This week in Claude Code, Codex and Gemini CLI (week of October 25, 2026)

This was a security fix week. Claude Code 2.1.309 carries more than ten fixes for routes around the sandbox and the permission checks. Codex 0.164.0 hardened its own sandbox checks and added credential masking.

Codex also shipped features. /presets stores prompts and slash commands in ten slots, and /model and /permissions now take their settings as arguments.

Claude Code

Eight releases this week, 2.1.303 through 2.1.310.

Sandbox and permission bypasses (2.1.309)

This release is lopsided: it is largely a list of routes that worked when they should not have.

Route	What was wrong
Shell startup files	On macOS and Linux, every sandboxed Bash command ran the shell's startup files outside the sandbox first
Symbolic links	macOS denyWrite glob patterns did not apply at a path's real location when the pattern's folder was reached through a symlink
MCP config file	Sandboxed commands and auto-accepted edits could modify the config passed with --mcp-config
Redirects	The Bash permission check trusted a variable set by a command whose redirect can fail to open
Compound commands	A cd that was wrapped or prefixed before a git command did not prompt, as a plain cd does
Deny rules	An Edit(path) deny rule did not block a Bash redirect to that path in some commands holding a subshell
Worktree isolation	Locale-prefixed commands, and some zsh arithmetic commands, passed the isolation guard

On Windows, PowerShell permission checks were auto-approving some Set-Location and cd commands that carry extra arguments. 2.1.310 adds another: with Git Bash missing, PreToolUse and PermissionRequest hooks let a tool call through when the hook's command was only quoted strings.

Telemetry and settings (2.1.305, 2.1.307)

• claude_code.safety_event: a new OpenTelemetry event for each tool call that a permission rule, auto mode, a safety check, a hook or the sandbox stopped, prompted on, or sent back
• sandbox.allowNestedUserNamespaces: lets sandboxed commands on Linux create user namespaces, for Chromium and rootless podman. The CHANGELOG also states plainly that this lets them get around the sandbox's file protections
• CLAUDE_CODE_RETRY_WATCHDOG_USAGE_LIMIT_RECHECK_MS: unattended retry mode now notices a usage limit lifted before its reset

Easy ones to miss (2.1.304, 2.1.310)

• CLAUDE_CODE_AUTO_COMPACT_WINDOW=200k silently set a 100K window. The variable now accepts k and M suffixes and warns when a value is out of range
• A very large cleanupPeriodDays made background cleanup delete some recent files, such as pasted images
• claude --worktree removed the worktree and its branch without asking at exit when HEAD was detached or on another branch, which could lose commits

Codex

v0.164.0 is a feature release.

Addition	What it does
/presets	Saves reusable prompts and slash commands in ten numbered slots, recalled from a keyboard menu
/model and /permissions arguments	Set model, reasoning effort, speed and permissions inline as arguments
Image preview	Shows viewed and generated images in the fullscreen transcript on Kitty or Sixel terminals
Enterprise MCP auth	Authenticates through Codex account grants or a dedicated sign-in, including OAuth clients that need secrets
Credential masking	Masks credentials in remote Bash commands and zsh snapshot sessions, custom provider credentials included
Bedrock setup	The Amazon Bedrock setup wizard is now on by default

On the security side, sandbox checks were hardened for case-variant metadata paths on macOS and for replaceable symlinks used to find executables — the same direction as Claude Code's symlink fixes this week.

Among the fixes, two stand out: a failed compaction no longer leaves a partial summary in history, and Windows HTTPS and WebSocket connections now handle proxy authentication with the signed-in user's Negotiate or NTLM credentials. For the previous release, see Codex CLI v0.163 turns Daybreak back on by default.

Gemini CLI

v0.65.0 (October 20) had one feature among 27 entries, the otlpHeaders telemetry setting. The change that matters more in practice is that workspace settings in an untrusted folder are now enforced as read-only. See Gemini CLI v0.65 enforces read-only settings in untrusted folders.

What to check now

1. Move Claude Code to 2.1.310, first if you rely on the sandbox or on deny rules
2. Check whether cleanupPeriodDays is set to an extreme value
3. If you wrote a suffixed value such as 200k for CLAUDE_CODE_AUTO_COMPACT_WINDOW, confirm it is the window you meant
4. Upgrade Codex to 0.164.0 if you use its sandbox

Summary

• Claude Code 2.1.309 fixes more than ten ways around the sandbox and the permission checks
• Sandboxed commands were running the shell's startup files outside the sandbox first
• claude_code.safety_event makes blocked and prompted tool calls measurable
• Codex 0.164.0 adds /presets, inline /model and /permissions arguments, and credential masking
• Gemini CLI v0.65.0 enforces untrusted folder settings and adds otlpHeaders