Your AI Agent Updates Itself. Check Before It Reads Your Notes

Your AI agent updates itself, and it may not tell you. As documented on 2026-10-13, Claude Code, Gemini CLI and OpenCode update themselves by default; Aider only checks. Codex CLI starts a shared background server, with its own hourly updater, that outlives its window¹²³. Know which version reads your notes — then update on purpose.

Codex is the clearest example, and OpenAI wrote it down plainly. The release notes for version 0.157.0, published on 2026-09-25, read: "Enabled automatic background-server startup for eligible interactive sessions, with recovery choices when server settings are incompatible. (#47179, #47318)"¹ The pull request behind it is titled "Enable automatic daemon startup by default."⁴ In the source, the daemon_auto_start flag is marked stable with default_enabled: true, at the latest stable tag, 0.162.1, and on the main branch⁵.

A user filed an issue the same day asking for the default to flip. As of 2026-10-13 it was open, with 137 reactions, 15 comments, and no comment GitHub marks as coming from an OpenAI member or collaborator³. The reporter's view is one user's, and worth reading as that: "For a CLI, the least surprising default is that the backend lives and dies with the window, runs the binary I installed, and doesn't update itself in the background."³

Not everyone sees it — one commenter on version 0.160.0 wrote: "No daemons running that I can see."³ Eligibility conditions apply, and the vendor's own docs carry them.

None of this is a scandal. It is a design choice, written in a release note.

What follows reads each of five tools' own docs for one question — does it change version without asking, and does anything keep running after you close it? No tool is ranked. Docs drift, so treat every line as documented on 2026-10-13 and check your version. This is not security advice.

Why does an agent's update model matter for your notes?

An agent with read and write access to your notes folder is a program, and programs change. If it installs updates in the background, the version that edited a note last Tuesday may not be the version running today. If part of it outlives its window, closing the terminal is not the same as stopping it.

Two practical effects follow. First — version history: the same prompt can stop working when a model changes, and the same is true of the harness around the model. What a tool reads and how it edits can shift between releases, so the version belongs in the record.

Second, interruption. OpenAI's daemon documentation says that when an update restarts the background server, "A running daemon restarts, so active or queued work may be interrupted; a stopped daemon stays stopped."² Its default grace window for that shutdown is 60 seconds². An agent mid-way through rewriting a folder of notes is active work.

People lose track of this easily. In a 2014 study of 37 Windows 7 users, Rick Wash and colleagues found that "28 out of our 37 participants had a misunderstanding about what was happening on their computer, and that over half of the participants could not execute their intentions for computer management."⁶

That was an operating system. An agent pointed at your notes is a smaller program with closer access.

An earlier audit here asked what an AI tool can read when you hand it a folder. This one asks the next question: which version is doing the reading, and is it still running?

Should you turn auto-update off?

Usually not — and the research on updates says why. Automatic updates get security fixes onto machines fast, and a frozen version keeps every bug it shipped with. The useful habit is narrower: know which channel each tool follows, choose a slower one or a pin where the docs allow it, and update on a schedule you set.

The same 2014 paper that measured confusion opens with the other side. "When security updates are not installed, or installed slowly, end users are at an increased risk for harm."⁶ Two sentences later, its abstract keeps both truths in view: "However, user involvement in software updates remains necessary; not all updates are wanted, and required reboots can negatively impact users."⁶

The case for silent updates has numbers behind it. In 2009, Stefan Frei and Thomas Dübendorfer measured browser update rates in anonymized Google web server logs: "Chrome topped with 97% share after 21 days, followed by Firefox 85%, Safari 53%, and Opera 24%."⁷ The same note adds: "However, during the first 5 days after a new release Firefox outperformed all the others."⁷

Their conclusion was plain: "We recommend any software vendor to seriously consider deploying silent updates as this benefits both the vendor and the user, especially for widely used attack-exposed applications like Web browsers and browser plug-ins."⁷

Even OpenAI's own config reference leans that way — toward keeping checks on. Its startup update check reads: "Check for Codex updates on startup (set to false only when updates are centrally managed)."⁸

So read the switches below as a way to choose a pace.

Claude Code: does it update itself?

Yes, on the native installer. As documented on 2026-10-13, Claude Code checks for updates at startup and while running, installs them in the background, and applies them at the next start. Homebrew, WinGet, apt, dnf and apk installs do not auto-update by default. A stable channel trails the default by about a week.

The setup page says it in two sentences. "Native installations automatically update in the background to keep you on the latest version."⁹ And: "Claude Code checks for updates on startup and periodically while running. Updates download and install in the background, then take effect the next time you start Claude Code."⁹

Install method changes the default. "Homebrew, WinGet, apt, dnf, and apk installations do not auto-update by default; see below to opt in for Homebrew and WinGet."⁹ That opt-in is an environment variable — CLAUDE_CODE_PACKAGE_MANAGER_AUTO_UPDATE=1. apt, dnf and apk stay manual⁹.

There are two off-switches — and they differ in reach. The doc is exact: "DISABLE_AUTOUPDATER only stops the background check; claude update and claude install still work. To block all update paths, including manual updates, set DISABLE_UPDATES instead."⁹ claude doctor shows whether auto-updates are on, and the result of the last attempt.

The slower path is a channel. Set autoUpdatesChannel to "stable" and you get "a version that is typically about one week old, skipping releases with major regressions."⁹ A minimumVersion setting adds a floor, so switching channels does not downgrade you⁹.

Rollback is possible but bounded. The native installer prunes old versions on its own: besides the one in use, it "keeps the two newest versions and deletes the rest."⁹

A pin needs both halves. One user, in a Claude Code issue still open on 2026-10-13, described the trap: "i can only launch Claude Code if i revert to 2.1.241 but then autoupdate puts me right back in the same predicament."¹⁰ That is a single user report — and the reason a pinned version needs the auto-updater off too.

Gemini CLI: is auto-update on by default?

Yes. As documented on 2026-10-13, Gemini CLI's configuration reference lists general.enableAutoUpdate with the description "Enable automatic updates" and a default of true. A separate setting, general.enableAutoUpdateNotification, also defaults to true. Google cuts new stable and preview releases weekly, and nightly builds daily.

The setting lives in settings.json — for a user, ~/.gemini/settings.json — under the general key¹¹. Setting enableAutoUpdate to false is the documented switch. The reference gives the setting, not the mechanism behind it, so this post does not describe one.

Cadence is what makes a default matter. The release notes are specific: "Each Tuesday ~20:00 UTC new Stable and Preview releases will be cut."¹² And for the nightly channel: "New releases will be published each day at UTC 00:00."¹²

With auto-update on, that is how often your binary can change.

A weekly cadence is a reasonable default for a coding tool — and a reason to note the version when an agent session edits something you care about.

OpenCode: does it download updates at startup?

Yes. As documented on 2026-10-13, OpenCode downloads new updates when it starts. Its config takes "autoupdate": false to stop that, or "notify" to be told about new versions without installing them. The notify mode only works when OpenCode was not installed through a package manager such as Homebrew.

The config page states it directly: "OpenCode will automatically download any new updates when it starts up. You can disable this with the autoupdate option."¹³

The middle setting is the useful one for notes. "If you don't want updates but want to be notified when a new version is available, set autoupdate to "notify". Notice that this only works if it was not installed using a package manager such as Homebrew."¹³

A notice keeps you informed and leaves the decision with you — which is the whole habit in one setting.

The same page documents a server block, but it applies to the explicit opencode serve and opencode web commands¹³. The config page describes nothing left running after an ordinary session closes.

Aider: does it install updates on its own?

No — it checks, and stops there. As documented on 2026-10-13, Aider's --check-update option checks for new versions on launch and defaults to true. Installing is separate: --upgrade upgrades Aider from PyPI and defaults to false. An Aider session does not replace its own binary unless you ask it to.

The options reference lists both rows. --check-update: "Check for new aider versions on launch," default True. --upgrade: "Upgrade aider to the latest version from PyPI," default False¹⁴.

To turn the check off, the same page gives --no-check-update or the AIDER_CHECK_UPDATE environment variable¹⁴. For scripts, --just-check-update will "Check for updates and return status in the exit code."¹⁴

Of the five, this is the model closest to "update on purpose" — by default, with no setting changed.

Codex CLI: what keeps running after you close it?

As documented on 2026-10-13, Codex CLI from version 0.157.0 starts a shared background server for eligible interactive sessions by default. OpenAI's daemon README says eligible managed daemons check for updates after five minutes, then hourly. The setting to turn it off is not in the published config reference — it sits in source and a repository README.

Start with what the vendor documents. The daemon README, in OpenAI's repository, says: "Eligible managed daemons check for updates after five minutes, then hourly by default."² It also says the server is shared, and what that means for its environment:

"Shared clients use the environment inherited when the daemon started. Opening a new terminal or clearing variables there does not clear the running daemon's environment; per-client environment isolation is not provided."²

A proxy or a working directory set for one session can therefore persist into the next.

Persistence has a limit — a reboot. The README says "the updater loop is not reboot-persistent; a managed start after reboot starts it again."² No vendor page reviewed here shows Codex installing a login item or a system service. The issue's reporter saw the daemon keep running after every Codex window closed, "until codex app-server daemon stop or a reboot."³

The README is also labelled provisional. "codex-app-server-daemon is experimental and its lifecycle contract may change while the remote-management flow is still being developed."²

Now the gap. On 2026-10-13, the published Codex config reference contained no row mentioning daemon at all⁸. The off-switch exists — just not on that page. It is the feature flag in source⁵, toggled through a documented command family — "Manage feature flags stored in $CODEX_HOME/config.toml. The enable and disable commands persist changes so they apply to future sessions."¹⁵

Put together, the switch is:

codex features disable daemon_auto_start
codex app-server daemon stop

Those are the first two lines of the issue reporter's own workaround³. It was not tested for this post. The reporter also wrote that daemon stop left the updater process running and had to be ended by hand — a reported bug, not a documented behaviour³.

To keep the daemon but stop its updates, the README documents "autoUpdateEnabled": false under "updater" in CODEX_HOME/app-server-daemon/settings.json².

Install method is the open question — and the docs and the issue point different ways. The README ties the managed updater to installs made with OpenAI's latest-channel installer². The reporter installed with npm install -g @openai/codex and saw the updater anyway, plus a reported copy of about 374 MB of the platform package under ~/.codex/packages/app-server-daemon/³. Both may be true on different machines. Check yours rather than assume.

The five tools, side by side

This table quotes what each vendor's own documentation said on 2026-10-13. It maps defaults and switches; it does not rank tools. A tool that updates itself is not worse than one that does not — it is a tool whose version you track differently. Read every row for your install method and your version.

Five tools, five update models.

The Codex row is the longest because its behaviour has the most parts. Every load-bearing cell in it — the default, the cadence, the environment, the reboot limit — comes from OpenAI's own release note, source and README.

Who should leave auto-update on, and who should pin?

Leave auto-update on, or move to a slower channel, if you use an agent for code and quick lookups and want security fixes without thinking about it. Pin a version, with the auto-updater off, if an agent runs unattended over notes you care about, or if a release broke your setup. Either way, record the version.

Leaving auto-update on fits when:

• You want fixes fast — the case the Wash and Frei–Dübendorfer papers make⁶⁷.
• A slower channel exists and you use it — Claude Code's stable channel trails by about a week⁹.
• The agent works on a copy, a branch, or a folder under version control, so changes can be reviewed and reverted.

Pinning fits when:

• An agent runs long sessions over your notes, where a restart mid-task would interrupt work².
• A new release broke your setup, as in the Claude Code report above¹⁰.
• You need to say later which version touched which note.

Neither fits when you never update at all. A pin needs a review date.

A five-minute check before you point an agent at your notes

Five steps, once per tool. Read the update setting in the tool's own docs. Pick a channel or a pin. Check what is still running after you close every window. Write down the version that touched your notes. Then set a date to update on purpose. None of it requires turning updates off for good.

1. Read the setting. Use the table above as a map, then open the vendor's page for your version. Settings drift; the table is dated for that reason.
2. Pick a channel or a pin. A slower channel where one exists — Claude Code's stable, Gemini CLI's stable over nightly⁹¹². A pin where you need one, with the auto-updater off so it holds¹⁰.
3. Check what is still running. Close every terminal window. On Linux, pgrep -af codex lists matching processes with their full command lines; swap in claude, gemini, opencode or aider. On macOS, ps -ax | grep -i codex does the same. For Codex, codex app-server daemon version reports the CLI and running server versions as JSON².
4. Record the version. Note the tool and its version next to the change, the same habit as writing down which model made a note. claude --version, gemini --version and aider --version print the number.
5. Update on a schedule. Weekly or monthly — read the release notes, then update. That keeps the security fixes and the record.

For the level below this one — whether the binary was built from the source you can read — see the source is public; the binary is not the one you installed.

Frequently asked questions

Does Claude Code update itself automatically?

Yes, on the native installer. As documented on 2026-10-13, Claude Code checks for updates at startup and while running, installs them in the background, and applies them at the next start. Homebrew, WinGet, apt, dnf and apk installs do not auto-update by default, though Homebrew and WinGet can opt in.

How do I stop Claude Code from auto-updating?

Set DISABLE_AUTOUPDATER to "1" in the env block of settings.json. That stops the background check, while claude update still works. DISABLE_UPDATES blocks every update path. Updates carry security fixes, so the stable channel, about a week behind, is a middle path between off and every release. claude doctor confirms the setting.

How do I disable auto-update in Gemini CLI?

Set general.enableAutoUpdate to false in settings.json, for example ~/.gemini/settings.json. As documented on 2026-10-13, the setting defaults to true, and Google cuts new stable and preview releases weekly, with nightly builds daily. If you turn it off, update by hand on a schedule so security fixes still arrive.

Does Codex CLI keep running after I close it?

Since version 0.157.0, eligible interactive sessions start a shared background server by default. OpenAI's README says it checks for updates after five minutes, then hourly, and that the updater does not survive a reboot. The issue's reporter saw it running after every window closed. Eligibility varies; one commenter on 0.160.0 saw no daemon.

How do I turn off the Codex background daemon?

The reporter's workaround is codex features disable daemon_auto_start, then codex app-server daemon stop. The flag name comes from Codex's source; the command family is in its CLI reference. As of 2026-10-13 neither appears in the published config reference. To keep the daemon but stop updates, the README documents "autoUpdateEnabled": false.

Does Aider update itself?

No. As documented on 2026-10-13, Aider checks for new versions on launch, through --check-update, which defaults to true. It installs a new version only when you run it with --upgrade, which defaults to false. --no-check-update turns the check off, and --just-check-update returns the status as an exit code.

Is my AI coding agent still running after I close the terminal?

Check rather than assume. Close every window, then list processes: on Linux, pgrep -af followed by the tool's name; on macOS, ps -ax piped through grep. Of the five tools here, only Codex documents a shared background server. The others' docs describe nothing left running after an ordinary session ends.

Should I turn off auto-updates for AI coding tools?

Usually not. Wash and colleagues' 2014 paper opens by noting that users who install security updates slowly face increased risk, and Frei and Dübendorfer's 2009 data showed Chrome's silent updates reaching a 97% share after 21 days. Prefer a slower channel or a dated pin, then update on a schedule you set, recording each version.

Updates you can name

An agent that updates itself is doing what most software should. The problem is narrower — a version that changed while you were not looking, or a process you thought you had closed. Both have documented answers, tool by tool. The work is reading them before the agent reads your notes.

Updates are not the risk. Not knowing which program read your notes is.

mnmnote.com keeps your notes as open Markdown on your own device — plain text that outlasts whichever agent, at whichever version, last read it.