This week in Claude Code, Codex and Gemini CLI (week of September 13, 2026)

Originally published at https://aicoding-guide.com.

This week was light on features and heavy on closing permission and security gaps across all three tools. The most consequential release is Claude Code 2.1.268, which fixes two separate cases where deny rules silently failed to apply. If you rely on deny rules to protect parts of your codebase, update first and read the rest later.

The releases covered here are Claude Code 2.1.268 and 2.1.269, Codex CLI 0.154.0, and Gemini CLI 0.59.0.

Key point
What you will learn

• The two cases where Claude Code's deny rules were being bypassed, and the fixes
• The breaking change in Codex CLI 0.154.0 (codex mcp-server removed) and what was added
• The MCP security fixes in Gemini CLI 0.59.0

Claude Code

2.1.269

Mostly additions.

• claude plugin eval: run a plugin's eval suite against Claude Code and get scored, reproducible results as a JSON and HTML report. Run claude plugin eval --help for usage
• /output-style [name]: list and switch output styles, including over Remote Control and in cloud and other headless sessions
• Bash edit diffs: when the Bash tool handles file edits, the tool result now includes a diff of the files the command changed. The setting is bashEditDiffEnabled
• CLAUDE_CODE_WORKFLOW_MAX_CONCURRENT_AGENTS: raise the Workflow tool's per-run concurrent agent limit, in the range 1 to 256

One permission fix landed here too. A deny or ask rule starting with ! was applying beyond the settings source that wrote it. It now applies only within its own source, and a bare ! negation is ignored.

Setting CLAUDE_CODE_BG_TASKS_REPORT_RUNNING=0 restores the old behavior where remote and headless sessions reported "waiting for your input" while background agents were still running.

2.1.268

This is the release that matters. Two cases where deny rules were bypassed were fixed.

1. Paths that go through a symlink: deny and ask rules on symlinked directories (/etc, /tmp, /var on macOS; /bin on Linux) did not apply when the path was given by its real location. Separately, Bash commands ignored deny rules written against a symlinked path spelling
2. Lines containing env -C or eval: a Read or Edit deny rule could fail to apply when a command the permission checker cannot analyze appeared on the same line

Both are the same class of problem: a prohibition you wrote was not actually in force. If your setup depends on deny rules to keep .env files or credentials out of reach, update so that the design in Claude Code permissions in settings.json behaves the way you expect.

Two secret-disclosure bugs were closed as well.

• /mcp and /plugin server details, claude mcp list and get, and MCP login errors were printing secrets resolved from ${VAR} placeholders in MCP configs
• Plugin and marketplace errors were showing a token or password contained in a git source URL

If you pass credentials to MCP servers through environment variables, see Adding MCP servers to Claude Code for the configuration this affects.

Other fixes worth knowing about:

Codex

CLI 0.154.0

Breaking change: codex mcp-server removed
The deprecated codex mcp-server entry point is no longer available. If a script, service definition, or editor integration invokes it, that call needs replacing before you upgrade.

New in this release:

• GPT-6-Astra is available in the model picker and in Amazon Bedrock catalogs
• Experimental worktree support: create isolated checkouts for new or forked sessions with --worktree or /worktree, then browse and resume them
• Inline answers while work continues: answer questions with suggested choices or custom text without losing your main draft
• Shared background server on Windows: Windows sessions can share a background Codex server, with daemon lifecycle commands and managed updates

Trust handling was tightened too. Startup now avoids running workspace-controlled helpers before trust is established, and the macOS sandbox blocks terminal input injection. For how approval and sandbox settings interact, see Codex CLI approval modes versus sandbox modes.

On the Python SDK side (openai-codex==0.154.0), max and ultra reasoning-effort values were added. When migrating, note that HookMetadata now wraps its handler in .root: replace accesses such as hook.command with hook.root.command, and check hook.root.handler_type before reading handler-specific fields.

Gemini CLI

0.59.0

The release notes list two substantive changes, both security fixes.

• Prevent SSRF in MCP OAuth metadata discovery and authentication (PR #29081)
• Enforce fail-closed workspace trust and filter mcpServers in restricted mode (PR #29099)

The second one keeps MCP server definitions from loading in a workspace you have not trusted. If your habit is to clone a repository and start Gemini CLI in it immediately, expect behavior to change.

Glossary
Fail-closed: when the system cannot determine whether something is allowed, it denies. The opposite, fail-open, lets the action through when the check is inconclusive.

What to check now

• [ ] Update Claude Code to 2.1.268 or later for the deny-rule fixes
• [ ] If you write deny rules against symlinked paths such as /tmp or /var, confirm they now apply as intended
• [ ] If you use a third-party endpoint via ANTHROPIC_BASE_URL, make sure you are not stuck on 2.1.265 through 2.1.267
• [ ] Grep your scripts for codex mcp-server before upgrading Codex
• [ ] On Gemini CLI, check that you are not loading MCP servers from workspaces you have not trusted

Summary

• All three tools shipped permission and security fixes this week; Codex had the most feature work
• Claude Code 2.1.268 fixes two deny-rule bypasses and is the highest-priority update
• The same release stops /mcp and claude mcp list from printing secrets resolved from ${VAR} placeholders
• Codex 0.154.0 removes codex mcp-server (breaking) and adds worktrees and GPT-6-Astra
• Gemini CLI 0.59.0 is two security fixes: MCP SSRF prevention and fail-closed workspace trust