Framework Watch: LangGraph 1.2.16 Hardens Resume, Claude Code 2.1.302, GitHub Ships AI Scan GA -- and a Critical Unauthenticated RCE Hits the Archon Coding Agent

A week of agent-tooling releases, with the recurring theme that the plumbing around agents -- resumption, security scanning, authentication -- is where the work now is.

• LangGraph 1.2.16 (October 16) is almost entirely resume-correctness fixes: it will "stop a subgraph from rerunning its finished tasks on resume," "apply a resumed Command's update once," "save a resumed exit run's pending writes once," and "let other tasks finish when a resume value is invalid." The paired checkpoint-postgres 3.2.0 adds a prune method to the Postgres savers. The SDK 0.4.8 now surfaces thread stream errors and stops "retrying a rejected stream."
• Claude Code 2.1.302 (October 16) is a large fix release. Notable items: the Read tool now refuses image sources over 128 MB instead of loading any size into memory; fork subagents default on in claude -p, the Agent SDK and the desktop app; prompt-and-agent hooks now cap at 12 of one event running at once; and a prompt-cache miss was fixed when a tool added mid-session is reloaded through ToolSearch or after compaction. Several fixes harden Windows and cloud-session behaviour.
• GitHub AI Scan for pull requests went generally available (October 15). It complements CodeQL "for languages and frameworks that CodeQL does not currently cover, including PHP, Shell/Bash, Terraform configuration (HCL), Dockerfiles, JSP for Java, Blazor for C#." Crucially, the findings "are advisory. They do not fail the code scanning check and cannot block pull request merges," and it does not run on fork or Dependabot PRs. It needs no Copilot license but consumes Code Security AI Credits.
• GitHub Copilot model deprecations. On November 16, GitHub will remove Claude Opus 4.8, Claude Opus 5 and GPT-5.6 Terra across all Copilot experiences, with Opus 4.8 kept only for individual annual subscribers. Suggested replacements auto-enable for Enterprise and Business unless an admin opted out.

The cautionary tale: CVE-2026-111322 in Archon

VulnCheck disclosed a missing-authentication flaw in Archon, the open-source "harness builder for AI coding" (about 23,700 GitHub stars). Per NVD, "Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default." Because the agent runs with bypassPermissions, a network-reachable attacker can drive it to run commands on the host as the Archon user. VulnCheck scored it 9.8 on CVSS 3.1 and 9.3 on CVSS 4.0. The advised mitigations are to firewall the endpoint or rebind it to 127.0.0.1; at the time of the advisory no vendor patch was listed.

What remains uncertain. No standalone public exploit had been published when the advisory went out, and the Archon repository was still actively committing without a clearly labelled authentication fix. Whether a patched release lands, and how many deployments expose the API beyond localhost, is unknown.

Analysis: The releases and the CVE tell one story. LangGraph's resume fixes and Claude Code's hook caps are about agents that run long enough to be interrupted; GitHub's advisory-only AI Scan is a bet that machine-found security findings belong next to human review, not blocking it. Archon is the counter-lesson: a coding agent with bypassPermissions and a control API on 0.0.0.0 is a remote shell with extra steps. The safe default for any local agent harness is to bind to localhost and assume the control plane is as sensitive as the shell it drives.