More ways to work locally, keep long-running tasks under control, move safely across environments, and turn conversations into durable engineering outcomes.
Software work does not stay inside one prompt, one window, or even one machine.
A developer may begin by asking a question, continue by running a build, move into a remote workspace, review an image or architecture plan, and finish with several related pull requests. Along the way, the work may need an administrator’s approval, a teammate’s input, a different device, or a model that can run closer to the code.
Most AI assistants treat those moments as separate interactions. Context is rebuilt. Background work becomes difficult to follow. Local intelligence is either unavailable or introduced without enough organizational control. Useful artifacts disappear into a transcript. The final delivery can become disconnected from the decisions that produced it.
Cortex 6.3 focuses on that gap.
The release makes Cortex more useful as a continuous working environment: one that can operate with stronger local protections, keep active work visible, use approved local intelligence, move conversations across workspaces, connect to remote environments, and produce artifacts that remain part of the work.
The result is not simply a longer list of AI functions. It is a more coherent path from an idea to a reviewable outcome.
Give AI work a safer place to run
AI-assisted engineering becomes more valuable when it can do more than suggest text. It may need to inspect a project, run a test, start a development process, or prepare a change.
Those actions also require clear boundaries.
Cortex 6.3 introduces a more consistent execution experience across supported environments. Organizations can establish how protected actions should be handled, while users receive clearer prompts when a decision is required.
Low-risk work can proceed with less interruption when policy permits it. More sensitive actions remain visible and reviewable. If an environment cannot provide the required protections, Cortex does not silently treat it as equivalent to a protected one.
For customers, this means less friction without turning convenience into an invisible expansion of authority.
Teams can choose the balance that fits their work. A tightly governed repository may require more frequent confirmation. A controlled development environment may allow routine operations to proceed with fewer prompts. Organization policy remains able to narrow what is available.
The important change is that the experience now reflects the actual operating boundary, rather than presenting every client or machine as if it had the same capabilities.
Use approved local intelligence when it makes sense
Cloud intelligence remains important for broad capability, scale, and access from many devices. It is not the only useful place for inference.
Some teams want selected coding requests to run on a developer-controlled machine. They may be working offline, reducing routine cloud usage, evaluating a small specialized model, or keeping an eligible prompt close to the workspace.
Cortex 6.3 adds an approved local route for supported development hosts.
Users can discover eligible local models and request access through a simple workflow. Administrators can approve a specific local model for a requester or an organization through a guided experience. The approval remains limited to what the administrator reviewed.
The chat experience makes the route visible and lets the user choose between approved local intelligence and cloud intelligence. Cloud remains the default, while organizations can prefer local execution or require it for selected use cases.
Local-only means what it says: if an eligible local route is unavailable, Cortex does not quietly send the request to the cloud.
This release deliberately treats local models according to their level of trust. A model being present on a machine does not automatically make it eligible for sensitive company work or broader agent capabilities. Its available role remains proportionate to its approval.
That distinction allows customers to benefit from open and locally hosted models without treating every downloaded model as equally trustworthy.
Keep long-running work visible
Many useful engineering tasks take longer than a chat response.
A test suite may run for several minutes. A local service may need to stay active while another part of the application is inspected. A build may continue after the user changes windows. A failed process may need to be restarted without reconstructing the original command.
Cortex 6.3 gives this work a clearer lifecycle.
Supported development environments can show active and recently completed processes, provide bounded output, and make stop or restart controls available where appropriate. A reconnect or window reload no longer has to make a running task feel lost.
This is especially useful for developers who use Cortex for complete workflows instead of isolated code suggestions. The conversation can continue while a longer task runs, and the task remains connected to the session that started it.
Process control also respects ownership and policy. A remote observer can see permitted status without becoming the execution host, and one session cannot casually take control of work owned by another.
Recover space without losing work
Parallel engineering work often creates additional workspaces. They are useful while a task is active, but they can quietly consume disk space long after a change is merged, abandoned, or moved elsewhere.
Cortex 6.3 makes managed workspace storage easier to understand.
Developers can review Cortex-managed work areas, see which ones are active or protected, and clean up eligible items. Organizations can apply retention guidance and identify storage pressure without exposing unnecessary local details to every client.
The experience is designed around recovery rather than deletion alone. When Cortex has enough durable information to reconstruct a managed workspace, users can remove the local copy and restore it later.
Active, pinned, unresolved, or approval-blocked work remains protected unless the user takes an explicit higher-impact action. This helps teams regain space without turning cleanup into another source of lost work.
Move a conversation without breaking its meaning
A chat may begin before the right workspace exists. A broad task may later split into several related streams. A user may need to move work from a folder to a managed workspace or continue it from another Cortex surface.
Cortex 6.3 improves how conversations relate to workspaces and to one another.
Users can organize related sessions, create nested work, and move eligible work to a different workspace while preserving the surrounding conversation. Parent and child sessions remain understandable without forcing every thread to share the same execution context.
This is useful for work such as a feature implementation that produces a separate test investigation, security review, and documentation task. Each stream can evolve independently while still belonging to the larger objective.
Because the relationship is durable, another supported Cortex client can present the same structure without pretending to own a filesystem it cannot access. The execution stays with the capable host; the conversation and control experience can travel.
Extend Cortex without turning every integration into a one-off project
Teams often want Cortex to understand their preferred workflows, tools, review practices, and enterprise services.
Cortex 6.3 introduces a governed customization experience for approved agents, skills, tools, connectors, workflows, and interactive views.
Users can browse what their organization has made available, install compatible capabilities, enable them only where needed, and remove them when they are no longer useful. Administrators can curate private offerings, assign required capabilities, control updates, and revoke a package when necessary.
The user experience focuses on outcomes rather than internal package formats. Someone looking for code review, test automation, GitHub, Jira, or another workflow can search by purpose and see only compatible options.
This creates room for Cortex to become more specific to each organization without making every user responsible for validating the underlying distribution mechanism.
Work naturally in remote development environments
Modern development frequently happens somewhere other than the local laptop.
Teams use remote servers, development containers, Linux environments, tunnels, managed cloud machines, and specialized hosts. Requiring users to manually recreate their Cortex setup for every environment adds friction and creates confusion about where work is actually running.
Cortex 6.3 makes the current development environment the natural execution context.
When a developer is already connected through a supported remote workflow, Cortex can use that workspace without asking for a separate setup file. Optional organization-managed agent hosts can also be assigned for work that needs to continue away from the current editor.
Other Cortex clients can observe, steer, or approve eligible work on those hosts without claiming local access they do not have.
For users, the experience is simpler: connect to the environment where the code lives and work normally. For administrators, managed hosts remain visible, assignable, and revocable.
Bring visual creation into the engineering conversation
Not every engineering artifact is source code.
Architecture diagrams, interface concepts, documentation visuals, threat-model illustrations, and product assets often emerge during the same conversation that produces code and plans.
Cortex 6.3 adds image generation and editing to supported Cortex experiences.
Users can describe a new visual, create a variation, or work from an existing image. In VS Code, a completed image appears directly in the chat instead of opening as an unrelated experience. It can be opened, located in the workspace, downloaded, or retried from the same place.
The visual remains connected to the conversation after reload, alongside the messages that explain why it was created. This makes generated media more useful as part of real project work rather than as a temporary preview.
Organizations retain control over availability, approved providers, usage, retention, and other relevant policy. Usage can be accounted for without placing prompts or image contents into ordinary operational logs.
Turn linear chat into shared, durable working material
Some ideas are difficult to maintain as a sequence of messages.
An implementation plan changes over time. A threat model has related components. Architecture needs structure. Findings may be reviewed and updated by several participants.
Cortex 6.3 introduces interactive canvases for these kinds of artifacts.
A canvas can remain associated with a Cortex session while giving users and agents a more structured place to work. Supported clients can update the same artifact, preserve revisions, and recover after reconnecting. Clients that cannot safely edit a particular layout can still present it without corrupting it.
This makes Cortex useful for work that sits between conversation and code: planning, review, modeling, coordination, and shared understanding.
The most important benefit is continuity. A canvas is not merely a transient rendering of a response. It can become a durable project artifact with a clear relationship to the session that created it.
Make voice feel like part of chat
Voice is most useful when it reduces effort without creating a second, disconnected conversation.
Cortex 6.3 brings microphone input into the normal chat composer on supported clients.
A user can speak a request, review the recognized text, edit it if necessary, and send it as an ordinary chat message. The resulting turn is stored and restored like any other part of the conversation.
This design keeps text as the visible source of intent. Spoken input does not silently approve a consequential action, and ambiguous speech does not become authority. When a protected decision is required, the user still receives a clear visual control.
Raw audio is not treated as ordinary chat history. Customers can use voice for speed while retaining a reviewable text conversation and organization-level controls over provider availability and retention.
Manage dependent pull requests as one delivery
Large changes are often easier to review as several pull requests. The first may introduce a foundation, the next builds on it, and a third completes the user-facing behavior.
Ordinary pull-request tooling still tends to present each item independently. That makes it easy to update the wrong base, overlook a dependency, or misunderstand what remains before the full change can land.
Cortex 6.3 adds support for pull-request stacks.
Users can view the relationship among dependent changes, validate their current state, and prepare coordinated updates. Cortex rechecks relevant repository state before a consequential update and presents the intended change for review.
If an external operation succeeds only in part, Cortex reports the surviving state instead of presenting the entire stack as complete. Retries are designed to avoid duplicating an already completed action.
The feature helps teams preserve the reviewability of small pull requests without losing sight of the larger delivery they form together.
50 improvements across the Cortex 6.3 experience
The release spans eight connected areas.
Protected execution
- Policy-aware protected actions
- Flexible confirmation modes for different working styles
- Clearer prompts for higher-impact work
- Environment-aware execution protection
- Protected actions do not proceed when required safeguards are unavailable
- Remote approval without turning the approving device into an execution host
Approved local intelligence
- Discovery of supported locally installed models
- Simple user requests for local model access
- Requester-level local approval
- Organization-level local approval
- Verification of the approved model identity before use
- Visible Local or Cloud routing
- Local-only operation without silent cloud fallback
- Restricted treatment for installed but unapproved models
Long-running work and workspace recovery
- Active and completed process visibility
- Manageable output history for longer-running commands
- Stop controls for eligible active work
- Restart controls for eligible terminal work
- Process recovery after reconnect or reload
- Managed workspace storage visibility
- Protected cleanup with restoration when work can be reconstructed
Conversations that move with the work
- Moving eligible conversations to another workspace
- Nested sessions for related streams of work
- Reordering and reorganizing connected sessions
- Preservation of drafts, attachments, and surrounding context
- Automatic use of the current supported remote workspace
- Organization-assigned remote agent environments
- Cross-client observation, steering, and approval
Governed customization
- Browsing approved Cortex customizations
- Searching by purpose, such as review, testing, or integration
- User-friendly install, enable, disable, and removal controls
- Session-specific customization enablement
- Client compatibility awareness before installation
- Organization assignment, version control, and emergency revocation
Richer project artifacts
- Image generation from a natural-language request
- Image editing and variation workflows
- Persistent generated-image results inside chat
- Open, locate, download, and retry controls for generated visuals
- Interactive plans, threat models, architecture, and findings
- Revision-aware shared canvas updates
- Safe read-only presentation on clients that cannot edit a canvas
Natural voice interaction
- Microphone input in the normal chat composer
- Editable transcripts before sending
- Session-aware voice steering and interruption on supported clients
- Visible confirmation instead of spoken authorization for consequential actions
Reviewable delivery
- Pull-request stack discovery and visualization
- Creation and management of dependent pull-request groups
- Validation and preview before coordinated updates
- Fresh repository and protection checks before consequential changes
- Truthful partial-failure reporting and safer retries
One experience, with capabilities that reflect the client
Cortex is available across development tools, browsers, Discover, mobile, the command line, and managed environments.
Cortex 6.3 does not pretend that every surface can safely do the same thing.
A phone can review or steer remote work without becoming a shell host. A browser can present the route used for a response without claiming it can run a desktop model. A development environment can execute locally when it has the required protections. An administrator can set organization policy without receiving the contents of every conversation.
This capability-aware approach helps customers move between clients while keeping the boundaries understandable.
The experience can remain connected without flattening meaningful differences among devices.
From a helpful response to a durable outcome
The value of AI in software development is not measured only by how quickly it produces an answer.
Teams also need to know where work ran, whether it is still active, what artifacts it produced, which environment owns it, whether local intelligence was approved, and how the result can move toward review.
Cortex 6.3 brings those concerns into one customer experience.
A developer can begin with a cloud conversation, use approved local intelligence for an eligible request, continue in a remote workspace, monitor a long-running test, create a visual or shared plan, speak the next instruction, and prepare a related set of pull requests without turning each step into an unrelated tool handoff.
Organizations can provide that flexibility while retaining meaningful controls over execution, models, customizations, remote environments, providers, and consequential actions.
That is the direction of Cortex 6.3: private where it should be, connected where it needs to be, and durable enough to carry real work from intent to outcome.
