AI Coding Tools Weekly, October 5-11, 2026: Copilot Local Sandboxing GA and Claude Haiku 5.5

Executive Summary

• GitHub made local sandboxing for Copilot generally available in the CLI, the Copilot app and VS Code sessions using Agent Host, at no extra cost.
• Claude Haiku 5.5 arrived in both Claude Code and Copilot, and Claude Code moved from 2.1.290 to 2.1.296 with hook fixes, including an opt-in onFailure: "block" setting.
• OpenAI used DevDay to move Codex toward reusable cloud environments, and Codex CLI reached 0.162.1 with managed Git worktrees.
• Stacked pull requests are generally available on all github.com plans.
• OpenCode 1.19 makes TUI updates manual and adds a path to OpenCode 2.
• GPT-5.5 retires from Codex for ChatGPT sign-in on October 14.

GitHub Copilot

Local sandboxing is GA

According to the GitHub announcement, local sandboxing works in Copilot CLI, the Copilot app and VS Code sessions using Agent Host, on Windows, macOS and Linux. It is powered by Microsoft eXecution Container (MXC), which applies one policy model through native controls on each platform.

You can limit which files agent commands may read or modify, control internet and local network access, restrict Git and GitHub CLI credentials, and extend the sandbox to local MCP and language servers where supported. Enterprises can require sandboxing and enforce settings developers cannot weaken. It comes at no extra cost and applies regardless of which model Copilot is using.

On the CLI release line, the v1.0.93 pre-releases made command sandboxing available to all users through /sandbox and --sandbox, sandbox network allowlists now support localhost and loopback hosts, and MCP server configuration changes apply between turns without restarting the session.

New models and local models

Claude Haiku 5.5 is generally available in Copilot. Per the changelog, it targets fast, high-volume work such as subagents, quick edits and terminal tasks, and in early testing matched Claude Sonnet 5 on many coding tasks with fewer tokens and steps. It is available on Pro, Pro+, Max, Business and Enterprise across VS Code, Visual Studio, Copilot CLI, JetBrains, Xcode, Eclipse, github.com and GitHub Mobile, billed at provider list pricing. Rollout is gradual, and Business and Enterprise admins manage access through the model policy.

GPT-6.1 Sol is rolling out. According to the GitHub changelog, it targets agentic coding and terminal workflows on Copilot Pro+, Max, Business and Enterprise. GitHub reports it completed tasks with noticeably fewer tokens and steps than GPT-6 and GPT-5.6. It is available in VS Code, Visual Studio, JetBrains, Xcode, Eclipse, Copilot CLI, github.com and GitHub Mobile.

Copilot CLI discovers local models. From version 1.0.94-0, running /model lists models from a running Ollama instance next to your configured and cloud models. Nothing is added automatically: you review the provider and endpoint, then add it for the session or without switching. Models must support tool calling and streaming. A local model does not enable offline mode, which stays opt-in via COPILOT_OFFLINE=true.

Retirements. GitHub deprecated four models on October 2: Gemini 3.5 and 3.6 Flash (use Gemini 3.8 Flash), Kimi K2.7 Code (use Kimi K3) and Claude Opus 4.7 (use Claude Opus 5.5). More deprecations are scheduled for October 19, so watch the Copilot changelog.

Stacked pull requests and code review

Stacked pull requests are GA on all github.com plans, per the announcement. You can split a large change into small, independently reviewable PRs that merge together.

• "Rebase stack" keeps approvals on unchanged code.
• A stack enters the merge queue as one merge group, and is retargeted instead of closed if its base branch is deleted.
• Shift+J and Shift+K navigate the stack, the pull_request webhook has a stacked action, and the gh stack extension supports worktrees.
• Auto-merge for a group is rolling out over the next few weeks, and GitHub Enterprise Server support is planned.

Copilot code review has an API. The October 2 changelog says reviews can be requested through the REST and GraphQL APIs with a per-request effort setting. Balanced is now the default level for new and existing repositories and organizations, effective September 28, and explicit Lite selections were kept. It is available on Pro, Pro+, Max, Business and Enterprise.

Maintainers can also now count draft pull requests toward PR limits, a useful brake on low-quality, agent-generated contributions.

Copilot CLI 1.0.92 and other updates

• Copilot CLI 1.0.92 (October 5) adds copilot config subcommands and the Ctrl+E environment picker for switching between local and cloud runs. Shell output now streams stdout and stderr live in the timeline, and the sandbox no longer exposes ambient GitHub tokens unless you configure them explicitly.
• The September VS Code release adds scheduled automations in the Agents window, agent merge for handling review feedback, failed checks and conflicts, and PR creation straight from agent sessions.
• GitHub introduced a purpose-built model for leaked secrets that reads surrounding code to catch credentials without a recognizable token format, such as plain passwords. Opt-in push protection and Copilot /security-review checks consume GitHub AI Credits.
• Copilot for JetBrains got new controls and chat improvements.

OpenAI Codex

Reusable cloud environments and Security Cloud

The biggest Codex story is the move into the cloud, as reported by TechCrunch. At DevDay on September 29, OpenAI announced several changes, summarized by The Decoder:

• Persistent, reusable cloud environments: start a task on your phone, continue on your desktop, and long-running jobs survive a closed laptop.
• A refreshed CLI with voice to start and steer tasks, an /agents view for tracking several tasks, and native worktree support.
• Code review inside the ChatGPT desktop app, including automatic initial reviews while you are away, before feedback goes to GitHub or GitLab.
• Codex Security Cloud, which scans GitHub repositories on a schedule or on every code change, investigates and de-duplicates findings, and prepares fixes for review.

GPT-6.1 Sol Ultrafast

GPT-6.1 Sol Ultrafast speeds up token generation in Codex and ChatGPT Work. The Decoder puts it at up to 8x in Codex at six times standard pricing. Per the Codex changelog, it is available on Pro $500 and eligible Enterprise and Edu plans, is off by default for Enterprise until a workspace owner enables it, and supports inference residency in the US and Europe (EEA plus Switzerland).

CLI 0.160.1 to 0.162.1

All of these are on the Codex releases page.

• 0.162.1 is a bug-fix update: it fixes a TUI crash when asynchronous questions span multiple lines, and startup failures caused by mismatches between a running background server's feature settings and CLI defaults. Compatibility checks now apply only to explicit command-line feature overrides. Alpha builds of 0.163.0 are already circulating.
• 0.162.0 (October 8) adds managed Git worktree tools for trusted local projects, task pinning in the agent Command Center, capability settings for custom model providers, and JavaScript helpers with ranked tool search in Code Mode. Fixes include CRLF preservation in apply_patch, Linux sandbox and Windows file-access issues, honoring server Retry-After advice, and a signed PowerShell installer for Windows.
• 0.161.0 (October 7) made GPT-6.1 Sol the default model in the bundled and Amazon Bedrock catalogs, added multi-agent V2 and Ultra reasoning on Bedrock, and introduced /mcp login <name> for signing in to MCP servers.
• 0.160.1 preserves SYSTEMROOT, TEMP and TMP when launching remote stdio MCP servers, which matters for Windows environment variables passed through to MCP servers.

GPT-5.5 leaves Codex for ChatGPT sign-in

The Codex changelog says GPT-5.5 retires from Codex for ChatGPT sign-in on October 14, 2026, and the API is unaffected. It also says gpt-6.1-sol, added September 29, offers near-Astra performance for complex work at lower cost. The same changelog lists a ChatGPT for iOS update (October 7) that opens Codex task links directly and adds a redesigned approval picker.

Claude Code: 2.1.290 to 2.1.296

Hook and permission safety

• Fail-closed hooks (2.1.295): per the changelog, onFailure: "block" for command and HTTP hooks means a hook that errors or times out blocks the action instead of letting it through. You have to set it.
• Instruction-style hooks (2.1.294): prompt and agent hooks written as instructions, such as "Block commands that...", could previously let actions through that they should have blocked. That is fixed, and prompt hooks on Stop and SubagentStop are judged better so Claude is less likely to stop early. Details are in the CHANGELOG.
• Permission prompts (2.1.292): PreToolUse hook approvals and auto mode no longer bypass the permission prompt for file reads from network (UNC) paths, and sandboxed commands can no longer read staged /ultrareview upload copies.
• Managed settings (2.1.290): new warnings for a link pointing outside the managed settings folder, and ignored sandbox allowRead paths or allowed domains now show in /status and doctor. This release also closes several MCP and permission-rule enforcement gaps. Version 2.1.296 fixes several managed-settings hook issues.

Haiku 5.5, sub-agents and workflows

• Haiku 5.5 (2.1.293): adds claude-haiku-5-5, now the default Haiku model on the Anthropic API, with a 1M context window and pricing of $0.10/$0.50 per million tokens ($0.50/$2.50 for prompts over 100K).
• Sub-agent effort (2.1.292): an effort parameter on the Agent tool lets Claude run a sub-agent at the effort level you ask for.
• Workflows and subagents (2.1.296): adds CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL, CLAUDE_CODE_OVERLOADED_RETRY_MAX_DELAY_MS, an autoCompactWindow setting for subagents, a code policy key for the Claude apps gateway, and an allow_large option on the Read tool for reading big text files in one call.
• Retries (2.1.292): CLAUDE_CODE_OVERLOADED_RETRY_BASE_DELAY_MS sets a longer base delay for backoff when retrying overloaded (529) requests.
• Managed Agents (2.1.290): /claude-api managed-agents-onboard <url> sets up the Managed Agents pattern a page describes, and it can also build a Console quickstart template such as deep-researcher with the ant CLI.

MCP and plugins

• Description limits: 2.1.295 cuts tool descriptions loaded through tool search at 16,384 characters instead of 2,048. The 2.1.296 notes raise the default MCP tool description limit from 2,048 to 4,096 characters.
• Protocol and fixes (2.1.295): subagents preload at most 32 skills, claude.ai connectors negotiate MCP protocol version 2026-07-28 by default, and many MCP reconnect and pagination bugs are fixed. Version 2.1.293 fixes a memory leak in HTTP MCP connections.
• Plugin hooks (2.1.290): agentId on the tool.check event lets a hook tell a subagent's permission check from the main session's, plus serverToolUses on turn.step results.
• Marketplace (2.1.292): claude plugin install --marketplace <source> adds the marketplace if needed, under the same policy checks as marketplace add, then installs the plugin.
• Mods (2.1.293): subagentStatusLine payloads include agentType, and mods can set isDeferred to false on $.tool.register to list a tool's schema in the prompt from the start.

Everyday fixes

• WebFetch no longer silently drops page text past 100,000 characters. It reports how much was unread and takes an offset to continue (2.1.290).
• claude attach <name> and claude logs <name> accept part of a session name instead of the full id (2.1.290).
• Version 2.1.291 fixes two regressions: cloud sessions dropping answers to permission prompts, and the last messages of a session being lost on quit.
• Saved scheduled tasks created after /resume now fire, a background /loop survives a process restart, and plan mode is restored when resuming from the session picker (2.1.292).
• Program Status Protocol support (OSC 7501) lets terminals show whether Claude is working, waiting or done, and the Claude apps gateway returns a request-id header (2.1.295).
• Requests no longer fail on [1m] models when a gateway or cloud provider refuses the context-1m beta, and background-work turns no longer drop earlier output in claude -p (2.1.295).

OpenCode: 1.18.35 and 1.19

The OpenCode v1.19.0 release makes TUI updates go through an explicit /update command, so updates are no longer installed automatically. It also adds opencode upgrade --major to move to OpenCode 2, permits the OpenAI ultrafast service tier, and validates PTY connection origins and tickets before checking whether a PTY exists.

OpenCode 1.18.35 (October 6) adds JSON and Markdown formats for agent-readable stats, and passes supported images in xAI tool results while skipping unsupported formats. Version 1.18.34 re-signed macOS binaries with a Developer ID for macOS 27+.

Gemini CLI

Gemini CLI continues on a nightly cadence, with recent fixes for process and CPU hangs. The AI CLI Tools Digest is a handy daily overview of these projects.

What to Do

• Update Claude Code to 2.1.296. Set onFailure: "block" on any hook that guards destructive actions, and re-test instruction-style hooks.
• Review your organization's Copilot sandbox policy and decide whether to require it. Turn it on before running agents on untrusted repositories.
• Try Haiku 5.5 for subagent and quick-edit workloads.
• Move Codex workflows off GPT-5.5 before October 14, and update Codex CLI to 0.162.1.
• If your Copilot workflows pin a deprecated model, switch now, and check your model choices ahead of October 19.
• Break large agent-made changes into stacked PRs, and check that Balanced effort suits your repositories.
• Evaluate Codex Security Cloud as a scheduled scanner, but review any generated fix before merging.
• OpenCode users: run /update deliberately, and read the OpenCode 2 notes before using --major.

Sources

• Claude Code changelog
• Claude Code CHANGELOG.md
• GitHub changelog: Local sandboxing GA
• GitHub changelog: Claude Haiku 5.5 in Copilot
• GitHub changelog: GPT-6.1 Sol in Copilot
• GitHub changelog: Discover local models in Copilot CLI
• GitHub changelog: Selected models deprecated
• GitHub changelog: Stacked pull requests GA
• GitHub changelog: Copilot code review API
• GitHub changelog: Draft pull requests count toward limits
• GitHub changelog: Copilot in VS Code, September 2026
• GitHub changelog: Leaked secret detection model
• GitHub changelog: Copilot for JetBrains
• GitHub Copilot changelog
• GitHub Copilot CLI releases
• TechCrunch: Codex reusable cloud environments
• The Decoder: OpenAI DevDay Codex and API announcements
• OpenAI Codex changelog
• OpenAI Codex releases
• OpenCode releases (sst)
• OpenCode releases (anomalyco)
• AI CLI Tools Digest