Kilo Code v7.8.28: security, inline images and Agent Manager

Kilo Code is an open source code agent that works in VS Code, JetBrains and terminal. Version 7.8.28 focuses on resolving Dependabot security advisories and polishing the Agent Manager experience, the panel that allows running several agents side by side.

In this article you will see:

• What changed in VS Code
• What changed in CLI
• The security fixes
• How to update and test today

What changed in VS Code

The most visible update is support for images generated by image models, like Google Nano Banana, and by the image generation tool, displayed directly in chat. This makes workflows easier where the agent produces diagrams, mockups or screenshots as part of the response.

Agent Manager received layout adjustments: example previews stay fully visible at a stable height, and the slim layout was simplified with the removal of numbered badges and the feature stepper. The Agent Manager splash option can now be enabled in experimental settings, disabled by default.

There was also a fix for auto-compaction: the process no longer starts too early before the configured context limit and does not loop on models without known context size or after the user interrupts a compaction.

What changed in CLI

CLI receives the same security fixes and inline images. In addition, dependencies were updated to resolve all remaining high severity advisories, including node-forge, brace-expansion, js-yaml, follow-redirects, body-parser and zod.

The Kilo CLI pin was updated to v7.8.28, and commonmark was updated to version 0.30.1. The bundled Kilo CLI was updated to v7.8.22 via v7.8.20.

The security fixes

Version 7.8.28 resolves moderate and low advisories by updating OpenTelemetry, several AI SDK providers, glob, minimatch, Babel and esbuild. It also updates express, proxy-addr and shell-quote to fix critical issues flagged by Dependabot.

In CLI, axios was updated to 1.21.0, fast-uri and fastify, and the vulnerable copy of fast-xml-parser was removed. Glob was updated to 14.0.2 to fix a cancellation issue.

Anyone running Kilo in production should update, mainly because of the fixes to express and shell-quote, which touch server components and command execution.

Project context Kilo Code

Kilo Code is a fork of OpenCode, enhanced to work within the Kilo agentic engineering platform. The platform offers more than 500 models, model switching mid task and direct payment to the provider, with no API markup. Version 7.8.28 is a maintenance update focused on security and stability, not on large new features.

The team maintains two branches: main for fixes to the current release and v2 for new features. Contributions for new features should target v2. This explains why 7.8.28 brings mainly fixes and polish.

How to update and test today

For VS Code, the update arrives via the marketplace automatically or manually in Extensions. For the CLI, download the latest binary from the GitHub releases page or update via npm with the package @kilocode/cli.

To test the new features, enable the Agent Manager splash in the experimental settings and try generating an image in a chat using a compatible image model. Also check that auto-compaction behaves correctly on models with unknown context.

Kilo Code is open source, with more than 500 models available at provider price, with no markup. The repository license allows use and contribution. Those who use code agents can also compare with the Kilo Code as open source code agent for VS Code and CLI and with the 5 tips to use Codex CLI in your workflow.