This Week in Coding Agents: September 28, 2026

Week 40, 2026 · Published September 28, 2026

Claude Code	2.1.283
Codex CLI	0.158.0
Gemini CLI	0.61.0

The short version

Claude Code’s changelog lists 2.1.283 as the top release (September 25). npm latest is 2.1.283. 2.1.280 makes Claude Opus 5.5 (claude-opus-5-5) the default Opus model. 2.1.281 extends AGENTS.md loading to Bedrock, Vertex, Foundry, gateways, and sessions with telemetry off. 2.1.283 adds /doctor prompt-audit.
Codex CLI 0.156.0 (September 22) turns on voice and worktrees by default and adds /tui, /usage, and /daemon. 0.156.1 and 0.157.0 put GPT-6 Sol and GPT-6 Luna in the model picker. src/data/tool-versions.json records latest as 0.158.0 (September 28, tag rust-v0.158.0), which sits outside this week’s exclusive-until window.
Cursor has no version number. The September 23 changelog entry is Rollouts and Security Review: two Teams and Enterprise bots, one for deploy health and one for exploitable bugs on pull requests.
GitHub Copilot has no version number. Claude Opus 5.5, GPT-6 Sol, GPT-6 Luna, and Grok 4.7 landed in Copilot. The Copilot app got local sandboxing and OpenTelemetry. Business and Enterprise get a global default-features policy that takes effect on October 22.
Gemini CLI 0.61.0 shipped on September 23. The notes I read are prompt-injection and sandbox hardening, not a new model. Nightly and v0.62.0-preview.0 tags sit above it.

Claude Code

2.1.280 (September 22) through 2.1.283 (September 25). I opened the live CHANGELOG.md. The first heading is 2.1.283. The npm latest document is 2.1.283. I also opened the memory docs and the same page on code.claude.com.

2.1.283 (September 25). /doctor prompt-audit (also /checkup prompt-audit) audits CLAUDE.md, CLAUDE.local.md, AGENTS.md, plus rules, skills, commands, subagents, and output styles under .claude/ and ~/.claude/ for older-model prompting, stale paths, stale commands, and contradicting files. The memory page says it needs 2.1.283 or later and runs through the bundled /claude-api skill. New managed settings: availableModelsMatch ("exact" pins an availableModels entry to that version) and deniedModels (blocks a model even when availableModels allows it). Opt in to x-claude-code-prompt-id on gateway hint headers with CLAUDE_CODE_GATEWAY_HINT_HEADERS=1. MCP tool, WebFetch, and WebSearch outputs join the tool.output OpenTelemetry span event when OTEL_LOG_TOOL_CONTENT=1. The Claude apps gateway gets load_test_mode and a mantle Bedrock upstream. Interactive sessions on a third-party provider or with telemetry off start in auto mode when no permission mode is set; permissions.defaultMode still wins. 2.1.283 reverts a 2.1.282 reservation of the claude-ai name, so skills, commands, workflows, and MCP server skills so named load again.

2.1.282 (September 24). maxProseWidth caps prose width in wide terminals; tables and code blocks keep the full width. /status and claude doctor list telemetry variables in a project’s settings files that were ignored or that turned telemetry off. allowClaudeInChromeWithManagedMcp lets claude --chrome run next to an exclusive managed-mcp.json. Project and local settings now ignore OpenTelemetry variables that turn on export, set an endpoint, or capture content, such as CLAUDE_CODE_ENABLE_TELEMETRY and OTEL_LOG_*. Auto mode uses the server-side classifier by default on a direct Anthropic API connection when telemetry is off (CLAUDE_CODE_AUTO_MODE_SERVER=0 opts out). sandbox.excludedCommands from project and local settings is ignored when managed settings or --settings set allowUnsandboxedCommands: false, or managed allowManagedDomainsOnly: true. A mistyped boolean lock key such as allowManagedPermissionRulesOnly now applies and startup names the key.

2.1.281 (September 23). The changelog line I read: AGENTS.md support now also works on Amazon Bedrock, Google Vertex AI, Microsoft Foundry, LLM gateways, and sessions with telemetry disabled. The memory page matches that: before 2.1.281 those sessions read CLAUDE.md only. The default is still claude-md-or-agents-md: Claude reads AGENTS.md when there is no CLAUDE.md, .claude/CLAUDE.md, or CLAUDE.local.md in the working directory or above it. A user ~/.claude/CLAUDE.md and a managed CLAUDE.md do not block AGENTS.md. /config can switch to claude-md-and-agents-md, claude-md, or managed-only. Direct AGENTS.md reads need 2.1.277 or later. "attribution": false in settings.json hides all commit and PR attribution; older CLIs skip a settings file that holds the boolean, so keep the object form in files shared across versions. claude plugin validate now reports .mcp.json entries that would be dropped at load, undeclared ${user_config.*} references, and insecure URLs. A recursive rm whose target is only command-substitution output, such as rm -rf "$(pwd)", now asks even with a Bash allow rule in auto and --dangerously-skip-permissions (CLAUDE_CODE_DISABLE_SUBSTITUTION_RM_PROMPT=1 skips the extra prompt). The dangerous-rm prompt in those modes waits 2 minutes, then denies so an unattended session can continue (CLAUDE_CODE_DISABLE_DANGEROUS_RM_TIMEOUT=1 turns the timeout off). --setting-sources now reaches teammates, /bg, claude agents sessions, and --worktree --tmux. Self-hosted runners that wrap with --system-prompt or --append-system-prompt must switch to --system-prompt-file or --append-system-prompt-file.

2.1.280 (September 22). Claude Opus 5.5 (claude-opus-5-5) is the default Opus model. The changelog lists 1M context, $4/$20 per Mtok, and $0.20/Mtok cache reads. CLAUDE_CODE_MAX_MCP_DESCRIPTION_LENGTH changes the 2,048-character cap on MCP tool descriptions and server instructions. Writes through a symlink are judged by where they land: acceptEdits, allow rules, and auto mode no longer approve a write that lands outside. Skills in ~/.claude/skills/ are no longer moved to ~/.claude/skills/.trash/ when a manifest.json in that folder listed their names.

Codex CLI

0.156.0 (September 22) through 0.157.1 (September 26) sit in this week’s window. I opened each release page. The releases list shows 0.158.0 as the current stable tag (rust-v0.158.0, September 28) and 0.159.0-alpha.* prereleases above it. The fetch window is half-open and excludes today, so 0.158.0 is latest in tool-versions.json and not in the week’s release list.

0.158.0 (September 28, outside the window). Fullscreen TUI copy-on-select and right-click paste, with Markdown kept on copied transcript selections. codex mcp add --oauth-client-secret for MCP servers that need a pre-registered OAuth client secret. Exec-server WebSocket connections can use bearer tokens, including through app-server. Image generation can request a transparent background. Terminal input approval is on by default for commands running with elevated permissions.

0.157.1 (September 26). The release page has no feature list. The chores note says highlights could not be determined because the PR index was empty and the GitHub tag comparison returned 404. Full changelog: rust-v0.157.0...rust-v0.157.1.

0.157.0 (September 25). GPT-6 Sol and GPT-6 Luna, including Amazon Bedrock and migration prompts for older models. Fullscreen transcripts are on by default, with Shift-click to extend a text selection. Eligible interactive sessions start the background server automatically, with recovery choices when server settings do not match. f forks a conversation that is open in another app and keeps drafts and queued prompts. /import works in remote sessions and local background-server sessions. File uploads retry transients and the upload timeout is five minutes. Network restrictions now follow redirects and live HTTP and WebSocket traffic, and cancel when policy revokes access.

0.156.1 (September 23). Hotfix of 0.156.0. Choose GPT-6 Sol or GPT-6 Luna from the model picker. The rate-limit switch prompt now recommends GPT-6 Luna.

0.156.0 (September 22). /tui picks an optional fullscreen UI for the next launch, with transcript search, mouse selection, and right-click copying. Voice is on by default: F8 toggles it, /voice settings picks a voice, and Linux and Windows bundle audio runtimes. /usage is an analytics dashboard for account usage, token totals, and plugin and skill activity. Worktree support is on by default; the agent command center can filter tasks by status and create worktree sessions. Six new themes, plus Mermaid diagrams and display equations in responses. /daemon updates the local background server; --no-daemon bypasses it. Deprecated friendly and pragmatic personality settings no longer select response styles. ? in network proxy allow and deny patterns matches a single character. Sandbox notes on that page: inbound Windows connections, privileged Linux and macOS sockets, and writes through read-only macOS file handles.

Cursor

No version number. I opened Rollouts and Security Review (dated September 23, 2026 on the changelog index).

Both bots are on Teams and Enterprise. Enable either from the automations tab.

Rollouts. Attaches a monitor to every pull request and reports change health per environment: verified healthy, regression detected, or inconclusive. Connect source control (Origin or GitHub), your deploy system, and a telemetry provider such as Datadog. On PR open it writes a monitoring plan as a comment; you can edit the plan. On deploy it runs that plan against logs, metrics, and traces, per environment. A regression names the change and notifies the author. It can open a revert PR or hand the finding to a cloud agent. The page says it does not merge or roll back on its own. Feature flag integration is “coming soon.” The page offered usage credits for the next 10 days from September 23 (about 50 changes on Teams, 500 on Enterprise).

Security Review. Reads every pull request in the context of the codebase and posts one review comment for exploitable bugs. Style and quality stay with Bugbot. Draft PRs are skipped. It looks for injection (SQL, command, template), auth bypasses including checks a refactor stopped running, secrets in source, SSRF and unvalidated redirects, unsafe deserialization, and dependency changes with known vulnerabilities. Each finding has a severity, an attack path, and a proposed fix. Dismiss with a reason and it will not raise that finding again on that PR. Team rules (for example which client external calls must go through) are enforced on every PR.

GitHub Copilot

No version number. I opened each changelog URL below.

Enterprise managed settings in-product validator (September 25). Finds malformed JSON, unsupported configurations, and invalid team mappings that can stop policies from applying. Review issues under “Copilot settings validation” on the enterprise AI controls page. Coverage: copilot/managed-settings.json, copilot/team-mappings.json, and team settings files those mappings point at. After a fix, commit to the default branch of .github-private, reload the Agents page, and re-check.

Usage metrics API adds pull request review stages (September 25). Enterprise and organization repos-1-day rows gain pull_request_review_times: median and p90 minutes from ready-for-review to first review, first to final review, and final review to merge. Only human-opened, human-reviewed pull requests that merged that day count. Copilot code review, other bots, and the author do not start the clock. No backfill. Pull requests that became ready before September 21, 2026 are left out of this array. A quiet day is [], not zeros. Access matches existing Copilot usage metrics (policy on; owners, billing managers, and View Copilot Metrics).

Agentic autofix now uses Copilot Memory (September 25). If you have Copilot Memory on, agentic autofix reads existing memories when it works a security alert and stores the fix pattern for later. Both features are public preview.

Weekly releases, September 21 (September 25). New models: Claude Opus 5.5 on Pro+, Max, Business, and Enterprise; GPT-6 Sol on the same set; GPT-6 Luna and Grok 4.7 on Pro and up. Copilot app: local sandboxing (public preview) and OpenTelemetry through enterprise-managed settings. Slack and Teams: switch models mid-conversation and keep the choice for the thread; Slack can set channel defaults; Copilot checks for similar issues before opening a new one. JetBrains: assisted approvals (public preview), rewind on re-edit, shared org and enterprise skills. VS Code 1.139: agents in Dev Containers on SSH, Tunnel, and WSL hosts (rolling out); Compact View and session rename in the session list; preview layout for a single active-chat view.

Updates to Copilot for Slack and Microsoft Teams (September 25). Public preview for Copilot Business and Enterprise. Slack: supported files, attachments, and message links as context. Teams: inline images, forwarded-message context, and channel and thread history. Copilot checks for similar issues, links the resulting work, and keeps a link back to the originating conversation. Slack can set default owners and repositories. Admins must enable the Copilot cloud agent policy (Teams also needs cloud sandboxes). Usage counts against existing Copilot entitlements and cloud agent budgets.

Default enablement of Copilot features for Business and Enterprise (September 24). New “Default policy for new features” on the AI Controls Copilot page: Enabled, Disabled, or Let organizations decide. You can set it now. It does not change access for 28 days. On October 22, eligible generally available features left Unconfigured follow that default. Explicit enable or disable stays. Preview features stay opt-in.

More ways to request and configure Copilot code reviews (September 23). Generally available on every Copilot plan: a personal code review page under profile Copilot settings for automatic review (new PRs, coauthored PRs, leaving draft), automatic review on new pushes and drafts, and a default effort (Lite or Balanced). Enterprise admins can set a default effort (Lite, Balanced, or GitHub default) for organization-owned repositories. Orgs and repos can still override.

Local sandboxing in the GitHub Copilot app (September 23). Public preview, off by default. Per-project filesystem, network, and credential policy for local repository and working-tree sessions. Enable “Sandbox new sessions” in the project settings, or /sandbox on for the current session. If the OS cannot enforce the requested policy, the sandboxed shell errors instead of running unsandboxed. Does not apply to cloud sandbox or remote-host sessions. Copilot app and Copilot CLI sandbox settings are separate. Enterprise-managed settings can tighten the effective policy.

OpenTelemetry in the GitHub Copilot app (September 22). Set the telemetry property in enterprise managed-settings.json. Prompt and response content is excluded by default.

New features in Copilot for JetBrains (September 22). Plugin 1.18.0. Assisted approvals (public preview): low-risk tool calls auto-approve, higher-risk still prompt. Re-edit an earlier message and Copilot rewinds conversation and file changes. Org and enterprise skills plus org-managed custom instructions work in local and Copilot agent sessions. Codex agent plan mode. A setting toggles the built-in GitHub MCP Server without touching manually configured servers (still on by default). Inline chat is hidden in JetBrains Gateway and remote development. JetBrains IDE 2025.1 gets an upgrade notice toward 2026.1; support is unchanged in this release.

Gemini CLI

0.61.0 (September 23). I opened the v0.61.0 release. The releases list shows that tag as the current stable release. Nightly tags and v0.62.0-preview.0 sit above it.

Notes I saw: preserve explicit versioned Flash model IDs; block indirect prompt injection through build file modifications and untrusted flags; harden sandbox filesystem boundaries and isolate runtime state; keep AgentLoopContext properties across object spread. No new model name appears on that page.

What this means for your setup

One AGENTS.md, every tool, Instruction files, New repo agent setup, and Context is a budget still say Claude Code reads CLAUDE.md and needs a one-line @AGENTS.md bridge. The memory page I opened today says 2.1.277+ reads AGENTS.md when there is no project CLAUDE.md, and 2.1.281 extends that to Bedrock, Vertex, Foundry, gateways, and telemetry-off sessions. Refresh those pages. You can drop an empty bridge CLAUDE.md on 2.1.281+, or keep the import if you also have Claude-only notes or a CLAUDE.local.md (that file blocks AGENTS.md unless Project instructions is claude-md-and-agents-md).
Run /doctor prompt-audit after 2.1.283 if your CLAUDE.md or AGENTS.md still talks to older models. Your AGENTS.md is too long and Agent config audit do not name that command.
Multi-model routing still prices Opus 5 at $5/$25 and talks about GPT-5.6 Sol and Luna. This week’s changelog puts Opus 5.5 at $4/$20 with $0.20/Mtok cache reads, and Codex plus Copilot now ship GPT-6 Sol and GPT-6 Luna.
Codex /usage is the analytics dashboard as of 0.156.0. Context is a budget said there was no Codex /cost equivalent on the pages I had then. Worktrees are on by default; --no-daemon skips the background server; /tui is the fullscreen switch. Voice is on by default (F8, /voice settings) if you do not want a hot mic.
If you still start unattended Claude Code with --dangerously-skip-permissions, 2.1.281 will pause on rm -rf "$(pwd)" even when a Bash allow rule matches, then deny after two minutes so the job can continue. Permissions and unattended runs and Unattended agents in CI do not name CLAUDE_CODE_DISABLE_SUBSTITUTION_RM_PROMPT or CLAUDE_CODE_DISABLE_DANGEROUS_RM_TIMEOUT. The --bare, --permission-prompts none, dontAsk, and codex exec --sandbox workspace-write --ask-for-approval never flags I re-checked on those pages still match what they stated.
Third-party or telemetry-off Claude Code interactive sessions now start in auto mode unless permissions.defaultMode is set (2.1.283). Set the mode if you do not want that.
Copilot Business and Enterprise admins: set “Default policy for new features” before October 22 or Unconfigured GA features will follow the default you leave. Turn on local sandboxing per project if you want filesystem, network, and credential limits in the Copilot app. Use the in-product validator on copilot/managed-settings.json before you rely on a new policy.
Cursor Teams and Enterprise: enable Rollouts and Security Review from the automations tab if you want deploy monitors and a security-only PR comment. That is a new surface. It does not change a command on the Cursor playbook (that page is still a draft).

Pages we updated this week

None this week.