Haiku 5.5 lands twice, local sandboxing ships: AI coding tools shipping Oct. 2–9
A practical scan of October 2–9 releases across GitHub Copilot, Cursor, Claude Code, Codex CLI, Gemini CLI, Kiro, Devin, Windsurf and Replit, focused on a cheaper default model tier and a local sandbox that now ships.
The qualifying releases in this issue shipped between Friday, October 2 and Friday, October 9, 2026. The cutoff is 10:00 a.m. Pacific on October 9, so anything published later that day belongs to next week's issue.
The previous edition covered orchestration moving into code. This week the same work got cheaper and moved closer to the machine the developer already owns. Anthropic's lightweight Haiku 5.5 reached GitHub Copilot on October 7 and became the default Haiku model in Claude Code the same day, at $0.10 per million input tokens. GitHub Copilot's local sandboxing left preview and shipped, built on a runtime that translates one policy into native controls on Windows, macOS and Linux. Copilot CLI learned to find a model already running on the laptop. GitHub also executed the model retirements it had announced in September, and the agent-activity numbers in Copilot usage metrics turned out to have been falling for weeks for a reason other than adoption.
Engineering managers can scan the summary table first, then use the review action attached to each item to decide what to pilot, what belongs in policy, and what is only worth watching.
The week in one view
| Tool and release | Date | What changed | Why it matters | First review action |
|---|---|---|---|---|
| GitHub Copilot: Claude Haiku 5.5 | Oct. 7 | A lightweight model for high-volume work — subagents, quick edits and terminal tasks — reached Pro, Pro+, Max, Business and Enterprise, billed at provider list pricing. Under default model enablement it is available on a managed account unless an administrator disables it. 1 | GitHub's early testing puts Haiku 5.5 level with Claude Sonnet 5 on many coding tasks while using far fewer tokens and steps, and this is the tier most agent work actually runs on. | Fold Haiku 5.5 into the model policy decision you already owe for Sonnet 5.5 and GPT-6.1 Sol, and check which model your default setting routes subagent work to today. |
| GitHub Copilot: local sandboxing generally available | Oct. 7 | Sandboxing shipped in Copilot CLI, the Copilot app and VS Code sessions using Agent Host. Commands and tools run with limits on filesystem, network, Git and GitHub CLI credentials, and on local MCP servers and language servers where supported. 2 | This is the containment layer for autonomous agent work, and administrators can require it through managed settings in a policy developers cannot weaken. | Turn it on for one team that runs long agent sessions, then confirm the policy still holds when a developer tries to widen it. |
| GitHub Copilot: local models in Copilot CLI | Oct. 7 | Copilot CLI 1.0.94-0 and later list models from a running Ollama instance in /model, alongside configured and cloud models. Adding one is a separate confirmation step that names the provider and endpoint. 3 | A model on the laptop becomes a first-class choice beside the cloud catalog, which changes where a prompt's code context can go. | Decide whether a local model is an approved destination for your code, because choosing one leaves offline mode and telemetry exactly as they were. |
| GitHub Copilot: a model for leaked secrets | Oct. 7 | A fine-tuned classifier reads surrounding code to catch credentials with no recognizable token format, including passwords. Existing AI-detected password alerts were upgraded automatically, and push-protection checks entered private preview. 4 | Secret checks now reach unstructured credentials at push time and inside Copilot's own security review, which pattern matching alone misses. | Read the billing notice before enabling anything: the alerts stay inside GitHub Secret Protection and Advanced Security at no charge, while the new push-protection and /security-review checks consume AI Credits. |
| GitHub Copilot: a metrics undercount | Oct. 6 | Agent sessions moved to the Copilot SDK without naming their IDE, so agent activity and agent lines of code dropped out of Copilot usage metrics and some was counted as Copilot CLI use. VS Code carries the fix now; other IDEs follow through November 2026. 5 | Reports an enterprise uses to judge adoption have been wrong for weeks, and the missing activity cannot be backfilled. | Move developers onto fixed IDE versions if you rely on agent metrics, because activity on an affected version is lost rather than delayed. |
| GitHub Copilot: code review by API, and a heavier default | Oct. 2 | Copilot code review can now be requested through the REST and GraphQL APIs, with an effort level set per request. Balanced became the default effort level for new and existing repositories, effective September 28. 6 | A review step that lived in the interface becomes something a pipeline can trigger, and the default review got more thorough without anyone choosing it. | Point one existing CI workflow at the review API and confirm the effort level your organization expects, since an explicit Lite setting is the only selection that was preserved. |
| GitHub Copilot: four models retired | Oct. 2 | Gemini 3.5 Flash, Gemini 3.6 Flash, Kimi K2.7 Code and Claude Opus 4.7 were deprecated across every Copilot surface. GitHub names Gemini 3.8 Flash, Kimi K3 and Claude Opus 5.5 as replacements. 7 | Workflows pinned to a retired model lost it without an action, and an enterprise administrator may still have to enable the successor. | Check the model policy for the three replacements and confirm each is enabled where your teams need it. |
| Cursor: remote control for local agents | Oct. 6 | The Cursor iOS app can watch and reply to agents running on a developer's computer. Remote control is on by default for everyone except Enterprise organizations, where an administrator enables it under Security and identity. 8 | An agent that stayed on one desk becomes steerable from a phone, while the work itself keeps running on the machine. | Decide the Enterprise switch deliberately, since the managed default is off and the computer has to stay awake and online to answer. |
| Claude Code 2.1.288–2.1.295 | Oct. 2–8 | Eight releases. Haiku 5.5 became the default Haiku model on the Anthropic API with a 1M-token context and $0.10/$0.50 per million tokens. Others added a blocking onFailure option for hooks, a per-upstream model list and a start-timeout on the Claude apps gateway, and an effort parameter for subagents. 910 | The cheap tier is now the default for the work Claude Code hands to a small model, and several sandbox and permission fixes landed in the same stretch. | Re-read the hooks your team runs, because a hook written as an instruction can now block an action instead of passing it through. |
| OpenAI Codex CLI 0.160.1–0.162.0 | Oct. 5–8 | Three stable releases. 0.161.0 made GPT-6.1 Sol the default model in the bundled and Amazon Bedrock catalogs and added /mcp login. 0.162.0 added tools for managed Git worktrees and hardened the Linux and Windows sandboxes. 11 | The catalog default moved again, and the same week closed sandbox gaps around denied files, writable helper executables and Windows temp permissions. | Confirm which model your installed version resolves to by default, and re-run any sandboxed build that depended on the old one. |
| Gemini CLI 0.63.0 | Oct. 6 | A reliability cut: the authentication loop caused by file contention, headless keyring state and dropped supervisor state was fixed, tool output is bounded in long-running loops, and plan execution now proceeds autonomously in non-interactive mode. 12 | Headless runs and CI jobs are where an authentication loop or unbounded tool output ends a job. | Upgrade one headless CI job and watch whether the authentication loop returns. |
| Kiro CLI 2.28.0 and Claude Sonnet 5.5 | Oct. 2–5 | The CLI now offers to switch an interactive Classic session to 3.0 and upgrade agent configurations, and V3 Hooks match a tool category instead of a tool ID. Sonnet 5.5 arrived across the IDE, CLI, Crew and web with a 1M-token context and a 1.3x credit multiplier. 1314 | The Classic migration Kiro announced now has a path out of the terminal, and the credit multiplier sets what the new model costs on a Kiro plan. | Take the switch offer on one Classic session, then check the 1.3x multiplier against the budget you set for Sonnet-class work. |
| Devin | Oct. 5 and 7 | A notification inbox with a Settings page that separates inbox-only alerts from phone pushes, a Terminal tab in the session workspace, Devin Review effort levels with an enterprise default, and code scans readable by id through the API and MCP. 15 | The agent's work became visible and tunable from more places, and review depth is now something an administrator sets rather than each trigger. | Set the enterprise Review effort default deliberately, because it applies to triggers across the organization. |
| Windsurf JetBrains plugin 2.12.28 | Oct. 3 | The plugin fixed a crash that stopped it starting on Macs with M6 chips. 16 | This is the first dated release on the Windsurf-branded surface since the middle of August. | Update the plugin if anyone on your team runs an M6 Mac. |
| Replit | Oct. 2 | Replit's changelog adds GPT-6.1 Sol in Max Mode and Claude Sonnet 5.5 in Power Mode as selectable models, a Jev integration through Replit AI Integrations, Settings as a full page, and workspace settings for company-wide rules with per-team exceptions. 17 | Model choice on Replit is now tied to the plan a builder pays for, and enterprise rules can be delegated to workspace admins. | Check which plan your builders need before a project depends on one of the two new models. |
GitHub Copilot: a cheap tier, and a sandbox that now ships
Claude Haiku 5.5 arrived on October 7 as Anthropic's smallest current model, and GitHub describes the work it suits as fast and high-volume: subagents, quick edits, terminal tasks. In GitHub's early testing it matched Claude Sonnet 5 on many coding tasks while using significantly fewer tokens and steps, which is the trade a team makes every time an agent spawns a worker for a small job. 1
Availability reaches Pro, Pro+, Max, Business and Enterprise, and the model appears in the picker in Visual Studio Code, Visual Studio, Copilot CLI, the Copilot coding agent, the Copilot app, github.com, GitHub Mobile, JetBrains IDEs, Xcode and Eclipse. Rollout is gradual, so the name may not appear immediately. Billing is at provider list pricing under usage-based billing. 1
The line that matters for a managed account is the one GitHub repeated from the last two model launches. Under default model enablement, a new model is enabled automatically unless an administrator has turned off the global default or disabled that specific model. Haiku 5.5 is therefore already selectable on a managed plan that has not opted out. 1
Local sandboxing reached general availability the same day, in Copilot CLI, the Copilot app and VS Code sessions that use Agent Host. Tools and commands Copilot starts run with restricted access to the filesystem, the network, credentials and other system capabilities, following a policy the developer or the organization defines. GitHub built it on Microsoft eXecution Container, which translates one sandbox policy into the native controls of Windows, macOS and Linux. 2
What a policy can now do is specific. It limits which files and directories an agent-run command may read or modify, controls access to the internet, local networks, Git credentials and GitHub CLI credentials, and applies to local MCP and language servers where supported. Enterprise-managed settings can require sandboxing and enforce rules a developer cannot weaken. GitHub's own framing separates the two questions the feature answers: sandbox policies apply to tool execution whichever model Copilot uses, so model choice and tool isolation are decided independently. Local sandboxing is included with Copilot at no additional cost. 2
The third item is smaller and points the other way. Copilot CLI 1.0.94-0 and later use
/model to discover supported models from a running local Ollama instance, beside the models already configured and the cloud models GitHub provides. Discovery does not add anything by itself: the developer reviews the provider and endpoint, then chooses whether to add the model and use it in the current session. Ollama and the model have to be installed already, and the model must support tool calling and streaming. 3One boundary is easy to misread. Selecting a local model turns on neither offline mode nor a telemetry pause. Offline mode stays an explicit choice through
COPILOT_OFFLINE=true, and GitHub notes that a remote provider can still receive prompts and code context over the network while offline mode is on. A team treating "local model" as "code never leaves the laptop" would have the wrong assumption. 3The last of the four October 7 posts targets secrets. GitHub has a fine-tuned classifier that reads the code around a suspected credential and judges whether it is one, including passwords that carry no recognizable token format, and it produces no code or prose of its own. Existing AI-detected password alerts were switched to the new model automatically, AI-detected secrets in push protection entered private preview, and a matching check is coming to the
/security-review command in Copilot CLI and the Copilot app. 4The billing split inside that announcement is the part to read before enabling anything. AI-detected secret alerts stay included in GitHub Secret Protection and GitHub Advanced Security at no extra charge, and that includes bringing them to GitHub Enterprise Server 3.23 in public preview. The new opt-in checks — push protection and the
/security-review additions — will consume GitHub AI Credits, billed to the organization that owns the repository, with usage attributed to the pusher only in enterprise-managed user namespace repositories. A check can consume credits even when it lets the push through. 4GitHub Copilot: what the buyer has had to do
Three Copilot changes from October 2 and 6 all land on the account owner rather than the developer.
The first is a retirement that went through on schedule. Gemini 3.5 Flash, Gemini 3.6 Flash, Kimi K2.7 Code and Claude Opus 4.7 were deprecated across Copilot Chat, inline edits, ask and agent modes, and code completions. GitHub names the replacements as Gemini 3.8 Flash for both Gemini models, Kimi K3 for Kimi K2.7 Code, and Claude Opus 5.5 for Opus 4.7. Removing the old models needs no action, but an enterprise administrator may still have to enable access to a replacement through the model policy in Copilot settings. 7
The second makes code review callable. Copilot code review can now be requested through the supported REST and GraphQL APIs, with an effort level set on each request, which lets a script, workflow or internal tool start a review from the system a team already uses. GitHub also confirmed Balanced as the default effort level for new and existing repositories and organizations, effective September 28, 2026, following the notice it published on August 28. An explicit Lite selection was kept, and the setting can be overridden at enterprise, organization, repository or personal level, each layer overriding the one above it. 6
The third is a correction. Copilot usage metrics had shown agent activity and agent lines of code falling while overall Copilot usage kept growing, and on October 6 GitHub named the cause: several IDEs had moved Copilot agent sessions onto the Copilot SDK, and those sessions did not identify which IDE they came from, so the metrics could not attribute them. Most of that activity was left out of reports and some was counted as Copilot CLI activity. 5
Two rules inside the fix decide what a team should do. Billing was never affected, so this is a reporting problem only. The data cannot be backfilled, because activity from an affected IDE version does not identify where it came from, and earlier Copilot CLI figures cannot be corrected either. Recovery is therefore gradual and depends on developers updating: VS Code 1.139.0 and later carry the fix now, Visual Studio 18.12 is expected in October 2026, JetBrains plugins in late October, and Eclipse and Xcode in November. 5
Cursor: the agents answer to a phone
Cursor's October 6 release lets the Cursor iOS app see and reply to the agents running on a developer's computer. Remote control is on by default for everyone except Enterprise organizations, which have to enable it under Org settings, Security and identity, Remote control. A desktop setting keeps the computer awake, and it has to be plugged in with the lid open for that to hold. 8
Nothing moves to the cloud. The agents keep running on the computer, and the app connects to it, so the machine has to stay on and online for a reply to arrive. Remote control also works without cloud agents, which makes it a separate feature from Cursor's cloud execution rather than an extension of it. For a managed organization the useful question is the enrollment state: here the managed default is off, and an administrator makes the choice. 8
Claude Code, Codex CLI and Gemini CLI
Claude Code published eight releases between October 2 and October 8, and the model inside them is the one with money attached. Version 2.1.293 added Claude Haiku 5.5 and made it the default Haiku model on the Anthropic API, with a 1M-token context and pricing of $0.10 per million input tokens and $0.50 per million output tokens, rising to $0.50 and $2.50 for prompts over 100,000 tokens. Any team that leaves the Haiku slot on its default inherited the cheaper model without selecting it. 910
Two releases tightened what a managed setup can rely on. Version 2.1.294 fixed
prompt and agent hooks written as instructions — the kind that read "Block commands that…" — which had been permitting what they were written to block. Version 2.1.292 closed a set of permission paths: a managed sandbox read-deny path that appears or re-points mid-session no longer drops project grants inside it or ends credential injection, a notebook or PDF read on macOS and Windows can no longer return a file outside what was approved through a link swapped in mid-read, and a tampered on-disk cache of server-managed settings can no longer switch off or unseat the built-in policy plugin. 9The newest release, 2.1.295, is mostly about operators. Command and HTTP hooks gained
onFailure: "block", so a hook that cannot start, times out or exits unexpectedly blocks the action instead of letting it through. The Claude apps gateway gained a start-timeout setting for cloud upstreams, an optional model list per upstream that is honored on failover, and forceLoginMethod: "gateway" for machines with no managed settings. Version 2.1.292 added an effort parameter to the Agent tool, so a subagent runs at the effort level the caller asks for. 9The Codex CLI shipped three stable releases in the window. Version 0.161.0 on October 7 made GPT-6.1 Sol the default model in the bundled and Amazon Bedrock catalogs, added
/mcp login <name> for signing in to an MCP server from an active terminal session, and changed Daybreak to opt-in through --enable cli_daybreak. 11 Version 0.162.0 followed on October 8 with tools for creating and listing managed Git worktrees from trusted local projects, /copy for navigating and copying transcript blocks, and sandbox fixes: Linux startup with multiple denied files, rejection of writable executables that could weaken a sandbox, and Windows temp permissions matched to the child process environment. An interim 0.160.1 on October 5 preserved the Windows startup environment when a remote stdio MCP server was launched with explicit remote variables. 11Gemini CLI's 0.63.0 landed on October 6 as a maintenance cut with one item aimed at unattended runs. The release fixes an authentication loop caused by file contention, a headless keyring and dropped supervisor state, bounds tool output size and manages memory in long-running agent loops, cleans up its temporary directory when a background shell exits, and enables autonomous plan execution in non-interactive mode. 12
Kiro, Devin and the Windsurf plugin
Kiro's migration out of the Classic command line got its first in-terminal path on October 5. When an interactive Classic session starts on a host that can run 3.0, Kiro offers to switch: choosing it saves 3.0 as the default, upgrades the agent configurations and reruns the command. Declining brings the reminder back about once a week. The same release, CLI 2.28.0, lets V3 Hooks match a tool category such as shell, read or write, or a named MCP server or tool, instead of an internal tool ID. 13
Claude Sonnet 5.5 reached Kiro on October 2, across the IDE, CLI, Crew and web, for Pro, Pro+, Pro Max and Power customers in
us-east-1 and eu-central-1, with a 1M-token context and adaptive thinking on by default. Kiro's own account of it says output is more than 30 percent faster than Sonnet 5 and that real-world knowledge work approaches Opus 5.5 performance. The number that touches a budget is the credit multiplier: 1.3x, against Opus 5.5's 2.0x. 14Devin's two release notes in the window move in the same direction, which is giving the person watching the agent more places to watch from and more control over depth. The October 7 note adds a notification inbox behind the sidebar bell, with a Settings page that decides which notifications land in the inbox and which also push to a phone, and marks a session's notifications read when it is opened. The same note grants enterprise administrators the ability to give a custom organization role the "Manage review rules" permission, which editing an organization's review rules and exclusions now requires, and adds a per-line redaction of saved private keys in command output. 15
The October 5 note is the larger one. The session workspace gained a Terminal tab for running commands on Devin's machine, the Files tab can now be opened while a session sleeps and opening either one wakes it, and HTML, PDF and SVG attachments can be opened in their own tab. Devin Review gained effort levels, settable by trigger action and with an enterprise default that administrators choose. A code scan can now be fetched by id through
GET /v3/organizations/{org_id}/code-scans/{scan_id} and through a matching get_scan action in the Devin MCP server. Bitbucket Data Center pull requests can have reviewers assigned by username, email or display name. 15The Windsurf-branded surface finally produced a dated release. The Windsurf JetBrains plugin reached v2.12.28 on October 3, and its changelog lists one substantive fix: a crash that prevented the plugin from starting on Macs with M6 chips. For anyone tracking the editor that became Devin Desktop, this is the first entry on the Windsurf plugin changelog since August 17, and the Devin Desktop editor itself has not shipped since v3.10.48 on September 29. 1618
Replit: two models behind two plans
Replit's changelog for October 2 adds two models and gates each by plan. GPT-6.1 Sol is available in Max Mode and Claude Sonnet 5.5 in Power Mode, both selectable when building with Agent. The same entry adds Jev through Replit AI Integrations, where
jev-latest is reachable through OpenRouter without managing API keys of your own. 17Two interface changes come with it. Settings moved out of a modal into its own page, with Integrations and Security getting separate pages, so a project or chat stays open underneath. For enterprise accounts, workspace settings let an administrator set rules company-wide, make exceptions for specific workspaces, and delegate some settings to workspace admins. 17
Monitored, with no verifiable release in the window
| Tool | Last verifiable release | Where checked |
|---|---|---|
| Aider | aider-chat 0.86.2, uploaded February 12, 2026 | The PyPI release index shows no newer upload. 19 |
| Continue.dev | 2.1.0, timestamped June 19, 2026 | The Open VSX registry still reports 2.1.0 as the current version. 20 |
| Tabnine | Newest dated product note December 15, 2025 | The product-news blog carries no newer dated entry, and its own release-notes page renders client-side. 21 |
| JetBrains Junie | Newest post September 18, 2026 | The Junie blog and its feed both stop at the September 18 local-model post. 22 |
Editorial view
Two of this week's items are the same argument seen from opposite ends, and the thing that joins them is cost per step on hardware the team already owns. Haiku 5.5 is the tier both GitHub and Anthropic put in front of high-volume work — subagents, quick edits, terminal tasks — and Claude Code made it the default Haiku on the Anthropic API at $0.10 per million input tokens. 19 Copilot's local sandboxing shipped the same day with a policy an administrator can require, and Copilot CLI began listing models already installed on the laptop. 23 Cheaper steps and an enforceable boundary around them are what both announcements change, and reading them as one direction is my inference rather than anything either vendor stated.
A second thread is smaller and points at administrators. Copilot's four model retirements and its metrics correction were both defaults that moved without the buyer choosing them: four names left the picker with replacements that may still be switched off, and weeks of agent activity were undercounted with no way to recover the numbers. 57 Both are answered by the same kind of work, which is reading the policy and the report rather than the release note.
The change worth watching is the boundary itself. Haiku 5.5 is the first cheap tier a team can point at subagent work by policy, local sandboxing is the first containment layer GitHub will let an administrator require, and Cursor put the steering surface on a phone. 8 The three together decide how much agent work a team can run without a person in front of it.
Worth doing before next Friday
- Move developers onto VS Code 1.139.0 or later if you rely on Copilot agent metrics, and schedule the JetBrains, Eclipse and Xcode updates for the same reason, because missing activity is lost rather than delayed. 5
- Enable Gemini 3.8 Flash, Kimi K3 and Claude Opus 5.5 in the model policy where your teams need them, since the four deprecated models are already gone. 7
- Settle one model-policy decision covering Haiku 5.5, Sonnet 5.5 and GPT-6.1 Sol, all three of which default model enablement has already made reachable on a managed plan. 1
- Turn on local sandboxing for one team that runs long agent sessions, require it through enterprise-managed settings, and then try to widen the policy from a developer account to see what holds. 2
- Decide the Enterprise remote-control switch for Cursor, and confirm whether the computers your developers use will stay awake and online for it. 8
- Set the enterprise Devin Review effort default rather than inheriting it, and check what the notification inbox and the new Terminal tab mean for who reviews a session. 15
- Take the Classic-to-3.0 switch on one Kiro session and read the notice's list of flags and saved settings before the deprecation closes. 13
- Update the Windsurf JetBrains plugin to 2.12.28 on any M6 Mac, where the previous version could fail to start. 16
References
- 1Claude Haiku 5.5 in GitHub Copilot
github.blog
- 2
- 3Discover local models in GitHub Copilot CLI
github.blog
- 4
- 5
- 6
- 7Selected models in GitHub Copilot deprecated
github.blog
- 8Remote control for local agents
cursor.com
- 9Claude Code changelog
code.claude.com
- 10anthropics/claude-code releases
github.com
- 11openai/codex releases
github.com
- 12Gemini CLI v0.63.0
github.com
- 13Kiro CLI 2.28.0
kiro.dev
- 14Claude Sonnet 5.5 Now Available
kiro.dev
- 15Devin changelog
devin.ai
- 16Windsurf JetBrains plugin changelog
docs.devin.ai
- 17Replit changelog
replit.com
- 18Devin Desktop changelog
docs.devin.ai
- 19aider-chat on PyPI
pypi.org
- 20Continue on Open VSX
open-vsx.org
- 21Tabnine product news
tabnine.com
- 22JetBrains Junie feed
blog.jetbrains.com
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.