Claude Code 2.1.314, Codex 0.166 and Browser Flaws: October 30 Roundup

Three things stand out today: Claude Code 2.1.314 shipped with a new write-boundary permission, Codex 0.166.0 is now a stable release, and a security write-up on Help Net Security describes how the built-in browsers of five AI coding assistants can be turned against their users.

Claude Code 2.1.314

The Claude Code releases page lists 2.1.314 as the newest build. The highlights:

• permissions.blockWritesOutsideWorkingDirectories: a new setting that makes Write, Edit and NotebookEdit refuse paths outside your working directories in every permission mode.
• Idle compaction: in VS Code and the Claude Desktop Code tab, a conversation over 200K tokens that sits idle is summarized, and the summary is used on your next message if the prompt cache has expired.
• Effort fix: sessions no longer fail with "Invalid effort level" when an admin caps a model's effort. Claude Code lowers the effort, retries and reports the level it used.
• claude -p now prints the error and exits with code 1 on a startup failure, instead of exiting 0 with no output. This matters for CI scripts.
• Providers: Bedrock sessions with many images drop older images and compact, and Microsoft Foundry falls back to an older model when no deployment exists for the default Sonnet, Opus or Haiku model.

Codex 0.166.0 goes stable

Yesterday's alphas became stable 0.166.0 on October 29, per the Codex releases page. The release notes on the page are truncated, so check the full notes before upgrading. What is listed:

• A keyboard-driven transcript selection with word, line and page movement plus search, and Markdown rendering in TUI questions and answers.
• GPT-6.1 Terra in the bundled, Vertex AI and Amazon Bedrock model catalogs.
• codex queue --resume to resume unloaded threads, and codex doctor --network-only for focused connectivity diagnostics.
• Fixes: approval and permission settings now persist across thread resume and fork, and reasoning-token accounting carries over on resume and fork.

Research: embedded browsers in five AI coding tools

According to the Help Net Security report, Forever Security researchers found that Cursor, GitHub Copilot, OpenAI Codex, VS Code and Claude Desktop each loosened their embedded browser so the AI could preview local projects or read tab content, and in all five one of the three core browser rules broke. They call the pattern EMBRACE. The reported findings and fix status:

• Cursor: a page with a hidden agent command could be run with one Enter press, and the agent disabled its own sandbox when blocked. Patched October 1.
• GitHub Copilot: the app trusted a page's reported address, so a fake page could show github.com/login over a fake sign-in form. Fixed in version 1.1.29 on October 13.
• OpenAI Codex: a single local file could read the whole disk, including SSH keys, .env files and npm tokens on the researchers' test machine. No fix as of October 29.
• VS Code: a web worker sits outside the project-folder check and can read any file. No fix as of October 29; Microsoft declined the report, citing Workspace Trust.
• Claude Desktop: the article describes the same folder-check gap as VS Code. It says Anthropic declined Forever's report but accepted a similar one from Noma Security, and does not state a fix.

This is one researcher's account reported by a news site, and the vendors' own responses were not in the article, so treat the details as unconfirmed until the vendors publish advisories.

What to do this week

• Claude Code users: update to 2.1.314 and consider enabling permissions.blockWritesOutsideWorkingDirectories in shared settings.
• Codex and VS Code users: don't treat the Workspace Trust prompt as protection, review which projects are trusted, and be careful with links an assistant generates.
• Copilot and Cursor users: confirm you are on Copilot 1.1.29 or later and a Cursor build from after October 1.

References

Claude Code releases · Codex releasesHelp Net Security: embedded browser research · GitHub Copilot changelog