If you run a small business or work on your own, there's a good chance an AI assistant already helps with some of your admin: drafting emails, sorting documents, tidying spreadsheets. What nobody mentions is that these tools change every week, and the changes that matter are buried in release notes written for developers.
So I read them for you. I went through four releases published between 15 and 22 October by two open projects on GitHub, Claude Code from Anthropic and Codex CLI from OpenAI, and picked out what a non-developer can actually use. Everything below comes from the official release pages, and I'll keep saying 'its release notes say' because I'm reporting what the projects claim, not grading them.
A quick word on numbers. The release pages don't show star counts, so I took them from each repository's front page on 27 October 2026. Claude Code shows 153.6k stars and 26.1k forks. Codex CLI shows 131.3k stars and 20.7k forks. That's a lot of people watching, which is a fair reason to spend ten minutes here.
First, a definition, because it's the word that matters most in these releases. A sandbox is a fenced-off area where an assistant can run commands, with limits on what it can access outside its workspace. If you ever leave an assistant working while you get on with something else, that fence is what you're relying on.
Claude Code v2.1.309 is dated 22 October, and its release notes say it fixed several gaps in that fence. Sandboxed commands on macOS and Linux had been running the shell's startup files outside the sandbox before each command. Sandboxed commands and auto-accepted edits could modify the MCP config file passed with --mcp-config. And a disabled MCP server could be reconnected by a later permission prompt in print and SDK sessions.
MCP, in plain words, is the connector that lets an assistant reach other apps and tools. So that last fix, and pay attention here, it's the one I'd read twice, is about a switched-off connection not staying switched off.
The same release also changed what happens in bypass permissions mode in the Desktop app and VS Code. Its release notes say a dangerous rm or rmdir command is now denied at once with a hint on how to rewrite it, so unattended sessions keep going instead of stopping to wait for an answer.
My take: boring security fixes are the best kind of news. Nobody gets excited about a fence that now closes properly, but it's the thing you'll care about on the day you need it.
Claude Code v2.1.304 is dated 19 October. Its release notes say it added /auto-mode-setup, a guided setup that reads your project and recent sessions to teach auto mode about your environment. Auto mode is the setting where the assistant approves routine actions itself, so teaching it what's normal in your setup is a sensible first step.
Two other lines caught my eye. The release notes say rm -r on a mounted drive, or on a folder at its top level, now gets the same safety prompt as rm -rf /Applications. And they say claude --worktree no longer removes the worktree and its branch without asking at exit when HEAD was detached or on another branch, which could lose commits. In plain terms, two ways of deleting something by accident got a confirmation step.
There's also a practical warning for Pro and Max plans. When resuming an inactive conversation would use a noticeable share of your 5-hour usage limit, you now get a heads-up and can start a new conversation instead. If you've ever watched your allowance vanish on one very long chat, you'll appreciate that.
Claude Code v2.1.307 is dated 21 October. Its release notes say it added a claude_code.safety_event OpenTelemetry event for each tool call that a permission rule, auto mode, a safety check, a hook or the sandbox stopped, prompted or sent back.
OpenTelemetry is a standard way of recording what software did. So the idea is a log of every time the assistant was stopped, asked about something or sent back to try again. For a solo professional that sounds like overkill. For a business with several people and client files in the mix, a record of tool calls that were stopped, prompted or sent back is the kind of thing you'll be glad exists.
Another line in the same release is worth a mention. Its release notes say HTTP MCP tool calls were being sent twice when the connection closed mid-call, and now only read-only or idempotent tools are retried. Idempotent just means doing it twice gives the same result as doing it once. Imagine an assistant that sends an invoice twice because the wifi blinked. That's the kind of problem a rule like this is for.
The fourth release comes from the other project. Codex CLI 0.163.0 shows 15 October on its release page. Its release notes list a searchable /config panel, mid-response steering (you can redirect the assistant while it's still answering), a configurable leader key in /keymap, restarting background servers from /daemon, and parallel execution of read-only tools.
The last one is the one I'd watch. Read-only tools only look at things and don't change them, so running several at once can make a task quicker without changing what ends up on your disk. Whether that shows up on your own tasks is something only you can find out.
The release notes also mention clearer notes on how the Linux sandbox uses bubblewrap and seccomp. Those are two Linux features that restrict what a program may do. You don't need to know how they work. It's reassuring that the sandbox gets documented in plain sight, though, because it means anyone can check.
Three things stand out.
First, most of these releases are about safety and reliability, not new tricks. Fences, confirmations, logs, retries. That's what maturing software looks like, and it's the right priority for anything you let work on its own.
Second, version numbers don't tell you much. v2.1.309 sounds like a tiny step after v2.1.304, but the sandbox fixes in it are the ones I'd read twice. Read the notes, not the number.
Third, release notes are the project's own account of itself. Treat them as a good starting point and a reason to ask questions, then check what applies to your own setup, or ask whoever looks after your tools to do it.
A fenced-off area where an assistant can run commands, with limits on what it can access outside its workspace. The fixes above are about making that fence close properly.
A way of connecting an assistant to other apps and tools, so it can read from them or act in them.
These are tools you install and run on your own computer, mostly used by developers, so a browser chat isn't affected by these specific release notes. If someone set up a tool like these for you, it's worth asking them whether it's up to date.
We selected these four releases from the official release pages. Three are from Claude Code, so this round leans one way. That's the data, not a preference.
If you're weighing up the two tools, I wrote about how I use Claude Code and Codex together. And if you'd rather see a single tool tested in detail, read my Agent Reach review.
Want help working out which of these updates matter for your setup? Write to us on WhatsApp or see how our Your AI Assistant service works.
Prefer Spanish? Read this guide in Spanish: Claude Code y Codex: cuatro versiones de GitHub que merece la pena leer.
Sources (checked 27 and 28 October 2026): the official GitHub release pages for Claude Code v2.1.304, v2.1.307 and v2.1.309, and for Codex CLI 0.163.0; star and fork counts from each repository page.
