Agent trust boundaries harden as Vercel pushes AI Gateway toward production

Summary

Today's ten signals cluster around three currents. First and loudest, coding agents are converging on safe-by-default execution: Claude Code 2.1.222 closes a gap so worktree isolation now covers destructive git and Bash across every session type, Zed 1.14.2 sandboxes its built-in agent's terminal and fetch tools, and OpenAI's Codex CLI backports safer automatic-review defaults for cyber-capable models. Anthropic pushes the same instinct into governance with beta inference hooks that hold every governed prompt across claude.ai, Cowork, and Claude Code for an organization's allow/deny verdict before inference runs. Second, Vercel dominated platform news, advancing AI Gateway on three fronts — a new Meta Muse Spark 1.2 coding model with BYOK and no markup, AWS Marketplace distribution for consolidated enterprise billing, and per-request OpenTelemetry traces exportable through Drains — while scaling agent runtime infrastructure with a 5x jump in Vercel Sandbox concurrency and durable human-in-the-loop approvals in the Chat SDK. Third, model lifecycle churn continues as Anthropic retires Claude Opus 4.1 from the API and steers users to Opus 5.

Key themes

• Trust boundaries harden across coding agents: Claude Code extends worktree isolation to destructive git and Bash in every session type, Zed sandboxes its agent's terminal and fetch tools, and OpenAI's Codex CLI ships safer auto-review defaults for cyber-capable models — an industry-wide shift to safe-by-default agent execution rather than opt-in controls.
• Governance moves inline: Anthropic's beta inference hooks give enterprise compliance teams a single pre-inference allow/deny enforcement point spanning Claude's chat, coding, and agent surfaces, with signed requests and logged denials.
• Vercel pushes AI Gateway toward production maturity: a fresh Meta Muse Spark 1.2 coding model (BYOK, no markup), AWS Marketplace distribution for enterprise procurement, and an OpenTelemetry trace per request exportable via Drains.
• Agent runtime infrastructure scales: Vercel Sandbox raises concurrency 5x to 10,000 sandboxes with auto-scaling vCPU quotas, and the Chat SDK adds durable, restart-surviving human-in-the-loop approvals for agent workflows.
• Model lifecycle churn: Anthropic retires Claude Opus 4.1 from the Claude API — requests now error — and points users to Opus 5, with continued researcher access via its External Researcher Access Program.

Notable items

• Anthropic launches inference hooks in beta (high impact) — real-time DLP that holds each governed prompt across claude.ai, Cowork, and Claude Code for an org security server's allow/deny verdict before inference proceeds.
• Claude Code 2.1.222 fixes a gap so worktree isolation now applies to destructive git, file edits, and Bash across every session type, including background and forked subagents.
• Zed 1.14.2 sandboxes its coding agent's terminal and fetch tools, isolating the shell commands and web requests the agent runs inside the editor.
• OpenAI Codex CLI rust-v0.146.1 applies safer automatic-review defaults for cyber-capable models and explains permission changes directly in the terminal.
• Vercel AI Gateway now emits an OpenTelemetry trace for every request, streamable to any OTLP/HTTP endpoint via Drains (metadata only, excluding prompt/completion content).
• Vercel AI Gateway lists on AWS Marketplace, letting teams route inference spend through committed AWS budgets with no change to per-token pricing.
• Meta's Muse Spark 1.2 coding model lands on Vercel AI Gateway with BYOK and no markup, targeting code generation, debugging, and long-horizon developer workflows.
• Vercel Sandbox raises limits to 10,000 concurrent sandboxes and up to 5,000 vCPUs per minute, with a dynamic quota that grows with sustained usage.
• Vercel Chat SDK adds durable human-in-the-loop approvals: a single requestApproval call pauses a running workflow with an Approve/Deny card that persists across restarts.
• Anthropic retires Claude Opus 4.1 (claude-opus-4-1-20250805) from the Claude API, returning errors on requests and recommending an upgrade to Claude Opus 5.

Source coverage

Source rows used: 10