This week in Claude Code, Codex and Gemini CLI (week of October 25, 2026)

Claude Code 2.1.309 and 2.1.310 shipped more than ten fixes closing sandbox and permission-check bypasses, including shell startup files running outside the sandbox on macOS and Linux, symlink-based escapes from denyWrite globs, and sandboxed commands able to modify the --mcp-config file. Codex 0.164.0 hardened its own sandbox checks against case-variant metadata paths and replaceable symlinks, masked credentials in remote Bash and zsh sessions, and added a /presets feature for storing prompts and slash commands in ten slots. The roundup urges teams relying on deny rules or sandbox isolation to upgrade to 2.1.310 and then re-review their configured rules.

Originally published at https://aicoding-guide.com https://aicoding-guide.com/en/posts/weekly-2026-10-25/ . This was a security fix week . Claude Code 2.1.309 carries more than ten fixes for routes around the sandbox and the permission checks. Codex 0.164.0 hardened its own sandbox checks and added credential masking. Codex also shipped features. /presets stores prompts and slash commands in ten slots, and /model and /permissions now take their settings as arguments. Key point This week in brief - Claude Code 2.1.309 concentrates fixes for sandbox and permission-check bypasses - Codex 0.164.0 adds /presets and masks credentials in remote Bash- Claude Code gained the claude code.safety event OpenTelemetry event Eight releases this week, 2.1.303 through 2.1.310. This release is lopsided: it is largely a list of routes that worked when they should not have. | Route | What was wrong | |---|---| | Shell startup files | On macOS and Linux, every sandboxed Bash command ran the shell's startup files outside the sandbox first | | Symbolic links | macOS denyWrite glob patterns did not apply at a path's real location when the pattern's folder was reached through a symlink | | MCP config file | Sandboxed commands and auto-accepted edits could modify the config passed with --mcp-config | | Redirects | The Bash permission check trusted a variable set by a command whose redirect can fail to open | | Compound commands | A cd that was wrapped or prefixed before a git command did not prompt, as a plain cd does | | Deny rules | An Edit path deny rule did not block a Bash redirect to that path in some commands holding a subshell | | Worktree isolation | Locale-prefixed commands, and some zsh arithmetic commands, passed the isolation guard | On Windows, PowerShell permission checks were auto-approving some Set-Location and cd commands that carry extra arguments. 2.1.310 adds another: with Git Bash missing, PreToolUse and PermissionRequest hooks let a tool call through when the hook's command was only quoted strings. Upgrade if you depend on deny rules or the sandbox These are "configured but not actually enforced" fixes. If your setup assumes .env cannot be read or writes are confined, move to 2.1.310 and then review the rules themselves. Claude Code permissions in settings.json https://aicoding-guide.com/en/posts/claude-code-settings-json-permissions/ covers the syntax. claude code.safety event sandbox.allowNestedUserNamespaces CLAUDE CODE RETRY WATCHDOG USAGE LIMIT RECHECK MS CLAUDE CODE AUTO COMPACT WINDOW=200k silently set a 100K window. The variable now accepts k and M suffixes and warns when a value is out of range cleanupPeriodDays made background cleanup delete some recent files, such as pasted images claude --worktree removed the worktree and its branch without asking at exit when HEAD was detached or on another branch, which could lose commits v0.164.0 is a feature release. | Addition | What it does | |---|---| | /presets | Saves reusable prompts and slash commands in ten numbered slots, recalled from a keyboard menu | | /model and /permissions arguments | Set model, reasoning effort, speed and permissions inline as arguments | | Image preview | Shows viewed and generated images in the fullscreen transcript on Kitty or Sixel terminals | | Enterprise MCP auth | Authenticates through Codex account grants or a dedicated sign-in, including OAuth clients that need secrets | | Credential masking | Masks credentials in remote Bash commands and zsh snapshot sessions, custom provider credentials included | | Bedrock setup | The Amazon Bedrock setup wizard is now on by default | On the security side, sandbox checks were hardened for case-variant metadata paths on macOS and for replaceable symlinks used to find executables — the same direction as Claude Code's symlink fixes this week. Among the fixes, two stand out: a failed compaction no longer leaves a partial summary in history, and Windows HTTPS and WebSocket connections now handle proxy authentication with the signed-in user's Negotiate or NTLM credentials. For the previous release, see Codex CLI v0.163 turns Daybreak back on by default https://aicoding-guide.com/en/posts/codex-update-0-163/ . v0.65.0 October 20 had one feature among 27 entries, the otlpHeaders telemetry setting. The change that matters more in practice is that workspace settings in an untrusted folder are now enforced as read-only. See Gemini CLI v0.65 enforces read-only settings in untrusted folders https://aicoding-guide.com/en/posts/gemini-cli-update-0-65/ . 200k for CLAUDE CODE AUTO COMPACT WINDOW , confirm it is the window you meant /presets , inline /model and /permissions arguments, and credential masking otlpHeaders