This week in Claude Code, Codex and Gemini CLI (week of September 20, 2026)

Originally published at https://aicoding-guide.com.

The headline this week is that Claude Code now reads AGENTS.md directly (v2.1.277). Until now you had to import it from a CLAUDE.md; in a repository without one, it is simply read.

Second: the 2.1.268 change this digest reported last week as a permission-bypass fix was reverted in 2.1.273. If you relied on that behavior, it is back to what it was.

Covered here: Claude Code 2.1.270 through 2.1.277, Codex CLI 0.155.0 and 0.155.1, and Gemini CLI 0.60.0.

Key point

What you will learn

• Claude Code's AGENTS.md support and which file wins- The deny-rule fix from last week that got reverted
• Codex voice conversations and Touch ID, plus Gemini CLI's security fixes

The changelog states it plainly: in a project with no CLAUDE.md, Claude Code reads AGENTS.md instead. The documentation now has an AGENTS.md section, and the resolution is this:

Three files count for that check: CLAUDE.md, .claude/CLAUDE.md and CLAUDE.local.md in your working directory or above. Your ~/.claude/CLAUDE.md, your organization's managed CLAUDE.md and .claude/rules/ files do not count and keep alongside AGENTS.md.

To change the default, run /config and set Project instructions:

You can set it in a settings file instead, under the built-in agents-md plugin's ID. Project and local settings files are ignored for this value.

{
  "pluginConfigs": {
    "agents-md@builtin": {
      "options": { "instructionFiles": "claude-md-and-agents-md" }
    }
  }
}

Some sessions don't get this

The documentation lists the cases where Claude reads CLAUDE.md only and Project instructions doesn't appear in /config: a version before v2.1.277; a session that doesn't fetch feature flags from Anthropic, such as Amazon Bedrock or another third-party provider or with telemetry disabled; your first session after installing or upgrading; and setting disableAllHooks or allowManagedHooksOnly, or disabling the built-in agents-md plugin. Import AGENTS.md from a CLAUDE.md in those environments.

For how the three tools' context files relate, see CLAUDE.md vs AGENTS.md vs GEMINI.md.

A 2.1.275 regression made every request fail with 400 … Input tag 'advisor_20260301' when ANTHROPIC_BASE_URL points at a proxy or gateway. 2.1.276 fixes it. If that describes your setup, upgrading is mandatory.

ctrl+enter (or ctrl+x ctrl+s) interrupts the current turn and sends all queued messages at oncesyncClaudeAiSkills: false or syncClaudeAiPlugins: false /plugin install <plugin> --marketplace <source> offers to add the marketplace before installing Last week this digest reported that Read and Edit deny rules failing to apply on a line containing env -C or eval had been fixed. That 2.1.268 change was reverted in 2.1.273. The changelog reads: "Reverted a 2.1.268 change that checked Read and Edit deny rules on Bash lines the permission checker can't analyze". Commands like time -p make build prompt again rather than being denied.

Permission fixes did land in the same release, though:

permissions.blockReadsOutsideWorkingDirectories, and a subshell hiding a dangerous rm in bypass mode The first one bears directly on protecting .env with deny rules — see Stop Claude Code reading your .env with a Read deny rule. For compaction thresholds, see autoCompactWindow.

timeout setCLAUDE_CODE_MCP_STARTUP_WAIT_MS to bound how long the first non-interactive turn waits for connecting MCP servers (0 means don't wait)http that only speak legacy HTTP+SSE failing to connect when they answer the first request with 422 or another 4xx For MCP configuration, see Adding MCP servers to Claude Code.

allowed_domains`` omitClaudeMd``--agents JSON lets custom and plugin subagents run without user, project and local CLAUDE.md files. Managed policy files still loadfmt and column after an unrecognized option, shell variable declaration flags misrepresenting the command, and commands with two directory changes/voice conversations/experimental on supported builds On the fixes side, Windows-process escapes from restricted WSL sandboxes are now blocked, and brokered shell snapshots were hardened against credential exposure.

New local TUI sessions leave reasoning summaries disabled by default again, fixing request rejection by providers that do not support them. Explicit reasoning-summary settings are still respected.

For how approvals and the sandbox interact, see What does Codex --full-auto actually do?.

Nearly every line in the release notes is a security fix.

Glossary

NTFS 8.3 short names: the PROGRA~1-style aliases Windows generates for long filenames. Because the same file can be reached by a second spelling, they are a route around path checks.

AGENTS.md and no claude-md-and-agents-md if you want botheval or env -C lines, revisit that assumption for 2.1.273 and latersyncClaudeAiSkills and syncClaudeAiPlugins to false claude-md-or-agents-md; change /config to load both