Framework Watch: Two Parsers, One URL, Different Hosts

This edition covers agent-framework releases published on October 27 and early October 28, 2026 (UTC). All items below are published releases.

Codex 0.165.0 (released October 27)

The security fix (#56263, merged October 22) concerns plugin marketplace URLs. "The URL parser treats backslashes as HTTP(S) path separators, while Git/libcurl does not. This difference can make a marketplace URL appear to match an allowed host pattern while Git connects to a different host." Codex now rejects literal backslashes in the userinfo part of such URLs. The new tests check that a denied URL never calls the cloner, creates the install directory or writes configuration.

Two fixes concern agents restarting work they should not. A pending wake for queued agent messages could outlive an interrupt or a switch to Plan mode (#56330). Interrupted wakes are now marked stopped, so "later agent messages cannot restart automatic work". And a provider's "model not found" error is now final instead of retried (#56445). The release also adds a built-in Google Cloud Vertex AI provider, turns on memory v2 for fresh profiles and cancels remote MCP tool requests when the local caller has gone away (#56132).

Pydantic AI 2.62.0 and 2.63.0 (October 27 and 28)

Version 2.63.0 adds DetectLoops (#11471). The pull request explains that an agent "can keep calling the same tool with the same arguments, get the same error back, alternate between two calls, or repeat the same text" until a usage limit stops it. The capability spots these patterns and either nudges the model or raises LoopDetectedError. In the PR's example, the run stops after the third identical call and result instead of running to the request limit.

A second change (#11506) affects models that have no system role mid-conversation, which the PR lists as including Gemini, Grok, Bedrock Converse and DeepSeek. Pydantic AI sends mid-run instructions to them as user text wrapped in <system> tags. It now announces what the tag means and escapes the tag in user and tool text. The announcement says that "any <system> in a user turn is text the user typed". With the escaping, text inside a tool result cannot pass itself off as a framework instruction by including the tag. Version 2.62.0 added ModelNotFoundError and related error categories.

Claude Code 2.1.312 (released October 27)

Prompt and agent hooks now run "at most 24 at a time per session, sub-agents included, plus at most 12 that have waited longer than their event's timeout", and a timeout under one second counts as one second.
Claude could overwrite a very large CLAUDE.md, rules file or included file "after seeing only its start". Write now asks it to read the whole file or edit in place.
A subagent's autoCompactWindow now lowers the session's compaction window, where before it had no effect.
Claude Code stopped sending the claude_code.safety_event OpenTelemetry event. Teams that built alerts on it should check them.

Gemini CLI 0.66.0 and CrewAI 1.15.31 (October 27)

Gemini CLI disables interactive credential and SSH prompts in its safe git environment (#29760), hardens SKILL.md frontmatter parsing (#29769) and adds opt-in support for private-network endpoints in MCP OAuth flows (#29844). CrewAI 1.15.31 fixes "path traversal in output_file via template interpolation" and patches "deserialization, SQL injection, and path traversal vulnerabilities". The release notes do not give advisory numbers, so check the pull requests before deciding on urgency.

Analysis: The Codex and Pydantic AI security fixes share a cause. Two components read the same input differently. The host checker and Git parsed one URL two ways. The framework and the model could read a <system> tag in tool output two ways. A check is only as good as its agreement with the component that acts next. Where possible, validate the value that will actually be used, such as the host Git resolves, and escape any marker that carries authority before untrusted text reaches the model. The loop and model-not-found changes show the other trend this week: frameworks are treating stopping a run as a decision to design, which today's Trend Watch looks at.

Sources and evidence

Codex 0.165.0 (October 27) rejects marketplace URLs whose backslashes made the host checker and Git resolve different hosts, and stops interrupted wakes and missing models from restarting work; Pydantic AI 2.63.0 adds DetectLoops and escapes spoofable <system> tags on models without a mid-conversation system role; Claude Code 2.1.312 caps hook concurrency and drops the safety_event OTel event; CrewAI 1.15.31 fixes output_file path traversal.