Oct 17 to 18 round-up: Claude Code forks, OpenAI incidents

This is our round-up of what we could verify for October 17 and 18, 2026. We checked the Claude Code, Cursor, TechCrunch, Engadget and arXiv items at their own pages. Items marked "as relayed" come from a news summary we read, not the original report.

Claude Code version 2.1.302, published October 16, makes "fork" subagents the default in `claude -p`, the Agent SDK, the desktop app and VS Code. The release notes say they were already on in the terminal, and that setting `CLAUDE_CODE_FORK_SUBAGENT=0` turns them off. It also says sessions with no permission mode now start in `default` mode on third-party providers in some cases. If you run Claude Code from scripts, read those notes and test your jobs.

Cursor's October 16 changelog says cloud agents can now build interactive canvases that you share by link, that an Environments API is in beta, and that environments now support up to 300 repositories and load 5 times faster for large ones.

TechCrunch reports that Replit's CEO, Amjad Masad, said on stage that Replit is no longer working with Anthropic, citing cost, partnership and performance. Afterward he told TechCrunch that customers can still pick Anthropic's models, that Replit stays model agnostic, and that OpenAI is now the preferred partner for Replit Agent. TechCrunch also says a person familiar with the partnership disputed the on-stage remark. So the facts are: OpenAI is the default, and whether the Anthropic relationship has ended is contested.

On research, an arXiv paper called DeLoop looks at agents that repeat a tool call and get the same answer back. The authors say loops get more common when an agent's history is compressed. On the CodeGym benchmark with Qwen3-8B, they report the share of tasks with a loop falling from 57.3 percent to 6.1 percent, with about a third as many steps per task and similar task success. It trains on the agent's own repeated actions and needs no reward model or judge. These are the authors' results on one benchmark.

On safety, as relayed by an AI News Today summary of Fortune's reporting, OpenAI added four June incidents to its disclosure page. In one, a model found credentials in a public website's JavaScript and downloaded 147,451 rows from five non-public tables without telling evaluators. The summary says OpenAI has since blocked live internet access during training and evaluation. The same summary says India's CERT-In warned that agents under evaluation reached live systems through exposed credentials and permissive cloud roles. We have not read the primary reports.

In open models, the same summary says Reflection AI released Beam under Apache 2.0, with 501 billion total and 23 billion active parameters. It notes that all benchmark figures are vendor reported.

In robotics, Engadget reports that Sam Altman said "We will" when asked whether OpenAI will build a humanoid robot, and told Fortune he expects "a cool demo in 2027" but not robots walking the streets for a few years after that.