{"slug": "two-agent-clis-shipped-here-is-what-actually-changed", "title": "Two Agent CLIs Shipped. Here Is What Actually Changed", "summary": "Claude Code v2.1.234, released August 17, 2026, cut the built-in claude-api skill's token load from ~200k+ to ~25k tokens and hardened five pre-approval file surfaces against Windows NT-namespace paths to close the NTLM credential-leak vector. Codex CLI 0.148.0, released August 18, added session forking, markdown export, and Amazon Bedrock Runtime as a built-in provider. Anthropic ended access to its legacy Workbench on August 17 and shipped Playground as its replacement on August 18.", "body_md": "Claude Code v2.1.234 and Codex CLI 0.148.0 shipped a day apart — August 17 and August 18, 2026 — and between them they touched agent security posture, context economics, session handling, and provider reach. Vendor changelogs list every line with equal weight. This post does not: it separates the changes that alter how you operate these tools from the ones that only change how they look.\n\nThe stakes are practical. If you run coding agents daily, one line in the Claude Code release returns a large slice of your context window, another hardens a credential-leak class on Windows, and a Codex line gives you the ability to branch a session instead of replaying it. Meanwhile, a quiet Console change at Anthropic retired a tool one day before its replacement went live — a sequencing detail most write-ups are likely to merge into a single event.\n\nEverything below traces to three primary documents: the [Claude Code changelog](https://code.claude.com/docs/en/changelog), the [Codex CLI GitHub release notes for rust-v0.148.0](https://github.com/openai/codex/releases/tag/rust-v0.148.0), and the [Claude Platform release notes](https://platform.claude.com/docs/en/release-notes/overview). Where a claim rests on a vendor’s own uncorroborated wording, we say so.\n\n- 01Claude Code v2.1.234 is the release that matters.The August 17 release hardened five pre-approval file surfaces against Windows NT-namespace paths — closing, in the changelog’s words, the remaining pre-approval file accesses against the NTLM credential-leak vector.\n- 02The standout number is context economics, not security.Loading the built-in claude-api skill dropped from ~200k+ tokens to ~25k — roughly an 8x cut, achieved by loading reference docs on demand instead of eagerly. That is real context-window headroom for anyone who touches the skill.\n- 03Codex CLI 0.148.0 made sessions first-class objects.Markdown export via /export, session forking via codex exec fork with archive/restore from the resume picker, and thread credit/cost visibility in /status — plus Amazon Bedrock Runtime as a built-in provider.\n- 04The Workbench retirement and Playground launch are two events, not one.Access to the legacy Workbench and the experimental prompt-tools API ended August 17. Playground, the replacement, shipped August 18 — one calendar day later. Both sit under the same changelog heading, which is exactly the trap.\n- 05v2.1.235 is a minor release — read it as one.The August 18 Claude Code release adds an optional spellcheck setting and a batch of UI and reliability fixes. No new security feature and no provider-facing change shipped in it — though one of those fixes closes a safety-relevant permission-prompt bug.\n\n## 01 — The WindowFive events in *two days*, unevenly weighted.\n\nAugust 17–18 produced five dated events across two agent CLIs and one console. They are not equal. Claude Code v2.1.234, dated August 17, is the largest release of the window — it is where the security and context-economics stories live. Claude Code v2.1.235 followed on August 18 and is materially thinner. Codex CLI 0.148.0, published August 18, is a substantial session-handling and provider release. And the Claude Console did two separate things: it ended access to its legacy Workbench on August 17, then shipped Playground as the replacement on August 18 — a sequence worth reading carefully, and the reason this post counts five events rather than three.\n\nNone of this changes which model you run. That is the point worth internalizing: these are harness-level changes, and [the harness outlasts the model underneath it](/blog/models-swap-in-48-hours-the-harness-does-not). Operators who track model launches but skim CLI changelogs are watching the wrong layer this week.\n\n##### Claude Code *v2.1.234*\n\nNT-namespace path rejection across five pre-approval file surfaces; claude-api skill load cost cut from ~200k+ tokens to ~25k; GitLab MR badge; auto-continue when a claude.ai usage limit resets.\n\n##### Console: *Workbench ends*\n\nAccess to the legacy Workbench ended August 17, and the experimental prompt-tools APIs — /v1/experimental/generate_prompt, improve_prompt, templatize_prompt — were retired with it. Requests to those endpoints now return errors.\n\n##### Claude Code *v2.1.235*\n\nOne feature — an optional spellcheck setting for the prompt input, using a locally installed aspell, hunspell, or ispell. The rest is UI and reliability fixes, one of which closes a safety-relevant permission-prompt bug.\n\n##### Codex CLI *0.148.0*\n\nMarkdown export via /export; session forking via codex exec fork with archive/restore; thread credit/cost in /status; Amazon Bedrock Runtime as a built-in provider; hooks run async and can invoke MCP tools.\n\n##### Console: *Playground*\n\nPlayground shipped August 18 at platform.claude.com/playground — every Messages API parameter, templates for features such as code execution and web search, and the full SDK request and API response per run.\n\nThat thinner August 18 release, v2.1.235, has one feature — an optional spellcheck setting. It is covered in Section 04, mostly to make the contrast explicit: not every version bump deserves your attention, and part of operating agent tooling well is knowing which ones do.\n\n## 02 — Security PostureThe NT-namespace fix closes *the remaining* pre-approval gap.\n\nThe headline security line in v2.1.234 says that remote file reads, session restore, CLAUDE.md includes, workflow scripts and file uploads now reject Windows NT-namespace paths — the changelog names the specific prefix, which we omit here — and that this is, **verbatim, “hardening the remaining pre-approval file accesses against the NTLM credential-leak vector.”**\n\nThe background, kept deliberately high-level: on Windows, certain path formats can cause the operating system to automatically attempt NTLM authentication against a network location the path points at. A string that looks like a harmless file reference can therefore become an outbound credential handshake to a location an attacker controls. For an agent that reads files *before a human approves anything*, path handling is an attack surface — which is why the fix targets pre-approval accesses specifically.\n\nThe operative word in the changelog is **“remaining.”** That phrasing implies earlier passes had already closed some file-access paths against this same class, and this release is framed as finishing the job across five surfaces: remote file reads, session restore, CLAUDE.md includes, workflow scripts, and file uploads. That reads as a deliberate audit of every place the tool touches a path before approval — not a one-off patch.\n\n*before approval*— on session restore, on config includes, on uploads — and each of those touches is an input-validation surface. When you evaluate any agent CLI, ask what it reads before the permission prompt, not just what it can do after one. No exploit steps are published here or in the changelog; the mechanism class is long-standing, well-documented Windows security territory.\n\n## 03 — Context EconomicsOne skill, roughly *an 8x* lighter load.\n\nThe standout number of the release for anyone running Claude Code daily is not the security fix. It is this: the context cost of loading the built-in claude-api skill dropped from ~200k+ tokens to ~25k. That is roughly an 8x reduction — about seven-eighths of the load cost removed — and it was achieved architecturally, by loading reference docs on demand rather than eagerly, not by trimming content.\n\n“Reduced the context cost of loading the built-in `claude-api` skill from ~200k+ tokens to ~25k by loading reference docs on demand”— Claude Code changelog, v2.1.234 entry, August 17, 2026\n\n#### claude-api skill load cost · tokens consumed on load\n\nSource: Claude Code changelog, v2.1.234 entry (vendor-stated, approximate figures)Why this is the number to remember: context is the scarcest resource in agentic work. A skill that consumed ~200k+ tokens on load was, on its own, a meaningful share of a working context window — crowding out repository state, conversation history, and tool results before any work happened. Cutting that to ~25k returns the difference to actual work on every session that loads the skill. Because the changelog hedges the starting figure at “~200k+,” treat the multiplier as approximate; the direction and order of magnitude are what matter.\n\nThe interpretive point is bigger than one skill. Eager loading is how most skill and tool systems still work: everything the agent might need is injected up front, whether or not the session uses it. On-demand loading inverts that default. We expect this pattern to spread across skill systems generally, because the economics are hard to argue with — the same capability at a fraction of the standing context cost. Teams building their own agent tooling can apply the pattern today: load reference material when the task asks for it, not when the session starts.\n\n## 04 — The Rest of the PairWhat else v2.1.234 shipped — and the *minor* v2.1.235.\n\nThree more v2.1.234 items are worth an operator’s attention. Repos with a GitLab remote and an authenticated glab CLI now show a merge-request badge — MR !N with draft, pending, and green states — in the footer statusline. Claude Code can now auto-continue a session when a claude.ai usage limit resets, toggled in /config as “Continue automatically at usage limit” — a real quality-of-life change for long autonomous runs that previously stalled until someone noticed. And a new optional CLAUDE_CODE_PROJECT_DIR_NAME environment variable lets hosts that give each session its own config directory choose a short name for the per-project transcript directory.\n\nThe fix list carries operational weight too. Auto mode in very long sessions no longer repeatedly re-checks and denies sandboxed commands’ network access after compaction. A crash on the non-streaming fallback path — common via third-party gateways — was fixed for API responses missing a thinking or text field. And MCP diagnostics no longer print resolved secrets: scope-conflict warnings show the configured variable form, and connection-failure details show only the server origin. If your team has covered our look at [the auto-mode classifier’s published defaults](/blog/claude-code-auto-mode-classifier-numbers-published), note that nothing in this window changes those numbers.\n\n##### GitLab merge-request badge\n\nRepos with a GitLab remote and an authenticated glab CLI show the current MR with draft, pending, and green states. Visibility only — nothing about execution changes.\n\n##### Continue at usage-limit reset\n\nSessions resume automatically when a claude.ai usage limit resets, instead of stalling until a human notices. Opt-in via /config. Changes how unattended runs behave.\n\n##### Optional spellcheck, and fixes\n\nUnderlines misspelled words in the prompt input using an installed aspell, hunspell, or ispell. The rest is UI and reliability fixes — no new security feature and no provider-facing change, though one fix closes a safety-relevant permission-prompt bug.\n\nOne v2.1.235 fix deserves a callout despite the release’s minor status: Shift+Tab inside the permission prompt’s comment field previously approved the edit and granted session-wide edit permission instead of closing the field. That is a safety-relevant UI bug — a stray keystroke silently widening permissions — and it is now fixed. It is also a useful reminder that permission UX is part of an agent’s security model, not cosmetic surface.\n\n## 05 — Codex CLI0.148.0 makes sessions *first-class* objects.\n\nOpenAI published Codex CLI 0.148.0 on August 18, and its through line is session handling. Conversations can now be exported to Markdown with /export, to clipboard or file. Sessions can be forked — branched from a point in their history rather than replayed from scratch — and archived or restored from the TUI resume picker. Draft prompts can be composed while the TUI initializes. And estimated thread credits or cost now appear in /status, status lines, and terminal titles, moving spend visibility from post-hoc accounting into the live session.\n\n“Fork sessions with `codex exec fork`, and archive or restore sessions from the TUI resume picker”— Codex CLI release notes, rust-v0.148.0, August 18, 2026\n\n##### Fork, export, *restore*\n\nBranch a session instead of replaying it; archive and restore from the resume picker; export whole conversations to Markdown. Session state becomes something you can version, hand off, and audit.\n\n##### Spend in */status*\n\nEstimated thread credits or cost surface mid-run in /status, status lines, and terminal titles — the difference between discovering spend after a run and steering it during one.\n\n##### Bedrock, *built in*\n\nAmazon Bedrock Runtime is now a built-in provider with AWS profile and region configuration — a first-party path for AWS-governed accounts that previously needed custom wiring.\n\n##### Hooks go *async*\n\nHooks can now run commands asynchronously and invoke MCP tools — hook logic stops blocking the session and gains access to the same tool surface the agent uses.\n\nOne sourcing note on the Bedrock line. OpenAI’s release notes phrase it as “Use Amazon Bedrock Runtime as a built-in provider with AWS profile, region, and GPT-5.6 routing” — and that routing detail is single-sourced to OpenAI’s own notes, with no independent corroboration we could find at publication. Treat it as the vendor’s release-note language rather than confirmed routing behavior, and verify against your own Bedrock account before depending on it.\n\nThe fix list also matters for anyone running Codex in anger: model switching and settings updates no longer interfere with active turns; resumed sessions restore their persisted working directory and approval policy; MCP servers recover after OAuth reauthentication; and sandbox restrictions are now enforced consistently across Linux and Windows. For the architectural background on why Codex versions as rust-v0.148.0, see [Codex’s Rust rewrite and its config changes](/blog/codex-cli-rust-migration-playbook-config-changes-2026); for the fuller surface this release builds on, see [Codex CLI’s config-profile and sandbox model](/blog/codex-cli-deep-dive-config-profiles-sandbox-2026).\n\n## 06 — The Console SwapWorkbench ended *before* Playground began.\n\nOn August 18, Anthropic’s platform release notes announced that “Workbench is now Playground in the Claude Console.” [Playground](https://platform.claude.com/playground) supports every Messages API parameter, includes templates demonstrating API features such as code execution and web search, and shows the full SDK request and the API response for each run. As a debugging and prompt-iteration surface, it is a genuine upgrade over what it replaces.\n\nBut the sequencing deserves precision, because the same dated section of the release notes carries two entries describing events from a day earlier. The legacy Workbench, per the notes, was sunset “with access ending on August 17, 2026.” The experimental prompt-tools APIs — /v1/experimental/generate_prompt, improve_prompt, and templatize_prompt — were retired along with it, also on August 17; after removal, requests to those endpoints return an error. So the actual order of events is: access to the old surface and its APIs ended August 17, and the replacement shipped August 18, *one calendar day later*.\n\n*same*“August 18, 2026” changelog heading. A reader skimming heading dates — or a write-up compiled from them — will merge the retirement and the replacement into a single event. They were not. Also practical: saved prompts, variables, and evals from the old Workbench are not supported in Playground; the sunset banner and Organization Settings expose an export path for anything worth keeping. If your team builds on Claude Code or the platform APIs, this is the same discipline as\n\n[the Claude Agent SDK migration](/blog/claude-agent-sdk-migration-playbook-from-claude-code-sdk-2026): track retirements and replacements as separate dated events.\n\n## 07 — Proprietary AnalysisThe headline changes, classified: *operational* or cosmetic.\n\nChangelogs present every line with equal visual weight. None of the three documents we read for this piece — the Claude Code changelog, the Codex CLI release notes, and the Claude Platform release notes — classifies its own changes by whether they alter how you operate the tool, so we did. The matrix below classifies the items we judged headline-level across the window’s five events — the announced features from each, plus two fix-list entries whose operational weight earns them a row. Which items clear that bar is a judgment call in itself, and reasonable operators can disagree at the margins; the point is that the judgment has to be made at all.\n\n| Change | Category | Changes how you operate? | One-line why |\n|---|---|---|---|\n| Claude Code v2.1.234 · Aug 17, 2026 | |||\n| NT-namespace path rejection, five surfaces | Security posture | Yes | Closes the remaining pre-approval file accesses against the NTLM credential-leak vector; changes what the tool will read before approval. |\n| claude-api skill load: ~200k+ → ~25k tokens | Context economics | Yes | Roughly seven-eighths of the skill’s standing context cost returned to actual work in sessions that load it. |\n| Auto-continue at usage-limit reset | Session handling | Yes | Unattended runs resume on their own; opt-in via /config. |\n| MCP diagnostics stop printing resolved secrets | Security posture | Yes | Logs and warnings no longer leak configured secret values; affects what is safe to share when debugging. |\n| GitLab merge-request badge | Cosmetic | No | Status display in the footer; nothing about execution changes. |\n| Optional CLAUDE_CODE_PROJECT_DIR_NAME env var | Session handling | No | Lets hosts that give each session its own config directory pick a short transcript-directory name; a default install behaves the same either way. |\n| Claude Code v2.1.235 · Aug 18, 2026 | |||\n| Optional spellcheck setting | Cosmetic | No | Prompt-input UI; requires a locally installed aspell, hunspell, or ispell. |\n| Shift+Tab permission-prompt fix | Security posture | Yes | A stray keystroke no longer approves an edit and grants session-wide edit permission. |\n| Codex CLI 0.148.0 · Aug 18, 2026 | |||\n| Session forking + archive/restore | Session handling | Yes | Branch from a session’s history instead of replaying it; restore archived sessions from the resume picker. |\n| Markdown export via /export | Session handling | Yes | Conversations become portable artifacts — handoffs, reviews, and records leave the terminal. |\n| Thread credits/cost in /status | Context economics | Yes | Spend is visible mid-run instead of after it; estimates, but steerable ones. |\n| Amazon Bedrock Runtime built in | Provider reach | Yes | AWS-governed accounts get a first-party provider path with profile and region config. |\n| Async hooks + MCP tool invocation | Session handling | Yes | Hook logic stops blocking turns and gains the agent’s tool surface. |\n| Draft prompts composable during TUI init | Cosmetic | No | Startup ergonomics — you can type while the TUI loads, and resume or fork progress is shown; the workflow itself is unchanged. |\n| Claude Console · Aug 17 retirement, Aug 18 replacement | |||\n| Workbench + prompt-tools API access ends (Aug 17) | Provider reach | Yes | Requests to the retired /v1/experimental endpoints return errors; saved prompts and evals are not carried over. |\n| Playground ships (Aug 18) | Provider reach | Yes | Every Messages API parameter, plus the full SDK request and API response per run — a stronger debugging surface. |\n\nScored this way, the window is lopsided: twelve of the sixteen items we classified change how an operator runs these tools, and three of the four that do not sit in Claude Code’s pair of releases. We have not measured earlier release windows, so read that ratio as a description of these two days rather than evidence of a trend — but it is why this particular pair of days earned a full write-up rather than a changelog link.\n\n## 08 — ImplicationsWhat to *do* with each of these.\n\nFour concrete moves follow from this window, depending on which stack you run. None requires waiting for anything further to ship.\n\n##### Update Claude Code to v2.1.234 or later\n\nThe NT-namespace hardening covers five pre-approval file surfaces. If agents on your fleet read repositories, restore sessions, or accept uploads on Windows, this is the release boundary that matters — treat it as a security update, not a feature bump.\n\n##### Re-check your *context budget*\n\nIf workflows previously avoided the claude-api skill because of its ~200k+-token load, that constraint is roughly 8x smaller now. Re-evaluate what you disabled for context reasons — the arithmetic that justified it may no longer hold.\n\n##### Fold forking and /status into the workflow\n\nSession forking changes experiment hygiene: branch a session to try a risky approach, keep the original intact. Cost in /status changes budgeting: watch spend during a run, not after. Both are habits, not configs — they pay off only if the team adopts them.\n\n##### Audit for the retired endpoints\n\nIf anything in your stack calls /v1/experimental/generate_prompt, improve_prompt, or templatize_prompt, those requests now return errors — access ended August 17. Export anything left in the old Workbench via the sunset banner while the export path exists.\n\nThe through line, projected forward: agent CLIs are converging on operator-grade concerns — pre-approval attack surface, standing context cost, mid-run spend visibility, session state you can branch and audit. Expect the next rounds from both vendors to continue in this direction, because these are the complaints production teams actually file. For teams adopting agent tooling across an organization — model routing, harness selection, permission policy, cost governance — our [AI transformation engagements](/services/ai-transformation) start exactly at this layer: the operational one, beneath the model-of-the-week conversation.\n\n## 09 — ConclusionRead changelogs like an *operator*, not a fan.\n\n### The interesting layer this week was the harness, not the model.\n\nTwo agent CLIs shipped a day apart, and neither release contains a new model. What they contain instead is the stuff production depends on: a closed credential-leak class on Windows, a built-in skill that costs *roughly an eighth* of what it did to load, sessions you can fork and export, spend you can see mid-run, and a first-party path into Bedrock-governed accounts.\n\nThe discipline this post argues for is classification. Vendor changelogs are flat lists; operating well means sorting them — security posture, context economics, session handling, provider reach, cosmetic — and acting on the ones that change how the tool behaves. By that sort, August 17–18 came out lopsided: twelve of the sixteen items we classified were operational, and the one dating subtlety in it — Workbench access ending a day *before* Playground shipped — rewards reading primary sources over summaries.\n\nNone of this is glamorous, and that is the point. Model launches get the headlines; harness releases determine whether your agents leak credentials, waste context, and lose session state. Track both — but if you can only read one changelog carefully this week, make it the harness’s.", "url": "https://wpnews.pro/news/two-agent-clis-shipped-here-is-what-actually-changed", "canonical_source": "https://www.digitalapplied.com/blog/claude-code-codex-cli-agent-operator-changes-august", "published_at": "2026-08-18 00:00:00+00:00", "updated_at": "2026-08-22 05:42:37.289936+00:00", "lang": "en", "topics": ["developer-tools", "ai-tools", "ai-products"], "entities": ["Claude Code", "Codex CLI", "Anthropic", "Amazon Bedrock Runtime", "GitLab"], "alternates": {"html": "https://wpnews.pro/news/two-agent-clis-shipped-here-is-what-actually-changed", "markdown": "https://wpnews.pro/news/two-agent-clis-shipped-here-is-what-actually-changed.md", "text": "https://wpnews.pro/news/two-agent-clis-shipped-here-is-what-actually-changed.txt", "jsonld": "https://wpnews.pro/news/two-agent-clis-shipped-here-is-what-actually-changed.jsonld"}}