Free reference
Claude Code and Codex: the changes that touch your controls.
Both agents ship several releases a week, and most release notes are about the interface. This page keeps only the lines that matter if you own the policy: managed settings, permissions, sandboxing, network rules, MCP, hooks, telemetry, auth and security fixes. Each row links the release note it came from.
Last checked .
How to read it
- Each row is a one-sentence summary of one release-note line. Follow the version link and read the vendor's wording before you change a policy.
- The selection is a judgment call and it is not complete. The release notes were filtered by keyword, so a relevant change with unusual wording can be missing.
- Claude Code's changelog carries no dates. The dates shown for it are the npm publish dates of each version. Codex dates are the GitHub release dates.
- Only stable Codex releases are covered. Nothing here was tested on a machine; it reports what the release notes say.
- I sell The Coding Agent SOC 2 Kit, which builds managed policy files for both agents. This page is free and does not need it.
Claude Code
54 changes, read through version 2.1.322.
| Version | What changed | Area | Date |
|---|---|---|---|
| 2.1.321 | Fixed a case where a read-only Bash command ran outside the sandbox without a permission prompt. | Security fix | |
| 2.1.321 | Deny rules and protected-file prompts now apply to the file written by a cp or mv into a directory. | Security fix | |
| 2.1.319 | Fixed a Bash permission bypass where a crafted environment prefix hid part of a command from permission checks. | Security fix | |
| 2.1.319 | Fixed a sandbox escape that occurred when creating a worktree. | Security fix | |
| 2.1.319 | Fixed a case where a sed command could skip the permission check in accept-edits and auto modes. | Security fix | |
| 2.1.318 | deniedMcpServers URL entries now also block matching Anthropic-provided servers and cloud or self-hosted-runner connectors. | MCP | |
| 2.1.316 | Server-managed settings for Team and Enterprise logins apply without an approval prompt, and a stored copy that fails verification is refused. | Managed settings | |
| 2.1.314 | Fixed forceRemoteSettingsRefresh set only in remote managed settings, which let sessions start without policy after the stored copy expired. | Managed settings | |
| 2.1.314 | Fixed sandbox protections not applying to a worktree entered through claude -p with --resume or --continue. | Sandbox | |
| 2.1.312 | Claude Code stopped sending the claude_code.safety_event OpenTelemetry event. | Telemetry | |
| 2.1.309 | Fixed sandboxed Bash commands running the shell startup files outside the sandbox before each command. | Sandbox | |
| 2.1.309 | Fixed sandboxed commands and auto-accepted edits being able to modify the MCP config file passed with --mcp-config. | Sandbox | |
| 2.1.307 | Added the claude_code.safety_event OpenTelemetry event for tool calls stopped, prompted or sent back by rules, auto mode, hooks or the sandbox. | Telemetry | |
| 2.1.305 | Added sandbox.allowNestedUserNamespaces, which lets sandboxed Linux commands create user namespaces and thereby get around the sandbox's file protections. | Sandbox | |
| 2.1.305 | allowedMcpServers no longer filters managed-mcp.json stdio servers that use variables only in env, so servers the allowlist omitted now load; deniedMcpServers keeps them off. | MCP | |
| 2.1.299 | Improved enforcement of managed permission rules, managed hooks and organization MCP tool names against user-installed mods. | Hooks | |
| 2.1.299 | MCP allow rules now apply only to the server they name, so mcp__a no longer allows servers named a__b or a_. | MCP | |
| 2.1.299 | Fixed a sandboxed shell command being able to write into a --plugin-dir folder whose code runs outside the sandbox. | Sandbox | |
| 2.1.296 | Fixed handling of managed PreToolUse hooks that deny with continue false and managed prompt hooks that block a tool call. | Hooks | |
| 2.1.292 | Security fix: PreToolUse hook approvals and auto mode no longer bypass the permission prompt for file reads from network (UNC) paths. | Security fix | |
| 2.1.292 | Fixed a tampered on-disk cache of server-managed settings being able to switch off the built-in policy plugin while the settings fetch failed. | Managed settings | |
| 2.1.290 | Added a warning when a managed settings file is a link to a file outside the managed settings folder. | Managed settings | |
| 2.1.288 | Fixed a dangerous rm inside a bash -c or sh -c script running without a prompt in bypassPermissions mode or under a shell allow rule. | Permissions | |
| 2.1.285 | Project settings can no longer widen or turn off an admin-required sandbox, replace a managed proxy, extend a strict allowlist, or reopen managed read-denies. | Sandbox | |
| 2.1.285 | Claude Code now warns and starts without policies when the OS denies reading the managed settings file; other read errors and unparseable files stop every session. | Managed settings | |
| 2.1.284 | Fixed marketplace, claude.ai and npm plugins pre-approving their own tools under managed allowManagedPermissionRulesOnly. | Permissions | |
| 2.1.283 | Managed sandbox settings with one invalid nested value now fail closed, and the rest of the sandbox block still applies. | Sandbox | |
| 2.1.282 | sandbox.excludedCommands entries from project and local settings are ignored when managed settings forbid unsandboxed commands or restrict managed domains. | Sandbox | |
| 2.1.282 | Project and local settings now ignore OpenTelemetry variables that turn on export, set the endpoint or capture content. | Telemetry | |
| 2.1.282 | On Windows and WSL, an invalid or unreadable admin policy now keeps user-writable HKCU and WSL settings from applying. | Managed settings | |
| 2.1.282 | Added the allowClaudeInChromeWithManagedMcp managed setting so claude --chrome can run alongside an exclusive managed-mcp.json. | MCP | |
| 2.1.277 | Fixed a sandbox.excludedCommands glob exempting a whole compound Bash command from the sandbox when only one part matched. | Sandbox | |
| 2.1.274 | Added the claude_code.managed_settings_resolved OTel event listing managed-settings sources and policy helper state, with redacted settings and digests optional. | Telemetry | |
| 2.1.273 | Fixed allowManagedMcpServersOnly, deniedMcpServers and disableClaudeAiConnectors from MDM or managed-settings.json being ignored when server-managed settings were also present. | MCP | |
| 2.1.271 | An unreadable or unparseable enterprise managed-mcp.json now keeps exclusive MCP control and warns at startup instead of being ignored. | MCP | |
| 2.1.267 | Managed allowedHttpHookUrls, httpHookAllowedEnvVars and allowedChannelPlugins now admit nothing, rather than everything, when unreadable. | Hooks | |
| 2.1.259 | Claude Code now refuses to start and names the source when managed settings from a file, drop-in, MDM plist or HKLM value cannot be parsed. | Managed settings | |
| 2.1.257 | defaultMode bypassPermissions in project settings files is now ignored; it must be set in user or managed settings or on the command line. | Permissions | |
| 2.1.257 | Added a Containment Escape rule to auto mode so cloud metadata-credential fetches, egress evasion and cross-tenant reach are no longer auto-approved by default. | Permissions | |
| 2.1.251 | Fixed project settings enabling detailed beta tracing or raw API body logging, and lower-scope tracing endpoints bypassing a managed OTLP collector. | Telemetry | |
| 2.1.251 | Server-managed settings that terminate sandbox TLS, route sandbox traffic through a proxy, inject credentials or weaken isolation now require approval. | Managed settings | |
| 2.1.248 | Added --restricted, which removes command-running tools and WebFetch, confines file tools to the working directory, and refuses bypassPermissions. | Permissions | |
| 2.1.232 | Hardened the Linux filesystem sandbox against a protected-path bypass. | Security fix | |
| 2.1.232 | Fixed a PowerShell permission bypass where variable-writing parameters could overwrite $PSDefaultParameterValues and redirect file access. | Security fix | |
| 2.1.223 | Fixed an agent definition's bypassPermissions mode ignoring the organization policy that disables bypass-permissions. | Permissions | |
| 2.1.221 | Fixed a Bash permission-check bypass where zsh regex conditionals could run hidden commands; affected commands now prompt. | Security fix | |
| 2.1.219 | Added sandbox.network.strictAllowlist to deny non-allowlisted hosts for sandboxed commands without prompting. | Network | |
| 2.1.212 | Enterprise forceLoginMethod is now enforced for VS Code extension, SDK, setup-token and install-github-app logins, not only the terminal. | Auth | |
| 2.1.193 | Added the claude_code.assistant_response OpenTelemetry event with model response text, redacted unless OTEL_LOG_ASSISTANT_RESPONSES=1. | Telemetry | |
| 2.1.187 | Added the sandbox.credentials setting to block sandboxed commands from reading credential files and secret environment variables. | Sandbox | |
| 2.1.175 | Added the enforceAvailableModels managed setting so the availableModels allowlist also constrains the default model and cannot be widened by user or project settings. | Managed settings | |
| 2.1.169 | Fixed enterprise managed MCP policies not being enforced on reconnect, IDE-typed configs, --mcp-config servers, or before remote settings loaded. | MCP | |
| 2.1.163 | Added requiredMinimumVersion and requiredMaximumVersion managed settings; Claude Code refuses to start outside the allowed version range. | Managed settings | |
| 2.1.149 | Added the allowAllClaudeAiMcps managed setting to load claude.ai cloud MCP connectors alongside managed-mcp.json. | MCP |
Codex
54 changes, read through version 0.167.0.
| Version | What changed | Area | Date |
|---|---|---|---|
| 0.167.0 | The app-server README documents managed network constraints under permissions.network and prompt-user command rules that require fresh human approval. | Network | |
| 0.166.0 | Managed requirements can now carry OpenTelemetry configuration. | Telemetry | |
| 0.166.0 | Managed requirements gained support for a network_proxy table. | Network | |
| 0.166.0 | OTEL exporter headers are redacted in app-server config responses. | Telemetry | |
| 0.165.0 | Added managed configuration loaders for custom config servers. | Managed settings | |
| 0.165.0 | Added support for managed hooks scoped to an environment. | Hooks | |
| 0.165.0 | Added managed network review domains that are evaluated before allow rules. | Network | |
| 0.164.0 | Windows registry overrides are now supported for requirements.toml. | Managed settings | |
| 0.164.0 | Managed configuration is now required from the configured server. | Managed settings | |
| 0.164.0 | Enterprise MCP connections authenticate through eligible Codex account grants or a dedicated sign-in, including OAuth clients that require secrets. | MCP | |
| 0.164.0 | Credentials are masked during supported remote Bash commands and Zsh snapshot sessions, including credentials from custom providers. | Auth | |
| 0.164.0 | Hardened sandbox checks for case-variant metadata paths on macOS and for replaceable symlinks used to locate executables. | Security fix | |
| 0.163.0 | The network proxy checks permission before DNS lookups, rejects duplicate Host headers, and stops credential aliases from bypassing inspection hooks. | Network | |
| 0.163.0 | Resuming a saved thread restores its permissions and network approvals while respecting explicit overrides and current managed policy. | Permissions | |
| 0.162.0 | Fixed Linux sandbox startup with multiple denied files, rejected writable sandbox-construction executables, and stopped ripgrep configuration from weakening deny-glob masks. | Sandbox | |
| 0.161.0 | Approved filesystem escalation can grant broader write access while keeping denied reads and network restrictions, and background tasks keep their originating turn's permissions. | Permissions | |
| 0.161.0 | Managed requirements can now disable the Windows MXC sandbox. | Sandbox | |
| 0.161.0 | Authentication guidance now covers keyring storage instead of implying credentials always reside in auth.json. | Auth | |
| 0.158.0 | Terminal input approval is on by default for commands running with elevated permissions. | Permissions | |
| 0.158.0 | Direct exec-server WebSocket connections can be secured with bearer tokens, including those configured through app-server. | Auth | |
| 0.157.0 | Network restrictions are enforced across redirects and ongoing HTTP and WebSocket traffic, including cancellation when policy changes revoke access. | Network | |
| 0.156.0 | Closed sandbox isolation gaps involving inbound Windows connections, privileged Linux and macOS sockets, and writes through read-only macOS file handles. | Security fix | |
| 0.156.0 | Managed configuration now requires forced macOS preferences. | Managed settings | |
| 0.155.0 | Blocked Windows-process escapes from restricted WSL sandboxes and hardened brokered shell snapshots against credential exposure. | Security fix | |
| 0.154.0 | Startup no longer runs workspace-controlled helpers before trust is established, and the macOS sandbox blocks terminal input injection. | Security fix | |
| 0.152.0 | Cloud task requests reject untrusted backend URLs and disable redirects to protect saved credentials. | Security fix | |
| 0.150.0 | Untrusted projects no longer supply project-level AGENTS.md instructions, and managed deny-read rules stay enforced after permission changes. | Permissions | |
| 0.150.0 | Managed requirements can now include developer instructions. | Managed settings | |
| 0.149.0 | Documented DNS exfiltration risks and trust limitations for secure devcontainers. | Network | |
| 0.148.0 | Sandbox restrictions now fail closed for denied or unreadable paths on Linux and Windows. | Sandbox | |
| 0.148.0 | Sessions are rejected when required managed hooks cannot be loaded. | Hooks | |
| 0.147.0 | Unfamiliar local projects require explicit trust, and managed authentication restrictions are enforced before credentials are used. | Auth | |
| 0.147.0 | Plugin isolation was hardened and network access is denied when policy updates fail. | Network | |
| 0.147.0 | Secrets and complete bearer tokens are redacted from displayed commands and replayed conversation history. | Auth | |
| 0.147.0 | Added the --approve-for-me CLI flag to enable automatically reviewed approvals. | Permissions | |
| 0.147.0 | Removed the deprecated codex exec --full-auto flag; --sandbox workspace-write replaces it. | Permissions | |
| 0.146.0 | Exact values from managed config requirements are now enforced. | Managed settings | |
| 0.146.0 | Managed MCP requirements now refresh for active threads. | MCP | |
| 0.146.0 | Added a managed policy that controls in-app updates. | Managed settings | |
| 0.145.0 | Strengthened safety and approval handling with better forced-rm detection, consistent full-access confirmation, and preserved rejection reasons across tools. | Permissions | |
| 0.143.0 | Plugin marketplace source admission requirements are now enforced. | Managed settings | |
| 0.143.0 | Updated OpenSSL, Hono, fast-uri, quick-xml and crossbeam-epoch to address security advisories. | Security fix | |
| 0.142.2 | PowerShell commands with executable AST regions the safety classifier cannot inspect now require approval. | Security fix | |
| 0.141.0 | Remote executors use authenticated, end-to-end encrypted Noise relay channels. | Auth | |
| 0.141.0 | Hook trust bypass now persists through codex exec thread start and resume, and blocking PostToolUse hooks reject code-mode tool calls. | Hooks | |
| 0.140.0 | Added managed Amazon Bedrock API-key authentication and encrypted local storage for CLI and MCP OAuth credentials. | Auth | |
| 0.139.0 | Thread resets no longer drop cloud-managed requirements or feature flags during TUI config reloads. | Managed settings | |
| 0.138.0 | Managed permission profile allowlists are now enforced. | Permissions | |
| 0.137.0 | Enterprise and admin flows show monthly credit limits and can apply cloud-managed config bundles, including for EDU workspaces. | Managed settings | |
| 0.136.0 | Command-safety hardening stops /diff from running repository-provided Git helpers or hooks and rejects browser-origin exec-server websocket handshakes. | Security fix | |
| 0.136.0 | Windows admins get an alpha elevated sandbox setup command, plus requirements support for allowed Windows sandbox implementations. | Sandbox | |
| 0.136.0 | Deny read rules stay enforced for safe-command and approval-bypass paths. | Permissions | |
| 0.133.0 | Managed permission profiles are now supported in requirements.toml. | Managed settings | |
| 0.131.0 | Managed read restrictions are preserved during permission escalation. | Permissions |