Framework Watch: Claude Code 2.1.293 Fixes Post-Compaction Redo and Ships Haiku 5.5; Codex 0.161 Lets Admins Switch Off the MXC Sandbox

Anthropic released Claude Code 2.1.293 on October 7, 2026, the same day OpenAI tagged Codex CLI 0.161.0 (15:58 UTC) and Microsoft made its MXC agent containers generally available.

Claude Code 2.1.293: what operators should act on

• Haiku 5.5 is the default Haiku on the Anthropic API: 1M context, $0.10/$0.50 per million tokens, $0.50/$2.50 over 100K. Teams that pin a Haiku model for subagents should check which one they now get.
• Compaction correctness. Fixed Claude "treating its own last actions before a context compaction as done after it, and retracting or redoing finished work" -- a bug that shows up in long sessions as duplicated or reverted edits.
• Permission and consent edges. claude agents no longer offers bypass permissions that background sessions then ignored when consent was saved only in .claude/settings.local.json or a --settings file; it now asks first. Esc on a permission prompt now stops the turn even right after moving the session to the background. On Windows, stopping a hook or shell command no longer risks killing an unrelated process that reused the same process ID.
• Rules loading. Path-scoped rules and nested CLAUDE.md files now load when Claude reads a file with cat, head, tail, sed -n or grep in Bash, not only through the Read tool.
• Reliability. An HTTP MCP connection no longer keeps every request it sent in memory; claude purge now exits 1 and lists what it could not delete instead of stopping silently. Two earlier changes were reverted, including the 2.1.281 wording that told Claude an auto-mode denial covers the outcome, not only the exact command.

Codex 0.161.0: permissions and sandboxing

• "Approved filesystem escalation can now grant broader write access while preserving denied reads and network restrictions," and background tasks keep the permissions of the turn that started them.
• Managed requirements can now disable the Windows MXC sandbox, and MCP sandbox metadata reports which MXC backend is in use. Enterprise MCP auth is restricted and config refresh fails closed.
• Cyber access can be chosen per run with codex exec --cyber-access-program; the Daybreak cyber routing is opt-in only. GPT-6.1 Sol becomes the default model in the bundled and Amazon Bedrock catalogs.

Analysis: the MXC switch is the one to notice. Codex is already integrated with Microsoft's containers, and admins can now turn that containment off by policy -- useful when it breaks a toolchain, but a setting worth auditing in managed fleets. Claude Code's compaction fix matters for anyone running long autonomous sessions: redone or retracted work after compaction is exactly the kind of error a reviewer misses.