This week in Claude Code, Codex and Gemini CLI (week of September 20, 2026)

The headline this week is that Claude Code now reads AGENTS.md directly (v2.1.277). Until now you had to import it from a CLAUDE.md; in a repository without one, it is simply read.

Second: the 2.1.268 change this digest reported last week as a permission-bypass fix was reverted in 2.1.273. If you relied on that behavior, it is back to what it was.

Covered here: Claude Code 2.1.270 through 2.1.277, Codex CLI 0.155.0 and 0.155.1, and Gemini CLI 0.60.0.

Claude Code

2.1.277: AGENTS.md support

The changelog states it plainly: in a project with no CLAUDE.md, Claude Code reads AGENTS.md instead. The documentation now has an AGENTS.md section, and the resolution is this:

Your repository has	Claude reads
An AGENTS.md, and no CLAUDE.md or CLAUDE.local.md in your working directory or above it	Your AGENTS.md
An AGENTS.md and a CLAUDE.md or CLAUDE.local.md	Your CLAUDE.md files only
A CLAUDE.md that already imports AGENTS.md	Your CLAUDE.md, with AGENTS.md through the import

Three files count for that check: CLAUDE.md, .claude/CLAUDE.md and CLAUDE.local.md in your working directory or above. Your ~/.claude/CLAUDE.md, your organization's managed CLAUDE.md and .claude/rules/ files do not count and keep loading alongside AGENTS.md.

To change the default, run /config and set Project instructions:

Value	What Claude reads
claude-md-or-agents-md	The default: CLAUDE.md, or AGENTS.md when you have none
claude-md-and-agents-md	Both, each directory's CLAUDE.md first and its AGENTS.md after
claude-md	CLAUDE.md only
managed-only	Only your organization's managed CLAUDE.md and auto memory

You can set it in a settings file instead, under the built-in agents-md plugin's ID. Project and local settings files are ignored for this value.

{
  "pluginConfigs": {
    "agents-md@builtin": {
      "options": { "instructionFiles": "claude-md-and-agents-md" }
    }
  }
}

For how the three tools' context files relate, see CLAUDE.md vs AGENTS.md vs GEMINI.md.

2.1.276: upgrade now if you use a gateway

A 2.1.275 regression made every request fail with 400 … Input tag 'advisor_20260301' when ANTHROPIC_BASE_URL points at a proxy or gateway. 2.1.276 fixes it. If that describes your setup, upgrading is mandatory.

2.1.275: a send-now key and claude.ai syncing

• Send-now key: ctrl+enter (or ctrl+x ctrl+s) interrupts the current turn and sends all queued messages at once
• Skill and plugin syncing: the skills and plugins enabled on your claude.ai account now sync to terminal sessions signed in with it. Opt out with syncClaudeAiSkills: false or syncClaudeAiPlugins: false
• /plugin install <plugin> --marketplace <source> offers to add the marketplace before installing

2.1.273: last week's deny-rule fix was reverted

Last week this digest reported that Read and Edit deny rules failing to apply on a line containing env -C or eval had been fixed. That 2.1.268 change was reverted in 2.1.273. The changelog reads: "Reverted a 2.1.268 change that checked Read and Edit deny rules on Bash lines the permission checker can't analyze". Commands like time -p make build prompt again rather than being denied.

Permission fixes did land in the same release, though:

• Fixed Bash commands the permission checker cannot fully analyze skipping the prompt under permissions.blockReadsOutsideWorkingDirectories, and a subshell hiding a dangerous rm in bypass mode
• Fixed the context meter and auto-compact counting advisor-tool turns at roughly twice their real context size, which made auto-compact fire at about half the real window

The first one bears directly on protecting .env with deny rules — see Stop Claude Code reading your .env with a Read deny rule. For compaction thresholds, see autoCompactWindow.

2.1.274: MCP fixes

• Fixed Streamable HTTP MCP tool calls timing out after about 5 minutes even with a longer per-server timeout set
• Added CLAUDE_CODE_MCP_STARTUP_WAIT_MS to bound how long the first non-interactive turn waits for connecting MCP servers (0 means don't wait)
• Fixed MCP servers configured as http that only speak legacy HTTP+SSE failing to connect when they answer the first request with 422 or another 4xx

For MCP configuration, see Adding MCP servers to Claude Code.

2.1.271 and 2.1.270

• Per-command allowed_domains for Bash, PowerShell and Monitor in auto mode with sandboxing: the hosts a command needs are reviewed with it and opened for it alone, and other hosts are refused
• omitClaudeMd in agent frontmatter and --agents JSON lets custom and plugin subagents run without user, project and local CLAUDE.md files. Managed policy files still load
• Several Bash permission-check gaps closed: files a wildcard expands to, files read by fmt and column after an unrecognized option, shell variable declaration flags misrepresenting the command, and commands with two directory changes
• 2.1.270 fixed a 2.1.269 regression where read-only git commands started asking for permission after a session had been running a while

Codex

CLI 0.155.0

• Experimental /voice conversations with live transcripts and microphone controls, enabled through /experimental on supported builds
• The TUI shows live reasoning summaries in the status row and completion timestamps after successful turns
• Task hiding, archiving and deletion in the agents overview, plus worktree ownership details and confirmed deletion of clean managed worktrees
• Touch ID verification for MCP requests in local TUI sessions on supported Macs
• Amazon Bedrock can obtain AWS credentials from configured commands, with caching and expiration-based refresh

On the fixes side, Windows-process escapes from restricted WSL sandboxes are now blocked, and brokered shell snapshots were hardened against credential exposure.

CLI 0.155.1

New local TUI sessions leave reasoning summaries disabled by default again, fixing request rejection by providers that do not support them. Explicit reasoning-summary settings are still respected.

For how approvals and the sandbox interact, see What does Codex --full-auto actually do?.

Gemini CLI

0.60.0

Nearly every line in the release notes is a security fix.

Area	Change
Web fetch	Improved destination validation and connection routing
MCP OAuth	Enforces RFC 9207 issuer identification
macOS Seatbelt	Isolates the temporary directory for the sandbox
Extensions	Hardened path resolution and boundary validation; prompts for consent on environment changes and sanitizes runtime-altering environment variables
chrome-devtools-mcp	Removed a hardcoded Google CrUX API key
Workspace boundaries	Stronger boundary checks and symlink resolution in command safety and file discovery
System config	Strict permission and ownership checks on system-wide configuration paths
Windows	Mitigates NTFS 8.3 short name (SFN) paths

What to check now

• On 2.1.275 behind a proxy or gateway, upgrade to 2.1.276 or later
• In repositories with an AGENTS.md and no CLAUDE.md, know that v2.1.277 changes what gets loaded
• If you keep both files, note that AGENTS.md is not read by default; use claude-md-and-agents-md if you want both
• If you relied on deny rules covering eval or env -C lines, revisit that assumption for 2.1.273 and later
• If auto-compact was firing early, check whether 2.1.273 improved it
• To keep claude.ai skills and plugins out of terminal sessions, set syncClaudeAiSkills and syncClaudeAiPlugins to false

Summary

• Claude Code v2.1.277 reads AGENTS.md directly, in repositories that have no CLAUDE.md
• The default is claude-md-or-agents-md; change Project instructions in /config to load both
• The 2.1.268 deny-rule change was reverted in 2.1.273, correcting what this digest said last week
• 2.1.275 has a gateway regression that fails every request with a 400; 2.1.276 fixes it
• Codex 0.155.0 adds experimental /voice and Touch ID for MCP requests; 0.155.1 restores the reasoning-summary default
• Gemini CLI 0.60.0 is almost entirely security work, including RFC 9207 enforcement in MCP OAuth