Framework Watch: Claude Code 2.1.309 Closes a Batch of Sandbox and Permission Gaps, Agent Framework 1.23 Makes AG-UI Authorization Explicit, and LangChain Core 1.7 Changes How Tool Arguments Stream

This edition covers framework and harness releases published on October 22 and 23, 2026. Most of the changes share a theme: they move safety-relevant decisions from implicit defaults to explicit settings.

Claude Code 2.1.309

Version 2.1.308 says only "Bug fixes and reliability improvements". Version 2.1.309, released later the same day, is a long list of fixes, and the sandbox and permission items stand out:

• "Fixed sandboxed Bash commands on macOS and Linux running the shell's startup files outside the sandbox before each command".
• Sandboxed commands and auto-accepted edits could modify the MCP config file passed with --mcp-config, and a disabled MCP server could be reconnected by a later permission prompt in print and SDK sessions.
• "Fixed the Bash permission check trusting a variable set by a command whose redirect can fail to open", and an Edit(path) deny rule not blocking a Bash redirect to that path in some commands that also held a subshell.
• Worktree-isolated sessions accepted some locale-prefixed commands and, on zsh, some arithmetic commands that the isolation guard should refuse. macOS denyWrite globs also failed when a folder was reached through a symlink.
• Split-pane agent teammates did not inherit the tool deny and --tools rules from the leader's command line.

The startup-file fix matters most for anyone who relies on the sandbox, because shell profiles run on every command.

Microsoft Agent Framework (Python) 1.23.0

The October 22 release has three breaking changes. It adds "the MCP 2.x compatibility foundation" and migrates MCP transports, errors, schemas and lifecycle handling. It now requires "an explicit AG-UI authorization scope or single-user declaration for endpoint registration", so an AG-UI endpoint can no longer be exposed without stating who may call it. It also renames the Docker shell's extra_run_args to unsafe_extra_run_args and makes "its trust requirements explicit". Separately, the A2A package adds allowlisted forwarding of function-invocation and client arguments from request metadata.

langchain-core 1.7.0

Streamed tool-call arguments now arrive as tool-call-delta slices instead of block-delta snapshots of the arguments so far. The release notes say: "If you read raw stream events and their block-delta args mid-stream, read tool-call-delta instead." .tool_calls.get() and .output are unchanged, and pinning langchain-core<1.7 keeps the old behaviour. UIs that render partial arguments are the code most likely to break.

Pydantic AI 2.60.0

Two changes concern trust boundaries. The release will "Strip request-level instructions from untrusted history in sanitize_messages and server-managed UI adapters", so a restored conversation cannot carry its own system-level instructions. It also summarizes harness-added user-channel content as <harness_data> during compaction rather than as user messages. In addition, the MCP capability now derives its default id from the server's hostname and rejects two servers on one host without explicit ids. RetryPromptPart is deprecated.

NVIDIA Dynamo 1.6.0

NVIDIA's distributed inference platform describes 1.6.0 as spanning "654 merged PRs from 148 contributors". The router gains plugin hooks that can defer, reorder or steer requests. Every request now flows through a policy queue ordered by deadline, and an opt-in session prefix index tracks session-to-block lineage "for agentic workloads". The frontend adds a /v1/rerank endpoint, a thinking_token_budget field and mutual TLS.

What remains uncertain. The Claude Code release notes mention no advisory or known exploitation, and Microsoft's notes do not say how existing AG-UI deployments are migrated.

Analysis: Read together, these releases treat the agent's own context and configuration as attack surface: shell profiles, MCP config files, restored message history, request metadata. If you wrap any of these frameworks, review where your code hands them untrusted state. Upgrade Claude Code if you rely on its sandbox, and add an explicit authorization scope before moving to Agent Framework 1.23.