Daily signal: Claude Code and Codex ship a week of sandbox, permission and hook fixes, and the MCP and A2A specifications stand still

Executive summary

The ecosystem story today is quiet protocol work and noisy agent-client hardening. The MCP and A2A specifications did not move. The two best-known coding agents each shipped release notes that read like a list of the places an approval and sandbox model can be walked around: startup files, symlinks, case aliases, redirects, hooks that return the wrong exit state. None is reported as exploited; together they are a map of what to test in any agent runtime you operate.

Models

No frontier model launch, system card or pricing change that I could verify from a vendor page in the window. Aggregator pages list October releases without days, and I did not treat them as evidence. Nothing to report for security.

MCP

No change to the MCP specification repository in the window beyond a maintainer’s handle on 23 Oct, and the Python SDK’s latest release remains 2.3.0 (2 Oct). The TypeScript SDK 2.4.0 (skills over MCP) was covered on 24 Oct. One MCP-adjacent change sits in the coding agents below: Claude Code 2.1.307 stops resending HTTP MCP tool calls after a mid-call connection drop unless the tool is read-only or idempotent, which closes a double-execution hazard for tools that write.

Agent ecosystem and interoperability

A2A’s latest release is v1.0.1 (28 May); its notes are bug fixes and none is labelled security. The A2A trust questions (Agent Card verification, tenant isolation) show up instead in SDK advisories such as the Strands A2A server bug covered on 24 Oct.

Claude Code and Codex: a week of sandbox, permission and hook fixes

OfficialClaude Code 2.1.307 to 2.1.310 · 21 to 23 OctCodex 0.164.0 · 23 Oct

What changed. Claude Code 2.1.309 (22 Oct) lists the largest set. Sandbox: sandboxed Bash on macOS and Linux ran shell startup files outside the sandbox before each command; macOS denyWrite globs did not apply at the real location when reached through a symlink; sandboxed commands and auto-accepted edits could modify the MCP config file passed with --mcp-config; on Linux, write denies lifted when a background command outlived the session. Permissions: the Bash permission check trusted a variable set by a command whose redirect could fail to open; some compound commands that cd before git were not prompted; an Edit(path) deny rule did not block a Bash redirect to that path when a subshell was present; some locale-prefixed commands and zsh arithmetic commands slipped past the worktree isolation guard; PowerShell checks auto-approved some cd forms. Hooks: PowerShell hooks did not block on exit code 2, and Windows PreToolUse and PermissionRequest hooks failed open when Git for Windows was missing (2.1.310 fixes a further variant when the hook command is only quoted strings). 2.1.307 adds a claude_code.safety_event OpenTelemetry event for each tool call that a permission rule, auto mode, safety check, hook or sandbox stopped, prompted or sent back. Codex 0.164.0 requires fresh Guardian approval for escalated retries, guards macOS sandbox metadata paths against case aliases and replaceable symlinks, masks credentials in remote Bash and Zsh snapshot sessions, and retires rejected MCP OAuth refresh tokens.

Security read. Three bug families repeat. First, ambient code outside the policy engine: shell startup files and background processes run with the user’s rights before or after the sandbox decision. Second, path identity: symlinks and case aliases make two names for one file, so a rule written for one name misses the other. Third, fail-open enforcement: a hook that cannot start, or exits in an unexpected way, is read as “no objection”. The last is the most dangerous for enterprises that use hooks as their policy layer: on Windows without Git for Windows, a policy hook could silently stop enforcing. None of the notes reports exploitation; the notes are vendor statements, and I did not test any of this. Mapping: OWASP Agentic Top 10 on tool misuse and privilege compromise; MITRE ATLAS execution and defence evasion.

Why it matters. These agents are the largest class of autonomous software running with developer credentials, and their safety rests on client-side policy that is only as strong as its edge cases. A version that is a few weeks old is likely missing several of these.

Mitigation and detection. Update to Claude Code 2.1.310 or later and Codex 0.164.0 or later; pin versions centrally so developers do not lag. If you enforce policy with hooks on Windows, confirm that Git for Windows is installed or fail closed in your own hook wrapper, and test that a deliberately broken hook blocks. Ship the new claude_code.safety_event stream to your SIEM and alert on spikes of denied or prompted calls from a single session, which is what an injected agent probing the boundary looks like. Keep OS-level isolation (containers, separate user, no standing cloud credentials) under the application sandbox rather than relying on it alone.

Recommendation (opinion): treat the vendor sandbox as one layer. Update now, then test your own deny rules against symlink, redirect and compound-command variants; the notes tell you where to look.

Sources: Claude Code releases · Codex releases · MCP specification commits · MCP Python SDK releases · A2A releases