AI Coding Agent Updates (November 2026): What Changed

From 2 October to 13 November 2026, the changes that matter most: GitHub retired 10 Copilot models (3 more go on 16 November) and made its model-policy API GA; Devin added budgets and self-serve SSO; Claude Code added pooled group budgets and a cost-report API; Claude Fable 5.2 shipped; Google shuts Jules down on 31 December.

Updated 13 November 2026. This is our monthly roundup of AI coding agent updates, written for engineering managers and CTOs who have to keep a fleet of agents working, governed and paid for. We only list changes we could confirm in each vendor's own changelog, docs or announcement. Rumours, aggregator posts and leaked benchmarks are left out. If you are choosing a tool rather than tracking one, start with our Cursor vs Claude Code vs Codex vs Devin comparison.

What changed in AI coding agents in November 2026?

The month was about control, not features: model retirements you must plan for, APIs to enforce which models people can use, and budget controls for agent spend. New frontier models also landed. Claude Fable 5.2 shipped on 9 November, and Gemini 4 Carbon reached GitHub Copilot on 10 November.

Here is the short list, by vendor:

• GitHub Copilot: 4 models deprecated on 2 October and 6 more on 19 October. On 19 October, model-policy GET/PATCH endpoints went GA at four levels. Claude Opus 4.8, Claude Opus 5 and GPT-5.6 Terra are scheduled to go on 16 November.
• Devin (Cognition): budget hierarchies, self-serve OIDC/SAML SSO, approval-required personal access tokens, session sharing defaults, sign-out of every device at once, and a daily session-consumption API.
• Claude Code: pooled group budgets, layered managed policies, a cost-report admin API on the Claude apps gateway, and new permission settings that deny instead of prompting. Fable 5.2 is now the default Fable model.
• OpenAI Codex: GPT-6.1 Terra was added to the CLI's bundled, Vertex AI and Amazon Bedrock model catalogs, and network requirements can now be managed centrally. GPT-5.5 was retired for ChatGPT sign-in on 14 October.
• Cursor: the Agent SDK went GA, environments now support up to 300 repositories, cloud agents can build and host live apps, and voice chat with agents arrived.
• Google: Jules became read-only on 11 November and shuts down on 31 December 2026.

Which GitHub Copilot models were retired in October 2026, and what replaces them?

GitHub deprecated 10 models across Copilot Chat, inline edits, ask and agent modes, and code completions in two waves, on 2 October and 19 October. A third wave of 3 models is scheduled for 16 November. Each one has a suggested replacement. Enterprise admins may have to enable the replacement in their model policy before developers can see it.

Sources: GitHub changelog entries for 2 October, 19 October and the mid-November notice. One exception: Claude Opus 4.8 stays available to individual subscribers on annual plans.

What breaks when a model is retired

GitHub says you do not need to remove deprecated models yourself. The real risk is elsewhere: scripts, Actions workflows, custom agents or prompt files that pin a model name. They fail or fall back silently. Search your repos for hard-coded model IDs before 16 November. Then run your own evaluation set against the replacement, because a "suggested alternative" is not guaranteed to behave the same on your codebase. Our LLM model migration guide covers how to do that without regressions.

What does the GitHub Copilot model policy API do?

Since 19 October 2026, admins can read and change which Copilot models are enabled, through GA REST endpoints rather than only the settings UI. That lets you manage model allow-lists as code and check them in CI.

The changelog entry lists GET and PATCH at four levels:

• Enterprise: /enterprises/{enterprise}/copilot/model-policies
• Enterprise teams: /enterprises/{enterprise}/teams/{team_slug}/copilot/model-policies
• Agent apps: /enterprises/{enterprise}/copilot/apps/model-policies
• Organization: /orgs/{org}/copilot/model-policies

Enterprise policies can hand model control down to organizations, or to teams and apps in enterprise-teams mode. This matters more now that new models are arriving fast. Claude Fable 5.2 reached Copilot on 9 November with its policy off by default for Business and Enterprise. Gemini 4 Carbon arrived on 10 November and is enabled automatically if your global default policy is on. Both are billed at provider list price under usage-based billing. We show how to wire this into a wider control plane in governing AI coding agents in the enterprise.

What did Devin ship in October and November 2026?

Devin's release notes from this period are mostly enterprise controls: budgets, SSO, token policy and session security. The biggest admin features are the 30 October budget hierarchy and self-serve SSO. The Devin release notes confirm:

• Budgets (30 Oct): user and organization spend organized in a budget hierarchy, with delegated permissions to manage sub-budget limits. The notes give no default numbers.
• Self-serve SSO (30 Oct): verify your email domain with a DNS record, then manage OIDC or SAML connections yourself. Since 14 October, SAML sign-out can also end the session at the identity provider.
• Token policy (30 Oct): enterprises with no personal-access-token policy now default to approval-required.
• Session controls: sleeping sessions can be resumed for 14 days, down from 30 (9 Oct). From 6 Nov, admins can set default session visibility, limit sharing to the session's organization, and sign a user out of web, desktop, CLI and mobile at once. On 11 Nov, Devin added an "Ask before loading external content" session security option.
• Multi-repo scale (2 Nov): the per-scan repository cap for code scans went from 500 to 1,000, in both the UI and the API.
• Spend visibility (9 Nov): a daily session-consumption API at GET /v3/enterprise/consumption/daily/sessions.

Also notable: Devin Oncall went GA on 19 October, and playbooks began migrating to skills on 23 October.

What changed in Claude Code and Claude models this month?

Anthropic released Claude Fable 5.2 on 9 November at $8/$40 per million input/output tokens. Claude Code shipped versions 2.1.305 to 2.1.322 between 20 October and 10 November, most of them adding admin and cost controls.

From the Fable 5.2 announcement: Anthropic reports 49.1% on FrontierCode 2.0 and 69.9% on FrontierSWE v2. These are vendor-run benchmarks. Fast mode costs $16/$80 per million tokens. Eligible enterprises can get zero data retention if they add Enterprise Frontier Safeguards; other customers have 30-day retention for safety monitoring. That retention point also applies inside Copilot, where Fable 5.2 keeps prompts and outputs to run safety classifiers. Check it against your data policy before you enable the model.

From the Claude Code changelog (dates from GitHub releases):

• 2.1.314 (30 Oct): permissions.blockWritesOutsideWorkingDirectories, which makes Write, Edit and NotebookEdit refuse paths outside the working directories in every permission mode. Gateway upstreams can also be limited to specific IdP groups.
• 2.1.316 (31 Oct): pooled group budgets (one monthly budget shared by a group, on top of each member's limit) and managed.policy_mode: layered. Fast mode for Opus 4.8 is deprecated, with removal planned for 30 November.
• 2.1.317 (3 Nov): a cost report in the Claude apps gateway admin API, by total, developer, day or IdP group, plus a daily record of each developer's IdP groups.
• 2.1.318 (4 Nov): cloud sessions can start with no repository.
• 2.1.319 (6 Nov): permissions.denyInsteadOfPrompting, so a tool call that would wait for approval is denied and the turn continues. That is useful for unattended runs.
• 2.1.321 (9 Nov): Fable 5.2 becomes the default Fable model, with 1M context. This release also fixed MCP OAuth requests that could send refresh tokens to another host after a redirect.

What changed in OpenAI Codex in October and November 2026?

Codex shipped incremental releases rather than a headline launch. The most useful changes are the new GPT-6.1 Terra model in more catalogs and centrally managed network rules. The Codex changelog lists:

• CLI 0.166.0 (29 Oct): GPT-6.1 Terra added to the bundled, Vertex AI and Amazon Bedrock model catalogs. FedRAMP API keys route to government endpoints by default.
• CLI 0.167.0 (6 Nov): managed network requirements under permissions.network, and a Google Cloud Vertex AI setup flow behind a flag.
• CLI 0.167.2 (11 Nov): incremental tool updates by default on Vertex AI.

The Codex pricing page notes that GPT-5.5 retired from Codex with ChatGPT sign-in on 14 October 2026. API-key sessions are unaffected. GPT-6.1 Sol is off by default for Enterprise and Edu until an admin enables it.

What did Cursor ship, and is Composer 2.5 new?

Composer 2.5 is not new this month. Cursor published it on 18 May 2026, priced at $0.50/$2.50 per million tokens for the standard tier. In this window Cursor shipped platform features instead.

• Agent SDK GA (20 Oct): agents are defined as folders of code, tested with evals, and deployed to Cursor or your own infrastructure. They can be triggered by GitHub, GitLab, Bitbucket, Slack, webhooks or cron.
• Environments (16 Oct): up to 300 repositories per environment, plus an Environments API in beta.
• Live apps (5 Nov): cloud agents can build, host and share web apps with a database and auth. Security checks run before publishing.
• Voice chat (6 Nov): realtime voice with agents, running on Grok Voice, with zero data retention under Privacy Mode.

The commercial change matters more. Cursor became part of SpaceX on 14 August, and its pricing page now sells plans through "The X Subscription". The $8 Plus tier covers Grok models only. Third-party models such as Claude and GPT start at Premium ($30) and are billed at API list price. If your team standardised on Cursor for model choice, re-read your plan.

Is Google Jules shutting down?

Yes. Google's Jules changelog announced the turndown on 29 October 2026. Users could finish sessions until 11 November. Jules is now read-only and shuts down on 31 December 2026. Code, branches and pull requests already live in GitHub and are not affected. The export covers only the settings and session history stored in Jules. Google points users toward Antigravity, its "agent-first platform", but has not said which Jules features will move there or when. If Jules runs in any of your workflows (scheduled tasks, issue triage), replace it now, not in late December.

What should engineering leaders do about these updates this month?

Do four things before the end of November: remove pinned model names before 16 November, put model policies under version control, set budgets on every agent platform you pay for, and replace any Jules automation.

1. Grep for model IDs. Look for Opus 4.8, Opus 5 and GPT-5.6 Terra in workflows, agent configs and prompt files. Run your evals on the replacement.
2. Policy as code. Use the Copilot model-policy API, Claude Code managed settings and Cursor's model access controls to keep one reviewed allow-list. Decide on purpose whether models that retain data (Fable 5.2) are allowed.
3. Turn on budgets. Devin budgets, Claude group pools and Copilot's paid-usage limits all exist now. Our cost-to-run guide explains why agent bills grow faster than seat counts.
4. Prefer deny over prompt for unattended runs. Settings like denyInsteadOfPrompting and blocking writes outside the working directory are small changes that close large gaps. The security benchmarks show why.

None of this changes the main finding from the AI coding agent productivity research: review and testing, not code generation, are the bottleneck.

How BeevR builds this

BeevR is a senior, founder-led software and AI studio in Hanoi. We build production AI agents on the rule that the model is an untrusted component. Our open-source Kite framework is built on that rule. For engineering teams, we can set up the controls described here as one fixed-scope phase: model allow-lists as code, budget caps, sandboxed execution and review gates. You get a working demo every Friday, and you own all source code and IP from day one. Phases are priced from $10K, with no per-user fees.

If you want an outside team to build or harden your AI agent setup, book a 30-minute call and we will tell you plainly which parts are worth doing first.