Microsoft Agent Framework Python 1.22.0
Released on October 15, 2026, this one carries two breaking security changes in the AG-UI adapter. It will "Enforce fail-closed request trust boundaries and bind workflow continuations and interrupts to the resolved thread ID". It will also "Prevent client Shared State and stored Thread Snapshots from replacing tool-approval state". In plain terms, a front end could previously send state that overwrote whether a tool call had been approved. The declarative package now bounds HTTP response bodies and decompression stages, and a core fix stops the framework putting tool arguments into metrics.
Read the rollout warning before upgrading. Pre-1.22 runtimes cannot read new persisted records containing hosted or merge_mode: "Do not run old and new workers against the same affected store during a rolling deployment". Python 3.15 support is added with per-package limitations.
Pydantic AI 2.57.0
Published on October 16 for the October 15 release, it adds a Harness ApprovalReviewer "to let a model approve low-risk tool calls before a person sees them". It also adds a MetaProvider for Meta Muse models, released the same day as Muse Spark Open's weights. Other fixes are worth checking: "Fix token-based compaction retaining too little recent history", and "Charge the partial response of an interrupted stream in SpendLimits", which closes a way to under-count spend. Skills now honour disable-model-invocation and user-invocable.
OpenAI Codex CLI 0.163.0
Released October 15. "The network proxy now checks permission before a DNS lookup, rejects duplicate Host headers, and prevents credential aliases from bypassing inspection hooks." Checking before resolving matters because a DNS lookup can itself leak data to an attacker-controlled domain. Resuming a saved thread now "restores its permissions and network approvals, while respecting explicit overrides and current managed policy." Codex can also run independent read-only tools in parallel.
Claude Code 2.1.301
Released October 15, it adds classifier_verdict and permission_mode to OpenTelemetry tool_decision events "so auto mode classifier decisions can be told apart from permission rules". One fix is worth noting for anyone running multi-step agent workflows: "Fixed workflow agents sometimes skipping their step, and the run still reporting success". Another stops quitting from removing a hook-created worktree "when it may hold unpushed commits".
What remains uncertain. Agent Framework does not say whether the approval-state issue was exploitable in deployed AG-UI apps, and Pydantic AI does not publish guidance on which calls count as low risk.
Analysis: The approval step is becoming a layered system: a model reviewer first, then a classifier, then a person, and each layer needs its own audit trail. That is what these releases are building, with telemetry that records who decided and state that clients cannot overwrite. The Agent Framework fix also shows the weak point. Approval state that lives where the client can write to it is not approval. Teams should check where their own framework stores it, and make sure a model reviewer's approvals are logged separately from human ones.
Microsoft Agent Framework 1.22 stops AG-UI clients overwriting tool-approval state and fails closed on trust boundaries, Pydantic AI 2.57 adds a model ApprovalReviewer for low-risk tool calls, Codex 0.163 checks proxy permission before DNS lookups, and Claude Code 2.1.301 logs classifier verdicts separately from permission rules.