This edition covers agent-framework and harness changes published on October 22 and 23, 2026. Claude Code 2.1.309 and Agent Framework 1.23 were covered on October 23.
Agent Skills joins the Agentic AI Foundation
On October 22 Anthropic said it is donating Agent Skills -- the format in which a skill is a folder with a SKILL.md file plus scripts and references -- to the Agentic AI Foundation (AAIF) under the Linux Foundation, which already holds MCP. The donation covers the name, logo, GitHub organisation and agentskills.io domain. "Engineers from Anthropic, Google, OpenAI, and other companies will maintain the standard as individuals", with David Soria Parra and Mahesh Murag as lead maintainers. The adoption numbers are large: "More than 70 agent platforms, including ChatGPT, Cursor, GitHub Copilot, and VS Code" have integrated it since December 2025, and "1 million skills have been published and nearly 280 million installed." The proposed roadmap starts with "versioned releases, a formal proposal process, and security guidance for people who write and install skills." Nothing changes for current users: "You can continue to use the standard or contribute to it without joining the AAIF."
Google ADK Python 2.13.0
Released on October 23, this version has one breaking change: telemetry "Defaults to OpenTelemetry GenAI v2 (otel_semconv_1_44, removing call_llm)", so dashboards keyed on that span will go blank unless you set ADK_TELEMETRY_SCHEMA_VERSION_OPT_IN=otel_semconv_1_36. Security-relevant fixes include "add SSRF protection to RestApiTool", "sanitize GCS blob names to prevent path traversal in skill loading" and "refuse internal agents with a 403 on a non-loopback dev server". It also caps litellm below 1.106.3 and requires a newer authlib. Twelve experimental features are promoted to stable.
OpenAI Codex CLI 0.164.0
The October 23 release adds the ability to "Mask credentials during supported remote Bash commands and Zsh snapshot sessions, including credentials from custom providers", and "Hardened sandbox checks for case-variant metadata paths on macOS and replaceable symlinks used to locate executables." Enterprise MCP connections can now authenticate with Codex account grants. Many changes refine Guardian, Codex's approval reviewer, including one to "Require fresh Guardian approval for escalated tool retries" and another to "Bind plugin hook approval to plugin contents", which ties an approval to what the plugin contained when it was approved.
Claude Code 2.1.310
The October 23 release fixes a Windows bug in which PreToolUse and PermissionRequest hooks let "a tool call through when Git Bash is missing and the hook's command is only quoted strings". File read prompts now show where a symbolic link leads, and enterprise custom roles can control access to cloud sessions and Remote Control.
ADK Java: a restriction rolled back
On October 23 ADK Java reverted two commits that restricted transfer_to_agent to declared targets, with the note "Rolled back due to a breakage." After the revert, a non-resumable flow again resolves the target by searching the whole agent tree, and only resumable flows reject undeclared targets. Because the target name is model output, a model can again hand control to any named agent in the tree in the default flow.
What remains uncertain. AAIF has not yet published a governance charter for Skills, and neither Google nor OpenAI attaches advisories or CVEs to the fixes above, so their severity is not stated.
Analysis: A million published skills is a supply chain, and the security guidance on the roadmap is overdue. Until it exists, treat installed skills like dependencies: pin them, review scripts, and do not let agents fetch skills at runtime. The ADK Java revert is the week's useful cautionary tale. Restricting which agent a model may delegate to is the right default, but it broke existing callers, so it now applies only to resumable flows. If you run multi-agent ADK Java systems, enforce your own allowlist in a callback rather than relying on the tree layout.
Sources and evidence
October 22-23: Anthropic donated the Agent Skills standard (70+ platforms, 1 million skills published, about 280 million installs) to the Linux Foundation's Agentic AI Foundation with a roadmap that includes security guidance; ADK Python 2.13 adds SSRF and path-traversal fixes and switches telemetry to OTel GenAI v2, removing the call_llm span; Codex CLI 0.164 masks credentials and hardens sandbox lookups; ADK Java reverted a restriction of transfer_to_agent to declared targets except in resumable flows.