Kiro ships a command sandbox and autonomous mode to all V3 users
Factory's Droid shut a prompt-injection hole, CodeRabbit began reviewing Cursor Origin PRs, and Amp's Puck went portable — a guardrails week for coding agents.
Copy markdown
Sandbox every shell command your agent runs
Kiro CLI 2.31.0 adds `/sandbox`, which boxes agent shell commands and their child processes into an OS-level sandbox where you choose the network policy — blocked, dev-hosts-only, or fully open, and local stdio MCP servers can run inside it too. `/autonomous on` then lets it grind through a task without approving each command, and both are live for every V3 user as of Oct 13. Kiro's own note warns it can't guarantee complete isolation, so keep eyeballing proposed commands.
Droid stops treating @-mentioned files as orders
Factory AI's Droid CLI v0.240.0 (Oct 13) closes a prompt-injection path where text inside a file you @-mention could rewrite Droid's instructions, and it stops the hooks, MCP servers, and commands Droid spawns from inheriting its runtime settings file. If you feed Droid untrusted repos or issues, that quietly shuts a real exfiltration door. The same build adds opt-in `droid doctor` checks for model and MCP connectivity.
CodeRabbit now reviews Cursor Origin PRs
CodeRabbit turned on automated, line-by-line pull-request reviews for repos hosted natively on Cursor Origin — early beta, US region only for now. If you moved a repo onto Origin, you no longer give up the review bot you relied on over on GitHub.
Take Amp's Puck into ChatGPT or Claude
Amp now exposes Puck, its coding agent, over MCP, so you can call it straight from ChatGPT, Claude, or any other MCP client instead of staying inside Amp's own UI. Useful if your agent workflow is already spread across several tools.