Framework Watch: Claude Code 2.1.305 Adds a Sandbox Escape Hatch It Labels as One, Pydantic AI 2.58 Fixes Two Advisories, Gemini CLI 0.65 Locks Untrusted Folders, and GitHub Puts a Firewall in Front of Agents' npm Installs

Selected agent-harness releases published on October 20, 2026 that earlier Framework Watch entries did not cover.

Claude Code 2.1.305: an explicit trade-off

The release adds sandbox.allowNestedUserNamespaces, so that sandboxed commands on Linux can create user namespaces for tools like Chromium or rootless podman. The note says plainly what that costs: "this lets them get around the sandbox's file protections". A second change also changes behaviour on upgrade. allowedMcpServers stops filtering managed-mcp.json stdio servers that use ${VAR} only in env, so "one your allowlist left out now loads on upgrade; use deniedMcpServers to keep it off". Among the fixes:

• A 2.1.304 regression that made every request fail on Vertex, Bedrock and gateways that reject tool search.
• An MCP server supplied by a cloud session or by the SDK's setMcpServers being replaced mid-session by a same-named server from local settings.
• Claude naming the wrong model for a subagent's work after the subagent fell back to another model.
• Workflow resume re-running agents that had already completed.

Pydantic AI 2.58: two medium advisories

GHSA-xv4x-g8mx-ch56: provider-native MCP configuration "could expose server URLs, authorization tokens and custom header values in OpenTelemetry request traces, even with include_content=False." The project advises users to "Restrict access to historical traces and rotate exposed credentials." GHSA-5pfm-2g3g-gh85: with server-side message history and the default manage_system_prompt='server', the Vercel AI and AG-UI adapters "could execute an available tool with client-chosen arguments without a model request". Tools that require approval were not reachable this way, and v1 is unaffected. The same release lets a running delegated task be redirected with DelegationTasks.steer. Its notes open with a line saying they were "posted by codex-tui using gpt-6.1-sol on behalf of David."

Gemini CLI 0.65.0: trust boundaries in the workspace

The stable release will "enforce read-only workspace settings in untrusted folders" and aligns OAuth callback iss validation with RFC 9207, which guards against mix-up attacks between authorization servers. It also isolates a tool rejection to the active call in sequential A2A batches and adds custom OTLP headers for telemetry. A same-day commit adds opt-in private-network endpoints for MCP OAuth flows.

GitHub package firewall: public preview

GitHub's changelog says attackers increasingly harvest credentials "at package installation time ... without even running the package's code". The new firewall "sits between endpoints like Actions runners or coding agents and the upstream package repositories", checking metadata requests and downloads against a configurable cooldown, the GitHub Advisory Database and attestation-downgrade checks. It supports only npm, requires each endpoint to be pointed at it, is free during the preview for GitHub Enterprise Cloud, and will be billed by metered usage at general availability.

Analysis: Each change narrows something the agent's environment used to trust implicitly: inherited workspace settings, same-named MCP servers, telemetry that turned out to carry tokens, and packages fetched fresh from a registry. The Claude Code notes are a good model for the hard cases. When a feature weakens isolation, the release note says so, which gives security reviewers something to search for. Pydantic AI users who exported traces from MCP-enabled agents should treat the rotation advice as urgent. A cooldown period on new package versions is the cheapest supply-chain control available to any agent that runs npm install.