Agents get hands, workflows become code: AI coding tools shipping Sep. 25–Oct. 2
A practical scan of September 25–October 2 releases across GitHub Copilot, Claude Code, Codex CLI, Gemini CLI, Kiro, Devin, Devin Desktop and Replit, focused on agents that act inside desktop apps and orchestration that moved into code.
The qualifying releases in this issue shipped between Friday, September 25 and Friday, October 2, 2026. The cutoff is 10:00 a.m. Pacific on October 2, so anything published later that day belongs to next week's issue.
The previous edition covered a model catalog turning over in two days. This week the change moved one layer up, to the part of the tool that decides what runs: which model answers, which step comes next, and who checks the result. GitHub Copilot added two models on consecutive days, then gave its agent a pair of hands on the desktop and a way to write a whole process as code. Kiro shipped the same idea as Workflows across its IDE, CLI and web surfaces. Replit described an agent that picks its own subagents instead of consulting a router. Around all of it, the controls a buyer sets at the top got denser, from a validator for enterprise settings to review-stage timings in the usage metrics API.
Engineering managers can scan the summary table first, then use the review action attached to each item to decide what to pilot, what belongs in policy, and what is only worth watching.
The week in one view
| Tool and release | Date | What changed | Why it matters | First review action |
|---|---|---|---|---|
| GitHub Copilot: Claude Sonnet 5.5 and GPT-6.1 Sol | Sep. 28–29 | Sonnet 5.5 reached Pro, Pro+, Max, Business and Enterprise. GPT-6.1 Sol reached Pro+, Max, Business and Enterprise. Both bill at provider list pricing, and default model enablement turns a new model on for Business and Enterprise unless an administrator has switched it off. 12 | The picker your developers choose from changed twice in two days, and both additions arrived ready to use on managed accounts. | Read the model policy for the plans you manage and decide whether each new model should stay selectable. |
| GitHub Copilot: computer use | Oct. 1 | Public preview in Copilot CLI and the Copilot app on macOS and Windows. The agent reads an application's content and visual context, then clicks controls, types, scrolls and drags inside it. Each app needs approval, and organization-managed settings can switch the feature off. 3 | It reaches legacy and GUI-only software that has no API, CLI or MCP integration, which is where a large share of enterprise workflow still sits. | Name the two or three internal apps with no API that slow your team down, and pilot one under the approval prompt. |
| GitHub Copilot: dynamic workflows | Oct. 1 | Orchestration defined in code: sequential or parallel steps built around agent calls, with checkpoints a run can pause at. Available in Copilot CLI, the Copilot app and the SDK on all plans, in public preview; the CLI needs experimental features switched on. 4 | A repeatable multi-agent process becomes a versioned artifact that runs the same way every time. | Pick one recurring team process, such as release checks, and have Copilot draft the workflow so you can read the steps before anyone depends on it. |
| GitHub Copilot: HydraFusion in VS Code and the app | Sep. 30 | The multi-model orchestration preview left the CLI for VS Code 1.140 and later and the Copilot app, with three workflows: Single, Cascade and Critique. Business and Enterprise administrators switch preview features on first. 5 | Model choice becomes a policy the tool optimizes within a turn, instead of a value a developer picks per request. | Run HydraFusion beside Auto on one task you already measure, and read which workflow it chose. |
| GitHub Copilot: VS Code September roundup | Oct. 1 | A recap of VS Code 1.136 through 1.140: scheduled automations, agent merge that handles review feedback, failed checks and merge conflicts, pull requests opened from agent sessions, Dev Container sessions, and Codex conversations carried over from the ChatGPT app. 6 | Several of the pieces that carry a change from session to merge arrived as previews, so their switches are a decision you can make now. | Find the teams running VS Code 1.140 and decide whether agent merge should be on before it becomes habit. |
| GitHub Copilot: controls for enterprise buyers | Sep. 25 | An in-product validator for enterprise managed settings, review-stage timings in the usage metrics API, and Copilot Memory feeding agentic autofix. 789 | A managed-settings file that never applied used to look the same as one that did, and the new validator makes the difference visible. | Run the validator against your .github-private managed settings and correct anything it names. |
| Claude Code 2.1.283–2.1.287 | Sep. 25–Oct. 1 | Five releases, including Sonnet 5.5 as the new default Sonnet with a 1M-token context, availableModelsMatch and deniedModels managed settings, an allowedProviders restriction, and Claude Mods. 1011 | The default Sonnet model and the list of providers a managed machine may reach both changed inside one week. | On a managed setup, check that availableModels, deniedModels and the provider list still describe what you intend. |
| OpenAI Codex CLI 0.158.0–0.160.0 | Sep. 28–Oct. 1 | Five stable releases in the window. Version 0.159.1 put GPT-6.1 Sol in the bundled catalog as the default model, with the Bedrock catalogs updated to match. 1213 | A default model change inside the CLI moves cost and behavior without anyone choosing it. | Read the release notes for the version your team runs and confirm the catalog default is the model you expect. |
| Gemini CLI 0.62.0 | Sep. 29 | A reliability release: authentication-loop fixes, PTY and terminal-buffer cleanup, MCP tool-call title formatting, and a retry indicator during connection recovery. 14 | The fixes target long-running agent loops, which is where headless runs break. | Upgrade one CI job that runs Gemini CLI headless and watch whether the auth loop comes back. |
| Kiro: Workflows across IDE, CLI and web | Sep. 28–30 | Workflows became an opt-in feature on all three surfaces, Claude Opus 5.5 arrived across them at a 2.0x credit multiplier, and untrusted workspaces gained stricter approval checks. 15161718 | Workflows are off by default, and the Classic command-line interface now shows a deprecation notice. | Switch Workflows on for one team and decide how to move anyone still launching Classic sessions. |
| Devin | Sep. 25 | Interactive HTML reports by default, 57 new hosted MCP servers, Microsoft 365 MCP connections requesting write scopes, Bitbucket Data Center automatic reviews and comment threads, and Azure DevOps pipeline-log reading. 19 | The new MCP defaults and the wider review surface change what Devin can reach without a fresh approval. | Review the write scopes your Microsoft 365 MCP connection now requests before anyone relies on them. |
| Devin Desktop, formerly Windsurf 3.10.48 | Sep. 29 | Sign in with ChatGPT lets an eligible ChatGPT Plus or Pro plan pay for GPT model usage in the editor. The release also fixes an Agent-window memory leak and a typing stall. 20 | The editor once called Windsurf can now bill GPT usage against a developer's personal ChatGPT plan, which changes who pays. | Decide whether developer-owned ChatGPT plans may cover editor usage, or keep that spend on an enterprise account. |
| Replit: harness design | Sep. 29 | Replit described an agent whose core loop chooses its subagents' tier and effort and adjusts its own as a task unfolds, in place of a router that reads each turn. 21 | It is an argument about where model choice belongs, and it arrives with vendor benchmark claims attached. | Compare the claim against your own spend on a repeated task before treating it as a plan input. |
GitHub Copilot: two more models, and a menu that keeps moving
Claude Sonnet 5.5 reached general availability on September 28. GitHub positions it for well-scoped everyday work such as building a feature or fixing a bug, and its own early testing found it matching Claude Sonnet 5 on coding tasks while using fewer steps, tokens and tool calls, and finishing faster. Sonnet 5.5 is the widest-reaching of the two additions: Pro, Pro+, Max, Business and Enterprise, and the model picker in Visual Studio Code, Visual Studio, Copilot CLI, the Copilot coding agent, the Copilot app, github.com, GitHub Mobile, JetBrains IDEs, Xcode and Eclipse. 1
GPT-6.1 Sol followed the next day, aimed at agentic coding and terminal workflows. GitHub's early testing credits it with reliable multistep work on fewer tokens and steps than the GPT-6 and GPT-5.6 families. Sol starts one tier higher than Sonnet 5.5, reaching Pro+, Max, Business and Enterprise but not the plain Pro plan. 2 Both models bill at provider list pricing under usage-based billing.
The line that matters for a managed account is the same in both announcements. Under default model enablement, a new model is enabled automatically unless an administrator has turned off the global default or disabled that specific model. 12 Two more names appeared in every developer's picker this week, and the only thing standing between a developer and a list-price model on a managed plan is the policy an administrator set in advance.
GitHub Copilot: hands on the desktop, and a process in code
Computer use opened in public preview on October 1 in Copilot CLI and the GitHub Copilot app on macOS and Windows. Copilot reads an application's accessible content and visual context, then clicks controls, enters and edits text, presses keys, scrolls, drags and moves through a workflow across applications. The use case GitHub names is the software that has no API, no command-line interface and no MCP integration, which is a large share of what runs inside a regulated enterprise. 3
The boundary is an approval prompt. Copilot asks before it controls an application, an always-allow choice can be reviewed or reset later, and organization-managed settings can disable the feature outright. On macOS the setup walks through the Accessibility and Screen Recording permissions the operating system requires. Teams switch it on for a session with
/computer on in the CLI or a toggle in the app's settings. 3Dynamic workflows, also October 1, put the orchestration itself into code. A workflow is a program inside a Copilot extension that defines the steps, decides when an agent is involved, and says how each agent's result is used; the steps run one after another, in parallel, or both. It can run commands and call other services, split a goal into independent tasks, pass structured results between stages, have subagents verify each other's findings, ask for input, and pause at a checkpoint so a person can review before it resumes. 4
GitHub draws the distinction from
/fleet, where Copilot delegates work to subagents and coordinates them in parallel: a dynamic workflow follows a process written down in code. The examples are the ones a platform team already runs by hand — release checks that pause for review, a large pull request reviewed file by file in parallel, a sweep for a pattern across many directories. Dynamic workflows are in public preview and available on all plans; the Copilot app has them with no setup, and Copilot CLI needs experimental features enabled with --experimental or /experimental on. 4HydraFusion leaves the CLI
HydraFusion, GitHub's multi-model orchestration research preview, reached Visual Studio Code 1.140 and later and the Copilot app on September 30. The name appears in the model picker, but it stands for a choice of workflow rather than a single model: Single has one model solve the task, Cascade has an efficient model draft a solution and a quality gate escalate it to a stronger model, and Critique has one model draft a result while an independent read-only critic from a different model family reviews it, after which the drafting model revises once. 5
GitHub contrasts HydraFusion with Auto, which selects a model per request; HydraFusion selects a workflow and coordinates several models within a turn. It is open to Pro, Pro+, Business and Enterprise users, and for Business and Enterprise an administrator has to enable preview features first — in VS Code that is
chat.copilot.hydraFusion.enabled. The feature stays a research preview. 5VS Code's September, collected in one place
GitHub's October 1 roundup covers VS Code 1.136 through 1.140 and reads as the month's agent plumbing. In the Agents window, automations run a task hourly, daily or weekly or on demand; agent merge, once enabled in an active session, handles review feedback, failed checks, merge conflicts and workflow reruns; and a pull request can be opened from a Copilot, Claude or Codex agent session with its title and description reviewed first. Sessions gained a "mark as done" suggestion after their pull requests merge, an optional application badge for new results and pending checks, and Dev Container startup so a session runs with the project's own tools. 6
Two items in the roundup cross product lines. A Codex conversation started in the ChatGPT app can be picked up in VS Code, and in chat an agent's message no longer interrupts the turn already running. Automations, agent merge, the mark-as-done suggestion and the application badge are all previews. 6
The controls a buyer sets
Three Copilot changes from September 25 all land on the buyer rather than the developer.
The first is a validator for enterprise managed settings. Until now a managed-settings file with malformed JSON, an unsupported option or an unmapped team could sit in
.github-private looking applied while the policy never took effect. The validator reports those problems in a "Copilot settings validation" section of the enterprise AI controls page, naming the affected file and JSON path for each issue, and covers copilot/managed-settings.json, copilot/team-mappings.json and any team settings file the mappings reference. The workflow is to correct the issue, commit to the default branch of .github-private, reload the Agents page and read the result again. 7
The second adds review-stage timings to the Copilot usage metrics reports. A new
pull_request_review_times array on each repos-1-day row reports a median and a 90th percentile for three stretches: ready for review to first review, first review to final review, and final review to merge. Only human reviews are counted, so a pull request reviewed by both a person and Copilot code review still appears, and the array is empty on a day a repository merged nothing that qualifies. There is no backfill: the data builds forward from the release date, and pull requests that became ready for review before September 21, 2026 are left out of this section. 8The third connects Copilot Memory to security fixes. Agentic autofix now reads existing memories for context when it works a security alert, and stores the pattern it used as a memory for later use — memories that can also teach Copilot code review and the Copilot cloud agent the secure patterns particular to a repository. Both agentic autofix and Copilot Memory are in public preview. 9
Claude Code: a new default Sonnet, and two ways to fence a machine
Claude Code published five releases between September 25 and October 1. 11
Version 2.1.284 added Claude Sonnet 5.5 and made it the default Sonnet model on the Anthropic API, with a 1M-token context and pricing of $2 per million input tokens and $10 per million output tokens, with cache reads at $0.20 per million. The same release added a "Yes, but ask again next time" answer to auto mode's prompt before a read outside the working directories, put the gateway's spend limit in
/usage in dollars, and added /mcp reconnect all. 10Two releases tightened what a managed machine is allowed to do. Version 2.1.283 added
availableModelsMatch, which with the value "exact" allows only the model version an availableModels entry names, so a new release stays blocked until it is listed, and deniedModels, which blocks named models even when availableModels allows them. 10 Version 2.1.285 added allowedProviders, a managed setting that limits which API providers a machine may reach — the Anthropic API, a custom endpoint, Bedrock, Mantle, Vertex AI, Foundry, Claude Platform on AWS or a cloud gateway. The same release added claude --desktop to open the desktop app on the current project, and an environment variable to switch the WebFetch tool off. 10The newest release, 2.1.287, introduced Claude Mods, which let a plugin modify deeper behavior, and shipped the first of them: a built-in mod called "You should know" that runs a side agent to flag things a person or Claude might miss, enabled with
/plugin enable cc-plugin-you-should-know@builtin. It also added URL prompts from MCP servers on the 2025-11-25 protocol, used for flows such as signing in, with a note that a server which stops connecting after the update needs "bareElicitationCapability": true added to its MCP config entry. 10Codex CLI and Gemini CLI: a default swapped, and a loop tightened
The OpenAI Codex CLI shipped five stable releases in the window. Version 0.159.1 added GPT-6.1 Sol to the bundled model catalog as the default and updated the Amazon Bedrock Mantle and Runtime catalogs to match, so the model a fresh install reaches for changed without anyone selecting it. 1213 Version 0.158.0 added support for MCP servers that require a pre-registered OAuth client secret, bearer-token authentication for direct exec-server WebSocket connections, and terminal input approval by default for commands running with elevated permissions. Version 0.160.0 added a keyboard-accessible way to browse older tasks, session startup outside a project under workspace defaults, and opt-in Guardian review capabilities. 12
Gemini CLI's 0.62.0 stable release landed on September 29 as a maintenance cut. It fixes OAuth refresh-token retention, PTY file-descriptor cleanup and terminal-buffer memory management, formats MCP tool-call titles as structured signatures, and shows a retry indicator while a connection recovers — the class of fix that decides whether a long headless run finishes. 14
Kiro: Workflows on every surface, and a deprecation notice
Kiro spent the week turning one idea into three releases. Workflows run a reusable, multi-step plan in the background while the parent conversation continues; each step runs in its own agent session, sees only what earlier steps hand it, and pauses when it needs input. Kiro ships three bundled recipes —
investigate for read-only work, feature-pipeline for staged delivery and publish-pr for opening a pull request and handling review — and a run can be inspected step by step, steered while it runs, paused, resumed, stopped or retried after a failure. 17The feature is off by default everywhere it landed. Kiro Web enables it under Settings, the IDE under Workspace Configuration or
kiroAgent.workflows.enabled, and the CLI 2.26.0 through /settings followed by a restart. 151617 The IDE release also hardened untrusted workspaces: Kiro asks before the agent changes agent, Hook or Power files, or the Workflow recipes under .kiro/workflows/, even when broader file permissions would allow the write, and a recipe in an untrusted workspace does not load until the workspace is trusted. 15The deprecation notice is the item to act on. Classic sessions in the CLI now show a deprecation notice, and when a flag, environment variable or saved setting is what launched Classic, the notice names it and points to guidance for the terminal interface. That arrived in 2.26.0; 2.25.0, a few days earlier, had added Power install and uninstall from chat or the command line, selectable V3 output styles and a
SessionEnd Hook. 16 Separately, Claude Opus 5.5 arrived across the IDE, CLI, Crew and web at a 2.0x credit multiplier, down from Opus 5's 2.2x, with a 1M-token context and experimental cross-region inference for Pro, Pro+, Pro Max and Power customers in us-east-1 and eu-central-1. 18Devin: a long release note, and a new way to pay
Devin's September 25 release note is the largest single entry of the week, and three clusters inside it change what the agent can reach.
The first is MCP. Fifty-seven hosted integrations joined the Marketplace, and Microsoft 365 MCP connections now request all read/write permissions that do not need administrator approval by default, so Devin can send mail, create events and post in Teams without reconnecting. Organization administrators can now change the access level of MCP servers installed by a plugin, and switches only an organization administrator can change carry a lock icon. 19
The second is review coverage. Bitbucket Data Center repositories can now be enrolled for automatic reviews, with Devin reading the comment thread and replying in thread, and Azure DevOps pipeline job logs are readable for failed checks, with a service hook notifying Devin when a pipeline on its pull request fails. The Devin Review status comment on a pull request now accumulates across commits instead of resetting on each push, and required checks that have not reported show as pending. 19
The third is output. When a report would benefit from interactivity and no format was named, Devin now produces an interactive HTML report with charts, tables or diagrams. Separately, the GitHub Enterprise Server apps that new registrations create request Organization Administration read and custom-organization-roles read so Devin can mirror an organization's roles and default repository permission into its access groups. 19
Devin Desktop, the editor formerly called Windsurf
The editor that shipped as Windsurf is now Devin Desktop, and its September 29 release carried a billing change alongside two performance fixes. Sign in with ChatGPT lets an eligible ChatGPT Plus or Pro plan pay for GPT model usage inside the editor; you choose a GPT model and those requests are billed to the ChatGPT plan, with Replit's sibling pattern of a lead model and a sidekick echoed in Devin's own suggestion to run Fusion with GPT-6 Astra leading and SWE-2 assisting. 20
The fixes matter to anyone running long sessions. Long or noisy shell commands no longer grow the Agent window's memory with every terminal refresh, which could previously crash the window, and a smaller local settings file stops typing, text selection and copy-paste from stalling the extension host. A new agent session started without a folder pick now keeps every folder of a converted multi-folder workspace. 20
Replit: the model picks its own subagents
Replit used a September 29 engineering post to argue against the model router. A router reads each turn and names an LLM, and by Replit's reasoning it is always less capable than the model it is choosing for. Replit Agent takes the other route: the core loop chooses each subagent's tier and effort and adjusts its own as the task unfolds, and on Replit's account GPT-6 Astra hands routine implementation to cheaper subagents and decides where its own tokens are worth spending. 21
The claims are Replit's own and come with named benchmarks: Replit Agent is Pareto-efficient against Astra alone on DeepSWE and Terminal-Bench, meaning no published Astra baseline costs less and scores higher, and it beats a single long-lived worker by 11 and 16 points on those two. The post also reports a design trend Replit says it observes — that stronger models delegate on their own, using subagents for context management and parallelism, which reduces what the harness has to scaffold. Treat the benchmark numbers as vendor results on named harnesses until an independent run reproduces them. 21
Monitored, with no verifiable release in the window
| Tool | Last verifiable release | Where checked |
|---|---|---|
| Cursor | Rollouts and Security Review, Sep. 23, 2026 | The changelog index still lists September 23 as its newest entry. 22 |
| Aider | aider-chat 0.86.2, uploaded February 12, 2026 | The PyPI release index shows no newer upload. 23 |
| Continue.dev | 2.1.0, timestamped June 19, 2026 | The Open VSX registry still reports 2.1.0 as the current version. 24 |
| Tabnine | Newest dated product note September 16, 2026 | The product-news blog carries no newer dated entry, and its own release-notes page renders client-side. 25 |
| JetBrains Junie | Newest post September 18, 2026 | The Junie feed's newest item is the September 18 local-model post. 26 |
Cursor's absence is worth reading carefully. Its last changelog entry was the September 23 pair of agents, Rollouts and Security Review, which the previous issue covered, and nothing appeared on the changelog index during this window. 22
Editorial view
The week's releases share one mechanism: the harness — the layer that decides which model runs, in what order, and who checks the result — became the thing being shipped. GitHub Copilot's dynamic workflows let a team write that layer down as code, and HydraFusion lets it choose between three arrangements inside a single turn. 45 Kiro's Workflows put named steps into separate agent sessions that hand results along. 17 Replit's post argues the harness should hand the choice to the model itself. 21 Five vendors, one week, the same layer.
A second pattern runs opposite to it. The more the harness decides, the more the buyer needs a way to see and bound it: Copilot's managed-settings validator, the review-stage timings in the usage metrics API, Claude Code's
availableModelsMatch, deniedModels and allowedProviders, and Kiro's untrusted-workspace approvals all exist to answer a question a developer no longer answers per request. 781015 The two movements are the same story told from both ends, and that reading is mine, drawn from the release notes rather than from any vendor's statement.Computer use is the outlier, and it is the one to watch. Everything else this week changed how a model is chosen or bounded; computer use changes what it can touch, reaching software with no API at all. 3 That single change moves a class of enterprise workflow — expense reports, internal tools, old line-of-business applications — inside the reach of an agent, with an approval prompt as the only gate.
Worth doing before next Friday
- Run the managed-settings validator against your
.github-privateconfiguration, then correct and re-commit anything it reports, because a policy that never applied is indistinguishable from one that did until now. 7 - Decide the model policy for Sonnet 5.5 and GPT-6.1 Sol on the plans you manage, since default enablement has already made both reachable. 12
- Pick one GUI-only internal application and run it under computer use with the approval prompt intact, so the boundary is tested before anyone depends on the feature. 3
- Check
availableModels,deniedModelsandallowedProviderson a managed Claude Code setup, and confirm the new default Sonnet is the one you intend. 10 - Find anyone launching Kiro Classic sessions and read the notice's list of flags, environment variables and saved settings before the deprecation closes. 16
- Review the write scopes a Microsoft 365 MCP connection now requests on Devin, and the ChatGPT-plan billing route that Devin Desktop offers developers. 1920
References
- 1Claude Sonnet 5.5 in GitHub Copilot
github.blog
- 2GPT-6.1 Sol in GitHub Copilot
github.blog
- 3
- 4
- 5
- 6
- 7
- 8
- 9Agentic autofix now uses Copilot Memory
github.blog
- 10Claude Code changelog
code.claude.com
- 11anthropics/claude-code releases
github.com
- 12openai/codex releases
github.com
- 13ChatGPT and Codex changelog
learn.chatgpt.com
- 14Gemini CLI v0.62.0
github.com
- 15Kiro IDE 1.2
kiro.dev
- 16Kiro CLI 2.26.0
kiro.dev
- 17
- 18Claude Opus 5.5 Now Available
kiro.dev
- 19Devin changelog
devin.ai
- 20Devin Desktop changelog
docs.devin.ai
- 21
- 22Cursor changelog
cursor.com
- 23aider-chat on PyPI
pypi.org
- 24Continue on Open VSX
open-vsx.org
- 25Tabnine product news
tabnine.com
- 26JetBrains Junie feed
blog.jetbrains.com
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.