentials. For the previous release, see [Codex CLI v0.163 turns Daybreak back on by default](https://aicoding-guide.com/en/posts/codex-update-0-163/).

v0.65.0 (October 20) had one feature among 27 entries, the `otlpHeaders` telemetry setting. The change that matters more in practice is that workspace settings in an untrusted folder are now enforced as read-only. See [Gemini CLI v0.65 enforces read-only settings in untrusted folders](https://aicoding-guide.com/en/posts/gemini-cli-update-0-65/).

`200k` for `CLAUDE_CODE_AUTO_COMPACT_WINDOW`, confirm it is the window you meant`/presets`, inline `/model` and `/permissions` arguments, and credential masking`otlpHeaders`