The editor stops being the product

Wednesday, October 28 was a big day for developer tools, and the two headline releases — Google’s Android Studio Rabbit 2 going stable and Microsoft’s VS Code 1.144 — landed with the same thesis: the IDE is no longer a smart text box with one built-in assistant. It’s a host for AI coding agents, plural, that you choose yourself.

Android Studio Rabbit 2: bring your own agent

At its Android Dev Summit, Google made Bring Your Own Agent stable in Android Studio Rabbit 2. The IDE now supports over 40 ACP-compatible coding agents — including Anthropic’s Claude Agent, OpenAI’s Codex, JetBrains’ Junie, and Google’s own Antigravity — installable from a marketplace under Settings > Tools > AI > Agents. You can install several and switch between them mid-project.

The important part isn’t the roster; it’s what the agents get. Connected agents inherit the IDE’s understanding of your project — structure, build configuration, symbols — plus its tools: Compose Preview, the emulator, Logcat, and the performance profilers. An agent can run a build, launch the emulator, and read the results instead of just suggesting code in a sidebar.

Also in the release: Change Review, which scans an agent’s pending changes and walks you through them before anything is applied; official Android CLI plugins for Claude Code and Codex, so agents can do project creation, emulator management, and UI inspection without the IDE open at all; and Android Bench 2.0, a benchmark for comparing agents on realistic Android tasks by completion time and cost.

VS Code 1.144: sessions that outlive the window

Microsoft’s release, shipped the same day, reframes VS Code as an agent command center. The architectural centerpiece is the Agent Host: a separate background process that keeps agent sessions running after you close the editor, locally or remotely. A new open standard, Agent Host Protocol 1.0, means those sessions carry over between VS Code, the Copilot CLI, the Copilot app, github.com, and GitHub Mobile — start on one, pick up on another (release notes).

The other big piece is Copilot Fusion, now generally available: instead of you picking a model, Fusion picks models, reasoning effort, and execution patterns per task, with Standard, High, and Max effort levels. High and Max require Copilot Pro+, Max, Business, or Enterprise; every model Fusion invokes bills at its standard rate, with a 30% discount on paid plans through November 30. Elsewhere in the release: cloud sessions on GitHub infrastructure (paid plan required), cloud automations in preview (schedule agent tasks or trigger them from repo events), experimental Computer Use (agents driving desktop apps on macOS and Windows, with user approval), an experimental working set (keep or undo an agent’s file edits in the editor), assisted permissions going GA, and image generation in preview.

The pattern: IDEs are competing on orchestration

Step back and both releases tell the same story. Google isn’t steering developers toward its own Gemini assistant — it’s opening the IDE to rivals. Microsoft is building the neutral substrate rather than the agent. The competition has moved from “best built-in assistant” to “best place to run whichever agent you like,” and the weapon is open protocols: the Agent Client Protocol on the Android Studio side (started by Zed Industries in August 2025, co-developed with JetBrains, with 30+ agents in its registry) and Agent Host Protocol 1.0 on the VS Code side. It rhymes with what the Language Server Protocol did for editor tooling a decade ago — write once, run anywhere.

The trust surface is growing as fast as the capability

Here’s the other story from the same week, and it matters exactly because agents are getting deeper access. On October 29, the security startup Forever Security published “Embrace” research on five AI developer tools — Cursor, GitHub Copilot, Anthropic’s Claude Desktop, VS Code, and OpenAI’s Codex. The common thread: each tool ships an embedded browser for previews and agent-driven browsing, and each had granted that browser powers no normal browser has. A web page could call Cursor’s agent composer to run commands on the host (patched October 1, silently); Copilot’s preview let a page spoof the address bar (fixed in build 1.1.29 on October 13, found and fixed independently); and local HTML files opened in Claude Desktop, Codex, or VS Code could escape their boundaries and read other files — Codex and VS Code were still unpatched as of October 29, with Microsoft labeling its report invalid. None of the vendors responded to The Register’s requests for comment.

The practical takeaway: as agents gain IDE superpowers, treat every tool-call approval as a security decision. Keep agents sandboxed, actually read Change Review output before applying it, and remember the browser inside your editor is not a browser.

Bottom line

Try the agent you already use inside the IDE you already have — that is the entire point of this release cycle. Watch the protocols more than the feature lists: the ACP registry and AHP 1.0 are where the real leverage is. And give your agents the least privilege you can get away with, because they’re about to have quite a lot of it.