# This week in Claude Code, Codex and Gemini CLI (week of September 20, 2026)

> Source: <https://dev.to/aicoding-guide/this-week-in-claude-code-codex-and-gemini-cli-week-of-september-20-2026-2fg1>
> Published: 2026-09-19 19:08:56+00:00

*Originally published at [https://aicoding-guide.com](https://aicoding-guide.com/en/posts/weekly-2026-09-20/).*

The headline this week is that Claude Code now **reads `AGENTS.md` directly** (v2.1.277). Until now you had to import it from a `CLAUDE.md`; in a repository without one, it is simply read.

Second: the 2.1.268 change this digest reported last week as a permission-bypass fix was **reverted in 2.1.273**. If you relied on that behavior, it is back to what it was.

Covered here: Claude Code 2.1.270 through 2.1.277, Codex CLI 0.155.0 and 0.155.1, and Gemini CLI 0.60.0.

**Key point**

What you will learn

- Claude Code's
`AGENTS.md` support and which file wins- The deny-rule fix from last week that got reverted
- Codex voice conversations and Touch ID, plus Gemini CLI's security fixes

The changelog states it plainly: **in a project with no CLAUDE.md, Claude Code reads AGENTS.md instead**. The documentation now has an `AGENTS.md` section, and the resolution is this:

| Your repository has | Claude reads | 
|---|---|
| An `AGENTS.md` , and no`CLAUDE.md` or`CLAUDE.local.md` in your working directory or above it | Your `AGENTS.md` | 
| An `AGENTS.md` and a`CLAUDE.md` or`CLAUDE.local.md` | Your `CLAUDE.md` files only | 
| A `CLAUDE.md` that already imports`AGENTS.md` | Your `CLAUDE.md` , with`AGENTS.md` through the import | 

Three files count for that check: `CLAUDE.md`, `.claude/CLAUDE.md` and `CLAUDE.local.md` in your working directory or above. Your `~/.claude/CLAUDE.md`, your organization's managed `CLAUDE.md` and `.claude/rules/` files do not count and keep loading alongside `AGENTS.md`.

To change the default, run `/config` and set **Project instructions**:

| Value | What Claude reads | 
|---|---|
| `claude-md-or-agents-md` | The default: `CLAUDE.md` , or`AGENTS.md` when you have none | 
| `claude-md-and-agents-md` | Both, each directory's `CLAUDE.md` first and its`AGENTS.md` after | 
| `claude-md` | `CLAUDE.md` only | 
| `managed-only` | Only your organization's managed `CLAUDE.md` and auto memory | 

You can set it in a settings file instead, under the built-in `agents-md` plugin's ID. Project and local settings files are ignored for this value.

```
{
  "pluginConfigs": {
    "agents-md@builtin": {
      "options": { "instructionFiles": "claude-md-and-agents-md" }
    }
  }
}
```

**Some sessions don't get this**

The documentation lists the cases where Claude reads `CLAUDE.md` only and **Project instructions** doesn't appear in `/config`: a version before v2.1.277; a session that doesn't fetch feature flags from Anthropic, such as Amazon Bedrock or another third-party provider or with telemetry disabled; your first session after installing or upgrading; and setting `disableAllHooks` or `allowManagedHooksOnly`, or disabling the built-in `agents-md` plugin. Import `AGENTS.md` from a `CLAUDE.md` in those environments.

For how the three tools' context files relate, see [CLAUDE.md vs AGENTS.md vs GEMINI.md](https://aicoding-guide.com/en/posts/context-files-comparison/).

A 2.1.275 regression made **every request fail with `400 … Input tag 'advisor_20260301'`** when `ANTHROPIC_BASE_URL` points at a proxy or gateway. 2.1.276 fixes it. If that describes your setup, upgrading is mandatory.

`ctrl+enter` (or `ctrl+x ctrl+s`) interrupts the current turn and sends all queued messages at once`syncClaudeAiSkills: false` or `syncClaudeAiPlugins: false`
`/plugin install <plugin> --marketplace <source>` offers to add the marketplace before installing
Last week this digest reported that Read and Edit deny rules failing to apply on a line containing `env -C` or `eval` had been fixed. That **2.1.268 change was reverted in 2.1.273**. The changelog reads: "Reverted a 2.1.268 change that checked Read and Edit deny rules on Bash lines the permission checker can't analyze". Commands like `time -p make build` prompt again rather than being denied.

Permission fixes did land in the same release, though:

`permissions.blockReadsOutsideWorkingDirectories`, and a subshell hiding a dangerous `rm` in bypass mode
The first one bears directly on protecting `.env` with deny rules — see [Stop Claude Code reading your .env with a Read deny rule](https://aicoding-guide.com/en/posts/claude-code-deny-read-env/). For compaction thresholds, see [autoCompactWindow](https://aicoding-guide.com/en/posts/claude-code-autocompact-window/).

`timeout` set`CLAUDE_CODE_MCP_STARTUP_WAIT_MS` to bound how long the first non-interactive turn waits for connecting MCP servers (`0` means don't wait)`http` that only speak legacy HTTP+SSE failing to connect when they answer the first request with 422 or another 4xx
For MCP configuration, see [Adding MCP servers to Claude Code](https://aicoding-guide.com/en/posts/claude-code-mcp-servers-setup/).

`allowed_domains`` omitClaudeMd``--agents` JSON lets custom and plugin subagents run without user, project and local `CLAUDE.md` files. Managed policy files still load`fmt` and `column` after an unrecognized option, shell variable declaration flags misrepresenting the command, and commands with two directory changes`/voice` conversations`/experimental` on supported builds
On the fixes side, Windows-process escapes from restricted WSL sandboxes are now blocked, and brokered shell snapshots were hardened against credential exposure.

New local TUI sessions leave reasoning summaries disabled by default again, fixing request rejection by providers that do not support them. Explicit reasoning-summary settings are still respected.

For how approvals and the sandbox interact, see [What does Codex --full-auto actually do?](https://aicoding-guide.com/en/posts/codex-full-auto/).

Nearly every line in the release notes is a security fix.

| Area | Change | 
|---|---|
| Web fetch | Improved destination validation and connection routing | 
| MCP OAuth | Enforces RFC 9207 issuer identification | 
| macOS Seatbelt | Isolates the temporary directory for the sandbox | 
| Extensions | Hardened path resolution and boundary validation; prompts for consent on environment changes and sanitizes runtime-altering environment variables | 
| chrome-devtools-mcp | Removed a hardcoded Google CrUX API key | 
| Workspace boundaries | Stronger boundary checks and symlink resolution in command safety and file discovery | 
| System config | Strict permission and ownership checks on system-wide configuration paths | 
| Windows | Mitigates NTFS 8.3 short name (SFN) paths | 

**Glossary**

**NTFS 8.3 short names**: the `PROGRA~1`-style aliases Windows generates for long filenames. Because the same file can be reached by a second spelling, they are a route around path checks.

`AGENTS.md` and no `claude-md-and-agents-md` if you want both`eval` or `env -C` lines, revisit that assumption for 2.1.273 and later`syncClaudeAiSkills` and `syncClaudeAiPlugins` to `false`
`claude-md-or-agents-md`; change `/config` to load both