Sandboxes become enforceable, models get retired: AI coding tools shipping Oct. 9–16

The qualifying releases in this issue shipped between Friday, October 9 and Friday, October 16, 2026. The cutoff is 10:00 a.m. Pacific on October 16, so anything published later that day belongs to next week's issue.

The previous edition covered a cheaper model tier and a local sandbox that finally shipped. This week the sandbox turned into a setting an administrator switches on, and the model catalogs turned over again with a price attached to the new entries.

GitHub put a frontier model in the picker and set a November date for retiring three others. Kiro gave every V3 user an operating-system sandbox for agent shell commands, with an autonomous mode that turns the sandbox on first. Devin Desktop let an enterprise point the editor at one approved extension marketplace. JetBrains ran its local coding agent on NVIDIA's new laptop platform from day one.

Engineering managers can scan the summary table first, then use the review action attached to each item to decide what to pilot, what belongs in policy, and what is only worth watching.

Gemini 4 Argon reached general availability in Copilot on October 13. GitHub describes it as built for complex coding, agentic and reasoning tasks, and says it solved more tasks than earlier Gemini models on every coding benchmark it ran, with the largest gains in Copilot CLI. Argon is available to Pro+, Max, Business and Enterprise, and a gradual rollout puts it in the picker across Visual Studio Code, Visual Studio, Copilot CLI, the coding agent, the Copilot app, JetBrains IDEs, Xcode and Eclipse. Billing is at provider list pricing. 1

One sentence decides what a managed account has to do about it. Under default model enablement, a new model is enabled automatically unless an administrator turned off the global default or disabled that model. A Copilot Business or Enterprise plan that never opted out therefore has Argon selectable already. 1

The same day, GitHub named what leaves. Claude Opus 4.8, Claude Opus 5 and GPT-5.6 Terra are deprecated across Copilot Chat, inline edits, ask and agent modes, and code completions on November 16, 2026. GitHub suggests Claude Opus 5.5 for both Opus models, and either GPT-6.1 Sol or GPT-6 Luna for Terra. 3

Claude Opus 4.8 carries an exception worth reading twice. It stays available to individual Copilot subscribers on annual plans, so they keep an Opus offering, and the deprecation does not apply to them. Two accounts on the same repository can end November with different pickers. No action removes a model after retirement; the work is on the successor side, where an administrator may still have to enable access through the model policy. 3

HydraFusion, GitHub's multi-model orchestration layer, got a wider pool and a heavier tier on October 14. It now draws on Claude Opus 5.5, GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna, and it sets reasoning effort per stage instead of taking each model's default: medium effort for a first draft, high effort for review. The Cascade workflow gained a judging step that inspects the first attempt and only asks for a repair when one is needed, and Critique leans on tools to read the workspace and runs parallel critic models. 2

HydraFusion Max uses the same architecture tuned for heavier tasks. It applies higher reasoning effort where depth matters and still uses orchestration to consider token efficiency. Both options remain in research preview, run in Visual Studio Code, the Copilot app and Copilot CLI, and appear on Pro, Pro+, Business and Enterprise plans where experimental or preview features are enabled and the organization's model policy allows them. 2

Agentic autofix for code scanning alerts reached general availability on October 15, and it changes what a security alert does. Assigning an alert to Copilot makes it explore the relevant files, propose a fix, rerun CodeQL to confirm the alert closes, iterate if it does not, and open a draft pull request that summarizes the fix and the validation steps. From an alert list or a security campaign, up to 25 alerts can be handed over for one pull request, and the REST API accepts the same request by setting assignees to copilot-swe-agent[bot]. 4

The access path runs through three doors. An enterprise administrator enables an "Agentic autofix" policy in Advanced Security policies, then an organization or repository administrator turns it on in Code Security settings, and a Copilot billing method has to be defined. It is available to GitHub Code Security and GitHub Advanced Security customers on GitHub Enterprise Cloud, including with data residency. 4

The billing split is the part to settle before enabling. Agentic autofix consumes AI credits from the Code Security budget and GitHub Actions minutes, and the usage appears in enterprise billing as the Advanced Security product, where SKU-level budgets can be set. 4

Managed settings gained two enforcement tools the same week. forceRemoteSettingsRefresh makes supported clients, Copilot CLI, Visual Studio Code and the Copilot app, retrieve current server-managed settings at startup rather than trusting a cached policy. When the client cannot confirm current policy it fails closed, so Copilot does not start on a stale policy. Server-managed delivery begins requiring refreshes after the client has received the value once, while MDM and file-based delivery can require freshness before the first sign-in. 6

The second tool is a version floor. GitHub is adding minimum client version requirements to governance-focused managed settings keys over time, starting with the sandbox key, which supports the generally available local sandbox. When that key is in managed settings, a developer pinned to an older Copilot client has to update before using Copilot again. 6

Telemetry separated identity from content. The telemetry.capture.identity setting adds three attributes to OpenTelemetry data: user.name for the authenticated Copilot account, process.user.name for the local operating-system account, and host.name for the machine. Identity capture is off by default and stays separate from the existing pseudonymous user identifier. 7

Five content classes are controlled independently: prompts, responses, tool arguments, tool output, and policy detail such as sandbox filesystem paths. Every class is off by default, explicit managed values beat local settings, SDK configuration and environment variables, and the older captureContent shorthand never turns identity on. Prompts and tool data can include source code, file contents and user-profile paths, so GitHub's own advice is to enable only what an audit needs and send it to an approved endpoint. 7

The Copilot plugin for JetBrains picked up the same administrative idea on October 10. Enterprise administrators can now choose any available Copilot agent model as the default for new conversations while leaving the explicit picker choice intact. A Fix action in diagnostic intention menus sends a reported problem to inline chat, a setting lets you stop Copilot and Claude MCP servers from starting automatically, and support for JetBrains IDE 2025.1 ended, so 2025.2 or later is now required. 8

Two smaller items round out the week. Copilot in Slack and Microsoft Teams can now work across several repositories inside one conversation, take an @ mention anywhere in a message, and use shared Slack messages and threads as context. 5 And the weekly roundup published October 9 describes a Copilot app that can use separate GitHub accounts for the Copilot license and for repositories, which suits an enterprise-provided license alongside repositories reached through a contractor account. 9

Kiro shipped an operating-system sandbox for agent-run shell commands in both clients on October 13. In Kiro IDE 1.3.0 you turn on the local command sandbox to limit what shell commands and their child processes can reach, choosing whether outbound network access is blocked, limited to common development hosts, or open. Local stdio MCP servers can run inside the same sandbox, and a status-bar item named Command sandbox opens the settings and confirms it is active. 10

Kiro CLI 2.31.0 carries the same capability to every V3 user, behind /sandbox. The boundaries are stated plainly: the agent itself, built-in file tools and remote MCP servers stay outside the sandbox, permission rules still govern agent actions, and Kiro says the sandbox reduces risk without guaranteeing complete isolation. That last point is the one to repeat to a team, because a sandbox is not a substitute for reviewing the commands an agent proposes. 11

The more consequential addition is autonomous mode. Running /autonomous on in a local V3 session lets Kiro work through a task without asking approval for each shell command, and Kiro switches to the Default agent and turns the local command sandbox on first. An approval prompt that disappears is exactly where a sandbox stops being optional. 11

A migration deadline moved closer on October 12. Kiro CLI 2.30.0 shows a startup prompt inviting you to switch to V3, save it as the default harness, enable automatic agent upgrades and start migrating custom agent configurations. V3 becomes the default when CLI 3.0 ships at the end of October, and the prompt is rolling out gradually, so not every host sees it immediately. The same release adds notices in a V3 transcript when a turn moves to another model because the selected one was unavailable or refused a request. 12

Three more Kiro items landed inside the window. CLI 2.31.1 on October 14 draws Mermaid diagrams directly in chat and makes saved settings work in headless V3 runs. 25 IDE 1.3.11 on October 15 opens Markdown files in a rendered review panel where you comment on exact passages and send the comments together, adds a What's New browser, and can generate commit messages before changes are staged. 13 Kiro Web on October 12 gained a fallback model that answers a single turn when the selected model is unavailable, a per-step model picker for workflows, a conversation preview while a session's sandbox restarts, and a way to grant extra iterations when a workflow loop hits its cap. 26

The model side moved in both directions. Kimi K3 arrived on October 15 with experimental support across the Kiro IDE, CLI, Crew and web for Pro, Pro+, Pro Max and Power customers using Kiro's US geography. Moonshot AI's open-weight model takes text and images, carries a 1M-token context, and costs a 2.4x credit multiplier. 14 Claude Sonnet 4 reached end of life in Kiro on October 14, with Kiro pointing customers to Claude Sonnet 5.5 as the current Sonnet model. 15

Kiro also entered Federal Risk and Authorization Management Program scope on October 12. Kiro is now in scope for FedRAMP Class C in the US East (N. Virginia) region, which is the program US agencies use to assess and continuously monitor cloud services. That opens the tool to government agencies, contractors and other organizations working under those requirements. 27

Cursor's Origin platform opened its app marketplace on October 13 with more than 20 partner integrations and public submissions. Origin is Cursor's code hosting platform, in early beta since August 17 on paid plans, with repositories, pull requests, code browsing and GitHub sync. 28 The marketplace now spans deployments, CI, code review, security, monitoring and project management, with named partners including Cloudflare, Vercel, CircleCI, CodeRabbit, Greptile, Semgrep, Socket Security, Sentry and Linear. 16

Building for the marketplace follows a documented path. An app is created in a namespace, kept private while it is built, then pointed at the Origin API, where apps authenticate with an app JWT and installation access tokens, receive webhook events, and write back check runs, pull request comments and reviews. Making it public is followed by a submission with a slug, suggested tags and a demo video that has to show install, uninstall and the core flows. 16

Devin's two releases in the window both touch what the agent remembers and what it lets administrators control. On October 9, Devin gained memory: it remembers what it learns about a user and their work across sessions, the memory is personal to that user, and it can be reviewed or switched off under Settings, Customization, Memory. Each night Devin reviews recent sessions and refines what it remembers, listed as recent dreaming sessions. Organization administrators can turn memory on or off for their organization, and enterprise administrators can force it either way. 17

The same October 9 note shortened the session resume window from 30 days to 14, kept session history available beyond that, added a Manage findings permission that separates who may change or dismiss scan findings from who may run scans, made scan findings from /scan write in the session's language, and gave secrets and enterprise settings clearer controls, including a renamed enterprise setting called "Only allow connecting admin-configured MCPs". 17

The October 14 note is mostly governance and plumbing. Code-scan findings can now be exported as SARIF 2.1.0 from the scan page or the findings export API. A new org-level Review manager role bundles Member permissions with Manage Review, and anyone holding Manage Devin Review can edit Review settings and rules and search repositories without also being an account, organization or Git integrations administrator. Splunk, Elastic, Dynatrace, Chronosphere and Google Cloud Monitoring joined as observability plugins, and the repositories and blueprint endpoints were promoted from /v3beta1/... to the stable v3 API. 17

Devin Desktop, the editor that was Windsurf, shipped version 3.10.67 on October 12. Enterprise administrators can now set an Extension marketplace URL in team settings, and when it is set the editor searches for and installs extensions from that marketplace alone. The release also adds support for MCP servers on protocol revision 2026-07-28, which use server/discover in place of initialize, remembers the model variant you last used in each family, and improves performance on very large or deeply nested folders. A private preview lets Devin Desktop connect to remote MCP servers configured in Devin Cloud, reaching enterprise-level MCPs only. 18

Claude Code published four releases between October 9 and October 15, and the money item is a price cut. Release 2.1.296 updated cost reporting to price Sonnet 5.5 cache reads at $0.10 per million tokens, down from $0.20, which lowers the cost of a long session that keeps reusing a cached prefix. The same release added a code key to the Claude apps gateway's managed policies, so the same settings can apply in Claude Desktop's Code tab, plus CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL for pinning every workflow agent to one model. 1920

Release 2.1.299 on October 14 added idle compaction, which trims a conversation over 200,000 tokens after roughly 54 minutes of inactivity, before the one-hour prompt cache expires, so the next message does not reprocess everything. A minimum-token setting changes that threshold and a settings entry turns it off. The release also added CLAUDE_CODE_DISABLE_FILE_MENTIONS, which gives Claude the paths of @ file mentions to read with its file tools rather than their contents. 19

Release 2.1.300 on October 14 is the observability one. Trace spans gained OpenTelemetry GenAI semantic-convention attributes such as gen_ai.provider.name, gen_ai.conversation.id and gen_ai.tool.name, and cache writes are now split by lifetime in the API request event. 19 Release 2.1.301 on October 15 added classifier_verdict, permission_mode and classifier_category to the tool_decision event, so a block from the auto-mode classifier can be told apart from a permission rule, and gave unattended retry mode a cap on how long it will wait for a usage limit that resets too far away. 19

Codex CLI shipped a small fix release on October 9 and a feature release on October 15. Version 0.162.1 fixed a terminal-interface crash on multi-line asynchronous questions and startup failures caused by a running background server and the CLI disagreeing about feature settings. 21 Version 0.163.0 opened /config for searching preferences across categories, with immediate changes for supported settings and a note on which ones need a restart, and made a follow-up message steer the agent while it is already responding. 21

Three more parts of 0.163.0 matter to how a machine is shared. A leader key is configurable in /keymap, with Ctrl+X as the default and voice mute moved to F9. A managed background server restarts from /daemon, which warns about the work a restart could interrupt and then reconnects on its own. Independent read-only tools, including skill, memory and conversation-history lookups, can now run in parallel. 21

Two behavioral defaults changed with it. Daybreak is enabled by default for eligible accounts, and codex exec can select it with an OpenAI API key when the server offers access. Resuming a saved thread now restores its permissions and network approvals while still respecting explicit overrides and current managed policy, and the network proxy checks permission before a DNS lookup, rejects duplicate Host headers, and stops credential aliases from bypassing inspection hooks. Codex also moved to its standard shell executor and no longer bundles a patched zsh. 21

Gemini CLI's 0.64.0 landed on October 13 as a reliability release with little that changes a plan. File tool operations are serialized and writes are made atomic, chat history uses append-only delta patching with a bounded window, and session state persists atomically and recovers from a backup when it is found corrupt. Folder trust now propagates in headless mode, the emergency Ctrl+C abort reaches its cancellation handler during active operations, and keyboard selection lists accept Enter and Spacebar reliably. 22

Replit's October 9 changelog opens a second way to run its agent. Replit Desktop entered private preview on Windows, where it can build and run apps locally on the PC, with each agent build running in its own isolated sandbox powered by Microsoft Execution Containers and NVIDIA OpenShell. Access is by waitlist. 23

The same entry lets one chat reach across projects. You can name a project or describe what it does, and Replit will find it, read its files and send it tasks, which changes land as background tasks you review, with nothing published automatically. The example Replit gives is asking one project's ordering flow to be adapted into another project, using the second project's own menu and design. Replit also added TikTok Ads, connected through MCP, so a campaign can be created and its performance reported from a chat. 23

JetBrains closed the week by putting its local agent on new hardware. Junie Local is supported on the NVIDIA RTX Spark from day one, and Windows support moved from experimental to stable. The RTX Spark pairs a Blackwell RTX GPU with a Grace CPU to run larger local models in slim laptops and compact desktops, and Junie Local automatically sizes its context window to the memory available to the GPU. 24

The requirements are the useful part for a hardware standard. An RTX Spark PC needs Windows 11 on Arm with at least 24 GB of memory available to the GPU. An x64 Windows PC needs an NVIDIA RTX card with at least 24 GB of VRAM, which covers an RTX 3090, 4090 or a 32 GB 5090, plus NVIDIA driver 581 or newer and about 20 GB of free disk space. JetBrains measured up to 55 tokens per second on the RTX Spark and offers Qwen3.6-27B or the merged Qwen3.8-3.6-27B-blend model. Junie Local is free, with no registration, subscription, credits or card. 24

The Windsurf-branded plugin has had no release since October 3, and the release that matters for that lineage is Devin Desktop 3.10.67 above. Tabnine's own release-notes page has returned a client-rendered shell for several weeks running, and this week its product-news archive resolved to Tricentis content instead, so no dated Tabnine coding-assistant release could be verified through either route.

Three dates are already set. On November 16, Claude Opus 4.8, Claude Opus 5 and GPT-5.6 Terra leave Copilot, and the successor models may still need enabling through a model policy. 3 At the end of October, Kiro CLI 3.0 makes V3 the default, and the switch prompt is already rolling out. 12 Kiro's Claude Sonnet 4 has already ended, so any saved configuration still naming it needs a successor chosen now. 15

One backlog is still being cleared across the month. The Copilot usage-metrics undercount reported in the previous edition is repaired by IDE updates, and GitHub's stated schedule spreads the fixes from Visual Studio through JetBrains, Eclipse and Xcode during late October and November. 33