Claude Code v2.1.309 ships roughly 60 changelog bullets, and the heart of it is closing gaps in the sandbox, Bash permission checks and worktree isolation guard. It also makes claude ultrareview require workspace trust and denies dangerous rm calls outright in bypass mode on Desktop and VS Code. Changelog-only analysis; not run.
Claude Code v2.1.307 adds a claude_code.safety_event OpenTelemetry event for tool calls stopped, prompted or sent back by permission rules, auto mode, hooks or the sandbox, plus /claude-api api-version to move code to API version 2026-10-21. It also fixes HTTP MCP tool calls being sent twice. Changelog-only analysis; not run.
Foremerge, launched on Show HN September 21, has AI coding agents declare intent before touching code so it can catch semantic conflicts — one agent replacing a service while another extends it — that Git’s line-based diffing misses entirely. Apache 2.0, pre-1.0, single maintainer, no independent benchmarks yet.
Codex CLI 0.155.0 (Sept 17) added Touch ID verification for MCP tool-call requests in local TUI sessions on supported Macs, using the Secure Enclave. It’s a genuinely nice UX touch, and it only covers the one deployment mode — a human sitting at a keyboard — where MCP’s real exposure is already smallest.
Cognition shipped Code Scans on September 16: a plan/shard/map/reduce pipeline that turns a vague engineering goal like ‘cut our build time’ into a batch of pull requests. Cognition’s own numbers claim a 96% PR merge rate at Philips and a 64% Rust build-time cut — but the pipeline runs on SWE-2, a model post-trained on someone else’s base, the same open question this blog has been asking about Cognition since its Series E.
Anthropic’s new R&D Automation Index puts a number on how much of its own AI research Claude actually leads: 26% as of August 2026, up from under 1% in February, with over 90% of measured work at least AI-collaborative and roughly 30,000 agents running concurrently. The most important number in the report is the one Anthropic didn’t round up: zero measured tasks where Claude operates fully autonomously.
OpenAI’s September 6 self-report says its research org now runs 3.1 agent-workdays for every human workday, with the median researcher spending $600/day and the 90th percentile $7,000/day on inference. The same report reveals GPT-6 Astra’s Critical cybersecurity classification forced a 59.2% cut to Astra-class GPU allocation for RL training — and OpenAI admits it doesn’t yet know how to safely reach full recursive self-improvement.
VulnCheck confirmed active exploitation of CVE-2026-0768, a CVSS 9.8 unauthenticated remote-code-execution flaw in Langflow’s custom component editor, with over 360 attack attempts logged by September 1 as Russia-origin actors harvest AWS and OpenAI API keys from compromised, root-level agent instances. A fix has existed since version 1.11.6; every unpatched release up to 1.4.2 grants root code execution to anyone who can reach it.
The Model Context Protocol’s maintainers published a new roadmap on August 22, organized around five priorities — the standout being a plan to replace browser-based human OAuth approval with agent-native identity (DPoP, Workload Identity Federation, enterprise-managed auth) for cloud-based agents that have no browser to click through.
Warp entered closed beta on August 18 with Warp Factories, cloud infrastructure for running triage-spec-implement-review-verify pipelines with Claude Code, Codex, or any harness as pluggable workers. It’s the clearest signal yet that the market is moving past ‘AI in your editor’ toward agent fleets as standing infrastructure — and it treats the IDE as optional, not the point.