Changelog — September 19, 2026

AGENTS.md is now a first-class instruction file. v2.1.277: "in a project with no CLAUDE.md, Claude Code reads AGENTS.md instead". You can change this under Project instructions in /config. It is not yet available on Bedrock, Vertex or Foundry. CLAUDE.md still takes precedence when both files exist, so nothing changes for projects that already have one. The case this helps is a repo shared between Claude Code and another harness. Until now you had to keep two copies of the same instructions in sync, or add a symlink that Windows handles badly. If you run more than one agent on the same repo, move your shared rules into AGENTS.md and keep only Claude-specific rules in CLAUDE.md.

TaskOutput is gone, which breaks anything that named it. v2.1.277 removes the deprecated TaskOutput tool. Claude now reads a background task's output file with Read. The taskOutputMaxChars setting and TASK_MAX_OUTPUT_LENGTH stop working without an error. If a permission rule, hook matcher, skill, or subagent tools: list names TaskOutput, that entry now matches nothing, and nothing warns you. Search your .claude/ directory for it. In the same release, subagent results now reach the main agent under a header that marks them as subagent output, so text inside a subagent's result can no longer pass as the session's own instructions. That closes a prompt-injection path most people were not guarding against.

Auto mode's classifier stopped costing extra. v2.1.278 changes auto mode for Claude API and Enterprise users, and on Bedrock, Vertex, Foundry and gateways, to default to the server-side classifier, which does not charge for classifier overhead. CLAUDE_CODE_AUTO_MODE_SERVER=0 opts out on the cloud providers and gateways. The client warns you when it falls back to the billed path, and a new Auto mode server row in /status shows which path a session is using. Before this, every tool call in auto mode made a second model call that you paid for. On long unattended runs that overhead could be large. Our cost guide should now treat auto mode as close to free on these plans.

A proxy regression again, but fixed within a day this time. v2.1.276 fixes every request failing with 400 … Input tag 'advisor_20260301' when ANTHROPIC_BASE_URL points at a proxy or gateway, a regression from v2.1.275. This is the second window in a row where a new tool schema passed the first-party API and failed on compatible endpoints. Last time the fix took three days; this time it took one. If you proxy Claude Code, pin a known-good version with minimumVersion/maximumVersion. Two regressions of this kind in eight days show it is a recurring risk for that setup. v2.1.277 also fixes claude update hanging when those version pins are set and a proxy returns an invalid version.

Plugins got a test runner. v2.1.269 adds claude plugin eval, which runs a plugin's eval suite against Claude Code and returns scored, reproducible results as JSON plus an HTML report. It is the first built-in way to check that a skill or plugin still does what it claims after a model or harness update. v2.1.271 adds --accept-command to claude plugin install/update, which accepts exactly the command an earlier --json run displayed. That lets scripts install plugins without a blanket -y. v2.1.275 syncs the skills and plugins enabled on your claude.ai account to terminal sessions (turn it off with syncClaudeAiSkills: false / syncClaudeAiPlugins: false) and adds /plugin install --marketplace.

Sandboxing and security. v2.1.271 adds per-command allowed_domains for Bash, PowerShell and Monitor in sandboxed auto mode. The hosts a command needs are reviewed with that command and opened for it alone, and every other host is refused. It also adds omitClaudeMd to agent frontmatter, so a subagent can run without user, project and local CLAUDE.md files. Managed policy files still load. v2.1.273 closes two permission bypasses: Bash commands the checker cannot fully analyse skipped the prompt under blockReadsOutsideWorkingDirectories, and a subshell could hide a dangerous rm in bypass mode. It also fixes managed MCP restrictions (allowManagedMcpServersOnly, deniedMcpServers) being ignored when MDM and server-managed settings were both present. The same release reverts a v2.1.268 change, so commands like time -p make build prompt again instead of being denied.

Everything else, briefly. v2.1.275 adds a send-now key (ctrl+enter, or ctrl+x ctrl+s), which interrupts the current turn and sends all queued messages at once. v2.1.269 adds /output-style [name], including over Remote Control and in headless sessions, and CLAUDE_CODE_WORKFLOW_MAX_CONCURRENT_AGENTS (1–256). v2.1.271 brings fast mode to Remote sessions and allows a modelPricing multiplier up to 10 for internal chargeback rates. v2.1.273 lets you fork a Remote Control session from the Claude app into a background session on your computer. v2.1.274 adds CLAUDE_CODE_MCP_STARTUP_WAIT_MS and a critical-memory warning. It also self-heals sessions that got stuck retrying "unexpected tool_use_id", and fixes Streamable HTTP MCP calls timing out at about 5 minutes regardless of the configured timeout. v2.1.277 makes claude -p and Agent SDK sessions exit with code 1 after an internal error instead of hanging, and strips invisible Unicode tag characters from prompts. Several fixes improve prompt-cache reuse: a memory file's age note changing, /login dropping thinking, and resume after an output-token cutoff.

Full changelog → Affects: /openclaw/, /openclaw/configuration/, /openclaw/security/, /openclaw/cost-optimisation/, /openclaw/skills-guide/, /claude-cowork/

A correction first: we had not been tracking OpenClaw's own releases. Our release feed for OpenClaw was the Claude Code feed, so the 2026.8.1 rebuild that OpenClaw calls "OpenClaw 2.0" and the whole 2026.9 series never produced a changelog entry. From today we poll openclaw/openclaw releases directly. Our video review of the 2.0 upgrade covers what broke at the time.

2026.9.5 (Sept 19) makes updates atomic. The new version is verified before OpenClaw switches to it, a failed change rolls back, and the last working configuration is preserved. The 2026.9 series also bounds untrusted response bodies from bundled providers and channel adapters and rejects oversized inputs. Other additions: guided specialist teams (a chief of staff, researcher, writer and reviewer created by the setup wizard; openclaw agents list finds an incomplete team and openclaw onboard --workspace <workspace> finishes it offline), plugin hot reloading without a Gateway restart, read-only conversation sharing, archiving, cited sources (up to eight pages) on researched answers, a Systems workspace for your machines, FreeBSD CLI support, and openclaw migrate plan to preview a migration before applying it. Fresh OpenAI setups now default to GPT-6 Astra. The new tools.alsoAllow setting adds tools explicitly, still subject to group restrictions.

2026.9.1 is the one to read before upgrading from 2.0. openclaw memory reset discards rebuildable index data while keeping sessions and transcripts, which is the first thing to try when memory recall goes wrong after an upgrade. openclaw doctor --fix now preserves agent knowledge paths and session-memory choices, and imports large Memory Core event logs in resumable batches. migrate apply claude --overwrite backs up the target skill directory before overwriting it. Security: managed llama.cpp archives are confined to the install tree; a mismatch between the CLI and Gateway state directories is blocked before any guarded write; an incomplete exec-approval repair now halts the Gateway instead of continuing; and unresolved plugin consent blocks an update from finishing. Doctor also flags legacy WhatsApp acknowledgement settings that can't survive migration exactly. NemoClaw's managed runtime moved to 2026.9.1 this week.

Releases → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/troubleshooting/

You can now compact a conversation yourself. Since September 14, the Messages API accepts a top-level compaction parameter behind the compact-2026-09-04 beta header. It returns a signed compaction block that summarises the earlier messages. Before this, compaction happened when the API decided to do it. Now your own harness can compact at a point that suits it, such as between tasks, before a long tool run, or before handing work to another agent, instead of partway through a step. Anyone building their own agent loop has been writing this summarisation step by hand; now they don't have to.

Apps and compliance. On September 15, Claude apps launched Salesforce in Claude (beta), a plugin that brings accounts, opportunities and pipeline into Claude with 37 pre-built sales skills. On September 18, the Compliance API's local session endpoints began returning Claude in Chrome transcripts (product_surface: claude_in_chrome) in beta for Enterprise. Browser-agent sessions are now in the audit trail alongside chat and Code. Before this, they were the one surface that wasn't.

Release notes → Affects: /claude-cowork/, /claude-cowork/vs-api/, /claude-cowork/skills-guide/

A quiet window for OpenAI, with one control worth enabling. On September 15, administrators got API key creation governance at organisation and project level. You can allow only service-account keys, allow only user-owned project keys, or disable new key creation entirely. Organisation rules override project settings, and existing keys are not affected. Together with the key expiration dates from September 10, you can now require short-lived service-account keys across an organisation. That removes the most common way agent credentials leak: a personal key pasted into a config file and never rotated.

Changelog → Affects: /chatgpt/teams/, /chatgpt/api-vs-chat/, /security/

KiloClaw is out of the editor. v7.7.3's only major change: remove KiloClaw. That covers the VS Code chat panel and sidebar button, the /kiloclaw TUI command and chat view, the Kilo Chat client and token handling, and the kilo.claw.status and kilo.claw.chatCredentials gateway endpoints. The release note removes the client. It says nothing about the hosted KiloClaw service that our KiloClaw videos covered (Slack summaries, inbox triage, meeting research), so check Kilo's own channels before assuming those automations still run. If a workflow of yours called /kiloclaw or depended on those gateway endpoints, it stops at 7.7.3.

The rest of the 7.7 line. v7.7.1 replaces Auto-Collapse Reasoning with a Reasoning Blocks setting (Expanded, Preview, Headline). Existing auto_collapse_reasoning: true configs map to Preview. v7.7.2 accepts any OpenAI-compatible transcription API for voice input instead of requiring Kilo Gateway, and moves the marketplace into the CLI backend so every editor shares it. v7.7.3 shows ChatGPT Codex quota next to other provider usage. v7.7.4 adds a fullscreen Mermaid viewer and a dialog for cleaning up leftover worktree folders that shows their size. v7.7.5 lets the Agent Manager's New Worktree prompt take @model, @past-chats, @worktrees, and slash commands, including /goal, so a new worktree can start with its objective already set. v7.7.0 was a pre-release with drag-to-mention and the ability to post inline PR review comments to GitHub.

Releases → Affects: /kilocode/, /kilocode/setup/, /kilocode/orchestrator/

If your Hermes sessions broke after 0.21.0, update to v0.21.2 or later. v0.21.0 rewrote the session store's connection handling. On some installs that made state.db fragile: second writers cancelled each other's locks, healthy databases were reported as corrupt, and one bad row could break sessions list. v0.21.2 fixes the root causes over six PRs, closing 44 issues. Profile gateways no longer write hosted-room state into the root database every five seconds (that state now lives in shared-state.db). The dashboard opens read-only first. Cron's lifecycle guard no longer does a raw open() on a live database, which cancels the gateway's POSIX locks. And doctor --fix now refuses to checkpoint unless it can prove no live process holds the database. Unlike v0.21.1, this patch lists what it changed.

v0.21.3 exists for Cloud users. It rolls up about 338 PRs into a tagged release so the remote-gateway sign-in fixes reach Hermes Cloud agents, which auto-update to the newest release tag. The main fix: remote dashboard sessions no longer expire during bursts of refreshes. Self-hosted users get it with hermes update.

Releases → Affects: /hermes/, /hermes/troubleshooting/, /hermes/dashboard/, /hermes/memory/

The managed runtime moved two OpenClaw releases forward. #11105 updates the bundled OpenClaw from 2026.7.1 to 2026.9.1, with reviewed dependency pins and end-to-end qualification. #12057 lets NemoClaw export a managed Deep Agents sandbox as nemoclaw.nvidia.com/v1alpha1. Config export is still refused for attached-Ollama and managed-vLLM rosters, and the PRs say so plainly rather than emitting partial YAML.

Two fixes that prevent data loss. #10489 checks the Microsoft Teams webhook port before a rebuild. Previously, channels add teams followed by a rebuild deleted the sandbox and then failed to recreate it if another process was using the port. #12074 makes onboarding-lock contention report the holder's PID, start time and command, instead of a bare internal error. The team QA'd it against shipped v0.0.127. Also: leading-zero port overrides like 08000 are now rejected, Hermes API ports are limited to 8642–8652, and N1x local-vLLM sessions keep a usable prompt budget during slow compaction.

Commits → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/