Four models in, six out, a bot on the deploy: AI coding tools shipping Sep. 18–25
A practical scan of September 18–25 releases across GitHub Copilot, Cursor, Claude Code, Devin, Kiro and Replit, focused on a model catalog turned over in two days and the controls that now watch what agents do.
The qualifying releases in this issue shipped between Friday, September 18 and Friday, September 25, 2026. The cutoff is 10:00 a.m. Pacific on September 25, so anything published later that day belongs to next week's issue.
Two movements ran at the same time. GitHub Copilot's model menu turned over inside two days: four models arrived, and six got an October 19 retirement date, all under a new global default that switches new models on for Business and Enterprise unless an administrator says otherwise. Around the agent, controls and instrumentation thickened — a local sandbox for the Copilot app, agent traces exported to your own monitoring stack, an enterprise-wide review-depth default, and two Cursor bots that follow a change into production.
Engineering managers can scan the summary table first, then use the review action attached to each release to decide what to pilot, what belongs in policy, and what is only worth watching.
The week in one view
| Tool and release | Date | What changed | Why it matters | First review action |
|---|---|---|---|---|
| GitHub Copilot: model lineup turnover | Sep. 18–22 | Grok 4.7, GPT-6 Sol, GPT-6 Luna and Claude Opus 5.5 joined the model picker across Pro, Pro+, Max, Business and Enterprise SKUs. Separately, six models — Gemini 3.7 Flash, GPT-5.5, GPT-5.4, GPT-5.4 mini, GPT-5 mini and Grok 4.5 — retire on October 19 with named replacements. 1234 | Any team that pinned a retiring model has a fixed migration date, and the replacements are already switched on for Business and Enterprise. | Diff your pinned model list against the October 19 replacement list and change every model that matches. |
| GitHub Copilot: default enablement policy | Sep. 24 | A global "Default policy for new features" — Enabled, Disabled, or Let organizations decide — covering generally available features and supported client capabilities. Configurable now, effective October 22. 5 | Features left unconfigured will follow the enterprise default instead of waiting for an administrator, so silence becomes a decision. | Pick the default before October 22 and list which features you have explicitly enabled or disabled. |
| Copilot app: local sandboxing | Sep. 23 | Per-project filesystem, network and credential policy for local repository and working-tree sessions; off by default; a session fails rather than runs unsandboxed when the operating system cannot enforce the policy. Public preview. 6 | It bounds what an unintended command can reach on a developer machine, and enterprise-managed settings can tighten the effective policy further. | Turn it on for one repository holding real credentials and watch a session hit the boundary. |
| Copilot app: OpenTelemetry export | Sep. 22 | An enterprise-managed telemetry block in managed-settings.json can export agent activity to a compatible monitoring tool; prompt and response content is excluded by default. 7 | Agent sessions become inspectable in the tracing tools a platform team already runs, without per-developer configuration. | Point the export at a test collector and read one trace before rolling it out. |
| Copilot code review: settings at every level | Sep. 23 | A personal code review page, now on every plan including Business and Enterprise, with separate toggles for new pushes and draft pull requests and a default effort of Lite or Balanced. Enterprise admins also get one default review effort that organizations and repositories can override. 8 | Review depth becomes a setting an organization picks once, rather than a choice made review by review. | Set the enterprise default, then check which repositories already override it. |
| Cursor: Rollouts and Security Review | Sep. 23 | Two bots on Teams and Enterprise plans. Rollouts writes a monitoring plan onto each pull request, watches the change through deploy per environment, and can open a revert pull request for review. Security Review posts one comment per pull request naming exploitable bugs with severity, attack path and a proposed fix. 9 | The last mile — verifying the change in production and finding exploitable bugs before merge — arrives as a paid plan capability. | Enable Security Review on one repository and read the first finding against the code it names. |
| Claude Code 2.1.277–2.1.282 | Sep. 18–24 | Six releases, including Opus 5.5 as the new default Opus model, auto mode defaulting to the server-side classifier, Bedrock role assumption and guardrails on the gateway, and AGENTS.md project instructions. 1011 | The default Opus model and the auto-mode billing path both changed, which moves cost and policy on managed and gateway setups. | Check what /status reports for the auto-mode classifier and whether your gateway bills it. |
| Devin | Sep. 18–23 | SWE-2, Cognition's next-generation software engineering model, opened as a research preview in the agent selector. Composable autoreview triggers, Helix Swarm and Bitbucket Data Center review support, and Microsoft Teams without tenant-wide admin consent followed. The GitHub App asked for more permissions. 12 | The GitHub App permission request needs an organization admin's approval, and SWE-2 must be enabled at enterprise and organization level before anyone can pick it. | Approve or decline the GitHub App permissions, then decide whether to turn on SWE-2. |
| Kiro: Crew 0.7.0, CLI 2.24.0, Web and IDE 1.1.70 | Sep. 21–24 | Crew gained a durable queue and pull-request watches beyond GitHub; the CLI gained session-wide tool approval and stopped loading project .env files automatically; Kiro Web gained reasoning effort; the IDE reached 1.1.70. 13141516 | Project .env files no longer reach chat sessions, MCP servers or tools, which breaks any workflow that depended on them. | Look for an MCP server or agent command that read a project .env variable, and export it in your shell instead. |
| Replit acquires Atta | Sep. 25 | Replit announced the acquisition of Atta, a business-analysis and charting company, alongside a first shipped capability: interactive charts inside Replit chat. 17 | Replit Agent now answers data questions with charts in the same conversation, without SQL or a separate BI tool. | Ask one of your own datasets a question in a Replit conversation and check the chart it returns. |
GitHub Copilot: four models in, six on the October clock
Four models reached the Copilot picker between September 21 and September 22. Grok 4.7, xAI's reasoning model, went to Pro, Pro+, Max, Business and Enterprise SKUs. 2 OpenAI's GPT-6 Sol and GPT-6 Luna followed the next day: Sol is positioned for interactive and agentic coding and lands on Pro+, Max, Business and Enterprise, while Luna is the cheapest member of the GPT-6 family and also reaches the plain Pro plan. 3 Claude Opus 5.5 arrived the same day on Pro+, Max, Business and Enterprise, billed at Anthropic's list pricing. GitHub's own early testing found it resolved tasks comparably to Claude Opus 5 while using fewer steps and tokens, and Anthropic watermarks its text output. 4
Then the other half of the swap. On September 18 GitHub published the retirement list for six models across every Copilot surface — Copilot Chat, inline edits, the ask and agent modes, and code completions — dated October 19, 2026:
| Retiring model | Retires | Replacement |
|---|---|---|
| Gemini 3.7 Flash | Oct. 19, 2026 | Gemini 3.8 Flash 1 |
| GPT-5.5 | Oct. 19, 2026 | GPT-5.6 Sol 1 |
| GPT-5.4 | Oct. 19, 2026 | GPT-5.6 Sol 1 |
| GPT-5.4 mini | Oct. 19, 2026 | GPT-5.6 Luna 1 |
| GPT-5 mini | Oct. 19, 2026 | GPT-5.6 Luna 1 |
| Grok 4.5 | Oct. 19, 2026 | Grok 4.6 1 |
Two lines in that notice matter more than the dates. The suggested alternatives are switched on automatically for Copilot Business and Enterprise, unless an administrator has turned off the global default or disabled that specific model. 1 And GitHub removes the retired models without any action from you, so the migration work sits entirely in whatever your workflows, prompts and evaluation harnesses assumed about the old ones.
GitHub Copilot: a global default that turns silence into a decision
On September 24 GitHub introduced a global default policy for generally available Copilot features and supported client capabilities, configured at AI Controls → Copilot → "Default policy for new features". It reaches the eligible features on an enterprise's "Features & clients" page, the Copilot Code Review policy on the Agents page, and the MCP servers in Copilot policy. 5
The three settings are Enabled, Disabled, and Let organizations decide. For 28 days the policy can be configured without affecting anyone's access. On October 22 it takes effect: features left Unconfigured follow the enterprise's chosen default, features an administrator explicitly enabled or disabled keep that decision, and preview features stay opt-in — including a preview you opted into that later ships as generally available. 5
The practical effect is that the gap between "released" and "available to my users" closes on its own. A team that wants to review each new capability before it reaches developers has to say so inside the next four weeks.
GitHub Copilot app: sandbox the files, export the traces
Local sandboxing arrived in public preview on September 23. It is configured per project for local repository and working-tree sessions, across three groups: filesystem (extra read/write folders, extra read-only folders, denied folders), network (outbound internet, local network), and credentials (Git credentials for authenticated HTTPS operations, GitHub CLI credentials). 6
The project settings describe the policy the app requests when a sandboxed session starts, and enterprise-managed settings can make the effective policy stricter. If the operating system cannot enforce the requested policy, the sandboxed shell fails with an error instead of running without one. 6 It ships off by default. You turn it on per project under Sandbox → "Sandbox new sessions", or type
/sandbox on to change a single running session without touching the project default. Cloud sandbox sessions and remote hosts are outside its scope, and the app's sandbox settings are separate from the CLI's. 6A day earlier, agent observability arrived through the enterprise settings file. A
telemetry block in managed-settings.json exports agent activity to a compatible monitoring tool, so a session's model requests and tool calls can be followed as traces, unexpected behavior can be reviewed step by step, and the settings apply across teams rather than machine by machine. Prompt and response content is excluded by default, and GitHub asks administrators to review content-capture settings before enabling it. 7GitHub Copilot code review: one setting, three levels
Copilot code review gained a personal settings page on September 23, available on every Copilot plan including Business and Enterprise, where previously these controls existed only for Pro, Pro+ and Max and covered a single automatic-review switch. The page separates three toggles — automatic review on pull request creation, coauthorship or leaving draft; automatic review of new pushes to a pull request Copilot is already reviewing; and automatic review of draft pull requests you create or coauthor — plus a default review effort. 8
Authorized enterprise administrators can now set one default review effort — Lite, Balanced, or the GitHub default — for the whole enterprise. It applies to organization-owned repositories through inheritance, and organizations and repositories keep their own overrides. 8 Static analysis at every pull request costs money and reviewer attention, and this is the first lever for setting that cost per enterprise rather than per repository.
Cursor: two bots for the last mile
Cursor shipped two bots on September 23, both on Teams and Enterprise plans. 9
Rollouts attaches a monitor to every pull request and follows the change as it deploys, reporting per environment as verified healthy, regression detected, or inconclusive. When a pull request opens, Rollouts reads the diff and the systems it touches and writes a monitoring plan as a comment: the risks it found, the effect the change is meant to have, the signals it will check, and gaps in instrumentation that would make the change hard to verify. You can edit that plan in the pull request and Rollouts uses your version. 9 It then wakes on deploy events and runs the plan against your logs, metrics and traces, tracking environments separately, so a change can pass in staging and still be flagged in production. On a detected regression it names the change it suspects, notifies the author, and can open a revert pull request for review or hand the finding to a cloud agent for a fix. Rollouts stops short of merging or rolling back on its own today. 9 Source control comes from Origin or GitHub, deploy events from your continuous delivery system, and signals from Datadog and other telemetry providers, with feature-flag integration listed as coming soon. 9
Security Review reads every pull request in the context of the codebase and posts one comment reporting exploitable bugs; style and quality findings stay with Bugbot. It looks for injection across SQL, command and template surfaces, authentication and authorization bypasses including checks a refactor stopped running, secrets and credentials committed to source, SSRF and unvalidated redirects, unsafe deserialization, and dependency changes that introduce known vulnerabilities. 9 Each finding carries a severity, the attack path and a proposed fix, can be dismissed with a reason so it is not raised again on that pull request, and can be governed by team rules such as which clients external calls must go through. Draft pull requests are skipped. 9
os.system. The comment names the description, the impact and the remediation. 9Both bots are enabled from the automations tab. For ten days from launch Cursor is including usage credits, sized for roughly 50 changes on Teams and 500 on Enterprise. 9
Claude Code 2.1.277–2.1.282: a new default Opus, and who pays for the classifier
Claude Code published six releases between September 18 and September 24. 11
Version 2.1.280 added Claude Opus 5.5 and made it the default Opus model, with a 1M-token context window and pricing of $4 per million input tokens and $20 per million output tokens, with cache reads at $0.20 per million. 10 The same version tightened a write path that mattered for permissions: writes through a symlinked path are now judged by where they land rather than their in-tree spelling, so the prompt names the real destination and
acceptEdits, allow rules and auto mode stop approving a write that lands outside the tree. 10Version 2.1.278 changed who runs auto mode's safety classifier. For Claude API and Enterprise users, and on Bedrock, Vertex, Foundry and gateways, auto mode now defaults to the server-side classifier, which does not charge for classifier overhead;
CLAUDE_CODE_AUTO_MODE_SERVER=0 opts out on the non-Anthropic platforms, and Claude Code warns when it falls back to a path that is billed. /status gained an "Auto mode server" row reporting which classifier the session uses. 10 A platform team that had budgeted for client-side classifier calls should confirm that line.The gateway work continued across the week. Version 2.1.281 added support for newer Claude Desktop keys in
desktop policy blocks, including blockReadsOutsideWorkingDirectories and disableBypassPermissionsMode; added assume_role on Bedrock upstreams so the gateway calls Bedrock as an IAM role it assumes through STS, optionally with one session per developer; and added a guardrail: {id, version} setting that applies an Amazon Bedrock guardrail to every request through those upstreams. 10 The same release added "attribution": false in settings.json to hide commit and PR attribution entirely, with a note that older CLI versions skip a settings file carrying the key. 10 Version 2.1.277 added AGENTS.md support, read instead of CLAUDE.md in a project that has none, switchable under "Project instructions" in /config and not yet available on Bedrock, Vertex or Foundry. 10Devin: SWE-2 in preview, and a review surface that reaches further
Devin opened SWE-2, which it describes as Cognition's next-generation software engineering model, as a research preview in the agent selector. You pick SWE-2 plus a reasoning effort — Medium, High or Max — when starting a session, switch to it mid-session from the agent toggle next to the message input, or use
!swe2 in Slack. Enterprise administrators enable SWE-2 (Preview) for the enterprise, and organization administrators then turn it on or off per organization under Agent capabilities. 12Automatic review gained a rule builder. In Settings → Review you can enroll a whole account, an SCM organization, a repository, a repository prefix or an individual member, then narrow each trigger with filters on pull request author, reviewer, label, title, source or target branch, changed files, author type and diff size, combined with all, any or not; each trigger also sets when Devin reviews, and exclusions override triggers so a matching pull request is never reviewed automatically. 12 On the same day Devin Review gained Helix Swarm reviews from the Perforce depot, and Bitbucket Data Center users who linked an account can post and edit discussion comments, add or remove reviewers, and decline a pull request as themselves. 12
Two items need an administrator. Microsoft Teams now connects with a single button and no longer requires a Global Administrator by default, with direct messages and people lookup working without tenant-wide admin consent inside the teams where Devin is installed. 12 And Devin's GitHub App is requesting additional permissions: Organization Administration read, Custom Organization Roles read, Code Scanning Alerts read, Secret Scanning Alerts read, Members read for GitHub team sync, and Actions write so Devin can rerun workflows. GitHub organization administrators receive an email and are asked to approve the updated permissions, and Devin keeps working with the current permissions until they do. 12
The older of the three release notes in this window moves Knowledge into Skills: existing notes are converted automatically into skills inside a
knowledge plugin for each scope, with content unchanged, and an organization's Knowledge page becomes read-only once migrated. 12Kiro: durable work in Crew, isolation in the CLI
Kiro Crew 0.7.0 shipped on September 24 and moved most settings to apply as soon as they are saved, with a badge marking the few that still need a Gateway restart. Accepted subagent work, Task Runner steps and workflow calls now enter a durable queue before they run, so a Gateway restart restores queued work instead of dropping it, and the System page shows the active queue and the concurrency in force. 13 Pull-request watches widened beyond GitHub to GitLab, Bitbucket Cloud and Azure DevOps Services, with Azure DevOps and private Bitbucket watches required to start from a dashboard conversation. 13 Preview users can add OpenCode and goose to the agent backend selector, let Jev route individual turns between models, or run remote crews on AWS Fargate, where tasks live six hours by default and the runtime admits at most ten at once. 13
The CLI change to check before upgrading is environment isolation. From CLI 2.24.0, project
.env files no longer load automatically into chat sessions, MCP servers or tools; Kiro starts with the environment inherited from your terminal, so variables a project .env used to supply have to be exported in the shell, and MCP servers have to reference exported values in their own configuration. 14 The same release added session-wide tool approval in V3 through /tools trust-all, which prompts for confirmation before enabling because it approves tool calls for the rest of the session. 14Kiro Web gained a reasoning-effort selector for models that support levels, folded consecutive reasoning steps and tool calls into one collapsible timeline, and made the five-document attachment limit apply per message rather than accumulating across a session. 15 CLI 2.23.0 had moved reasoning controls into
/model and let V3 cloud sessions start before a repository is connected. 18 IDE 1.1.70 added a configurable default timeout for local agent commands, opened Markdown links to workspace files in the editor, and fixed restored Agent Focus sessions reconnecting to a blank chat pane. 16Replit buys Atta, and puts charts in the chat
Replit announced on September 25 that it is acquiring Atta, a business-analysis and charting company, and shipped the first capability from it the same day: interactive charts directly in Replit chat. 17 You upload a dataset or connect a data source in a conversation and ask a question, or ask Replit Agent to visualize what it just discussed, and it selects a chart type suited to the data — a waterfall for a revenue change, a heatmap for retention patterns — with labels and layouts that adapt as the chart is resized. 17
Founders Omar Shaik and Amine Ben Khalifa join Replit with the acquisition. Replit states the longer-term direction — an investigation becoming a recurring routine, then slides for a leadership review — as intent, and inline charts are the shipped part. 17
Also shipping
Copilot for JetBrains 1.18.0, dated September 22, brought assisted approvals in public preview, where low-risk tool calls are approved automatically and higher-risk actions still prompt. It also added re-editing of an earlier message with the conversation and file changes rewound to that point, organization and enterprise skills plus organization-managed custom instructions in local and agent sessions, plan mode for the Codex agent, a switch for the built-in GitHub MCP Server plus persistent per-tool controls, and hid inline chat in JetBrains Gateway and remote development environments. JetBrains IDE 2025.1 users now see advance notice to upgrade to 2026.1 or later. 19
Copilot in Slack and Microsoft Teams, dated September 25, now takes Slack files, attachments and message links as context, and in Teams inline images, forwarded messages and channel or thread history. Copilot checks for a similar existing issue before opening a new one, links the resulting work back to the originating conversation, and keeps a mid-conversation model switch for the rest of the thread, with channel defaults available in Slack. The public preview is available to organizations on Copilot Business and Enterprise. 20
OpenAI's Codex CLI published 0.157.0 on September 24, adding GPT-6 Sol and Luna with Amazon Bedrock support and migration prompts for older models, turning fullscreen transcripts on by default, and enforcing network restrictions across redirects and ongoing HTTP and WebSocket traffic, including cancelling access when a policy change revokes it. 21
Gemini CLI published 0.61.0 on September 23 with fixes that prevent indirect prompt injection through build-file modifications and untrusted flags, and harden the sandbox's filesystem boundaries and runtime state isolation. 22
Monitored this week, no release found
The Windsurf JetBrains plugin changelog still ends at version 2.12.27 dated August 17, 2026, and the JetBrains Marketplace version list shows the same version with an August 18 update date. 2324 Aider's newest release on PyPI remains
aider-chat 0.86.2, uploaded February 12, 2026. 25 Continue.dev's newest Open VSX build remains 2.1.0 with a June 19, 2026 timestamp. 26 JetBrains Junie's blog feed shows no post newer than September 18, and both of that day's posts were covered in the previous issue. 27Tabnine's release notes page renders its content in the browser and returned no readable text, so nothing dated could be verified from it this week; the newest dated product note on Tabnine's product-news page is older than this window. 2829
Editorial view
The week's releases share one mechanism, and it is the same one in five different places: a setting that used to sit inert until somebody turned it on now carries a live default that the vendor owns. Copilot's new policy makes unconfigured features follow an enterprise default from October 22, and the same default machinery is what switches new Copilot models on for Business and Enterprise the day they ship. 15 Claude Code's auto mode now runs its classifier server-side by default on the API, Enterprise and the major cloud platforms, and tells you in
/status which path a session took. 10 Kiro's CLI stopped loading a project .env into agent processes, which closes a quiet channel for credentials and breaks workflows that used it. 14 Gemini CLI hardened its sandbox's filesystem boundaries. 22Read together, the review question changed shape. A tooling owner used to be asked which capabilities to switch on; this week's releases ask them to audit what is already on and to say so before a deadline. That reading is mine, drawn from the release notes above rather than from any vendor's statement.
A second pattern is thinner but consistent: the new instrumentation lands on the buyer's surface rather than the developer's. Copilot's OpenTelemetry export is configured in the enterprise settings file, 7 the review-effort default is an enterprise setting that organizations inherit, 8 Cursor's Rollouts reports change health per environment through a pull request comment, 9 and Devin's review triggers are enrolled by account, organization or repository. 12 Each one gives a platform or quality owner a lever they can set for everyone at once.
Worth doing before next Friday
- Diff your pinned and default models against the six retirements due October 19, and update prompts, evaluations and CI that name an old model. 1
- Choose the Copilot global default — Enabled, Disabled, or Let organizations decide — before October 22, and record which features you have explicitly set either way. 5
- On any Claude Code setup behind Bedrock, Vertex, Foundry or a gateway, read the "Auto mode server" row in
/statusand confirm who is billed for the classifier. 10 - Turn on local sandboxing for one repository with real credentials and let one agent session hit the boundary. 6
- Find any MCP server or agent command that relied on a project
.envfile, and export those values in the shell before the Kiro CLI upgrade reaches the team. 14 - Decide on Devin's expanded GitHub App permissions, which need an organization administrator's approval in the installation settings. 12
References
- 1
- 2Grok 4.7 is now available in GitHub Copilot
github.blog
- 3
- 4
- 5
- 6Local sandboxing in the GitHub Copilot app
github.blog
- 7OpenTelemetry in the GitHub Copilot app
github.blog
- 8
- 9Rollouts and Security Review
cursor.com
- 10Claude Code changelog
code.claude.com
- 11anthropics/claude-code releases
github.com
- 12Devin changelog
devin.ai
- 13Kiro Crew 0.7
kiro.dev
- 14Kiro CLI 2.24.0
kiro.dev
- 15
- 16Kiro IDE 1.1.70
kiro.dev
- 17
- 18Kiro CLI 2.23.0
kiro.dev
- 19
- 20
- 21Codex CLI 0.157.0
github.com
- 22Gemini CLI 0.61.0
github.com
- 23Windsurf JetBrains plugin changelog
docs.devin.ai
- 24Windsurf plugin versions on the JetBrains Marketplace
plugins.jetbrains.com
- 25aider-chat on PyPI
pypi.org
- 26Continue on Open VSX
open-vsx.org
- 27Junie blog feed
blog.jetbrains.com
- 28Tabnine release notes
docs.tabnine.com
- 29Tabnine product news
tabnine.com
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.