Yesterday in AI: 20 April 2026 — rm Hole Fixed, Mozilla Challenges Copilot

Claude Code v2.1.116 closed a sandbox bypass that let rm skip dangerous-path checks; Mozilla's MZLA shipped Thunderbolt, a self-hostable MPL 2.0 enterprise AI client; and Archon hit 19K GitHub stars on a claim that YAML harnesses push PR acceptance from 6.7% to 70%.

By OMC Editorial on 2026-04-21

Claude Code shipped a patch for a sandbox security bypass, Mozilla entered the enterprise AI market with an open-source Copilot rival, and the TypeScript coding harness Archon crossed 19K stars — all in one April 20 cycle. Claude Code v2.1.116 Closes a Sandbox rm Bypass Released April 20 at 22:18 UTC, Claude Code v2.1.116 fixed a sandbox auto-allow flaw that let rm and rmdir commands slip past the dangerous-path safety checks protecting critical system directories. Any user running Claude Code with auto-allow enabled was potentially exposed — update immediately. The release also makes /resume 67% faster on sessions larger than 40MB, cuts MCP startup time when multiple stdio servers are configured, and wires agent frontmatter hooks: to fire when an agent runs as a main thread via --agent — a gap that had left orchestration hooks silent in that mode. The thinking spinner now shows inline progress text "still thinking," "thinking more," "almost done thinking" rather than a separate row, and the Bash tool surfaces a hint when gh commands hit GitHub's API rate limit. Source: anthropics/claude-code releaseshttps://github.com/anthropics/claude-code/releases Mozilla's MZLA Ships Thunderbolt, an Open-Source Enterprise AI Client Mozilla's for-profit subsidiary MZLA Technologies launched Thunderbolt, a self-hostable enterprise AI client under MPL 2.0, with the bulk of press coverage landing April 20. Built in React, Thunderbolt lets organizations run their own AI hub, connecting Anthropic, OpenAI, Mistral, and OpenRouter as cloud providers while also supporting local models via Ollama or llama.cpp. The pitch is data sovereignty: enterprise prompts and documents stay on your infrastructure, not a vendor's. Full MCP integration gives it access to 10,000+ active MCP servers. The name deliberately echoes Thunderbird, Mozilla's email client — framing Thunderbolt as "what Thunderbird did for email, applied to AI clients." MZLA is offering both an open MPL 2.0 community editio