Agent Patch Notes #3: Claude Code locks down, CrowdStrike's AI Kill Switch, GitHub Agentic Workflows GA

Hey, Seth here.

Issue #3 of Agent Patch Notes, the weekly email from Ranked Agents, where we rank 46 AI agents and automation tools from S to B tier. This week the story is control: Claude Code tightened write and connector permissions, CrowdStrike shipped an AI Kill Switch, and Vercel put Security Review in public beta. GitHub Agentic Workflows also went GA, and Factory rebuilt its coding harness around programmatic tool calling.

Claude Code 2.1.314 to 2.1.318: tighter writes, hooks that can block, and sign-in expiry warnings (Oct 30–Nov 4)
permissions.blockWritesOutsideWorkingDirectories makes Write, Edit and NotebookEdit refuse paths outside the working directories in every permission mode. 2.1.317 adds a /schedule warning when a cloud task gets connectors you did not ask for, asks before sending your account email on web/shell calls, and lets Agent SDK hooks use onFailure: "block". 2.1.318 reports when a stored claude.ai sign-in ends (with a warning 10 days out) and lets mods set effort on $.model.fork. Heads-up: Opus 4.8 fast mode is deprecated as of Oct 30 and goes away Nov 30, 2026 — migrate to Opus 5.5.

CrowdStrike adds an AI Kill Switch for rogue internal agents (Nov 3)
In Falcon Guardian, authorized security teams can terminate a misbehaving AI agent where it runs, block it from launching again and cut off its enterprise network access. A human triggers the action, with a full audit trail.

Vercel Security Review enters public beta for Pro and Enterprise (Nov 3)
Once enabled, every push to a connected GitHub repo is reviewed for vulnerabilities, including direct and force pushes to production. Findings land in the Vulnerabilities dashboard with a summary, suggested fix and AI severity rating, plus a GitHub check and PR comments on private repos. Fix with Vercel Agent opens a PR you approve. Reviews are free until November 10, 2026, then billed at the Vercel Agent rate (needs Vercel CLI 65.10.0+).

Honeycomb launches Personal and Team AI SRE agents in early access (Nov 3)
Personal Agents investigate production questions with evidence from high-cardinality traces and MCP connectors, keep chats private, and act only when asked. Team Agents run goal-oriented background work such as watching releases, improving instrumentation, investigating alerts and maintaining knowledge docs, with shared memory and autonomy limited by team-set permissions.

GitHub Copilot: Agentic Workflows reach general availability (Oct 28)
The open-source GitHub Next project compiles natural-language Markdown workflows into standard Actions YAML so coding agents can handle issue triage, CI failure analysis, docs updates and test writing. Agents run read-only by default in a sandboxed container behind the Agent Workflow Firewall. GA adds ARC and Docker-in-Docker runners, gh aw forecast for AI credit spend, per-workflow model providers, a model router and micro-VM isolation. Available on GitHub Free, Team and Enterprise; the default Copilot CLI engine needs a Copilot license.

Factory launches Droid 1.0 with programmatic tool calling (Oct 29)
Factory's rebuilt agent harness makes programmatic tool calling the default: the model writes a JavaScript Script that runs in a sandbox and can make hundreds of tool calls in one model request, which Factory says cuts cost 15% on Claude Opus 5.5. The base prompt shrank 37% and only 2 tool definitions load up front. Available as a macOS and Windows desktop app, a terminal UI and the @factory/droid-sdk TypeScript SDK.

OpenAI Codex CLI 0.166: keyboard transcript selection and codex doctor --network-only (Oct 29)
Keyboard-driven transcript selection with word, line and page motions and integrated search, GPT-6.1 Terra in the bundled, Vertex AI and Amazon Bedrock catalogs, codex queue --resume for unloaded threads, clearer safety-block explanations, and codex doctor --network-only for connectivity checks.

There's more on the daily releases feed, including DeepSeek's open-source dsh-superagent prototype, Agno 3.1.12 routing Claude/Codex approvals into AgentOS, Mastra 1.80.0 per-user OAuth, MCP servers 2.2.0 (eMudhra CA response), Pydantic AI 2.64 and LangGraph 1.2.19.

For reference, the current S tier is: Claude Code, Cursor, OpenAI Codex, n8n, LangGraph, ChatGPT Deep Research, Zapier, ChatGPT Agent and Vapi. Full tier list

GitHub Agentic Workflows went GA, so here's how Copilot stacks up against Cursor:

Read the full comparison

Turn on write boundaries before you hand an agent a long job. Claude Code's new permissions.blockWritesOutsideWorkingDirectories refuses Write/Edit/NotebookEdit outside your working directories in every permission mode — useful when a session runs long and the agent starts wandering. Pair it with hooks that use onFailure: "block" so a failed check actually stops the action instead of logging and continuing. If you run agents in production, treat CrowdStrike-style kill switches and Vercel Security Review the same way: assume something will go wrong, and decide who can cut power before it does.

That's issue #3. Hit reply and tell me which tool you want ranked next. I read every reply, and your answers shape what gets added next.

If a friend or teammate is trying to pick an AI agent, forward this to them. They can subscribe at rankedagents.dev.

See you next Friday,
Seth at Ranked Agents