Claude Report — 2026-09-21
- Claude Code ships two releases in two days: v2.1.277 adds AGENTS.md support, v2.1.278 defaults auto mode to server-side classifier billing.
- Anthropic and Accenture each commit $1B+ over five years to embed independent evaluators inside Anthropic, per Dario Amodei's "pace the frontier" pledge.
- Plugin4Shell, a zero-click flaw letting repo owners swap pinned plugin code via hash-shaped Git branch names, hits Claude Code, Codex, Copilot and Gemini CLI; Anthropic ships a fix.
- MCP ecosystem stays busy: chrome-devtools-mcp preps an SDK v2 refactor, codebase-memory-mcp lands new merge/freshness fixes, oraios/serena patches C# and Kotlin language backends.
- Compliance API extends session-transcript retrieval to Claude in Chrome for Enterprise orgs (beta).
🚀 Anthropic Official
Partnering with Accenture on embedded evaluation (Sep 18)
Commits Anthropic and Accenture (led by Faculty, Accenture's AI unit) to at least $1B each over five years building an embedded-evaluator function that red-teams models, runs alignment assessments and tests safeguards from inside Anthropic; the arrangement is non-exclusive, with talks underway with METR and other nonprofit evaluators.
Claude Code v2.1.277 (Sep 18)
Adds AGENTS.md as a fallback project-instructions file when no CLAUDE.md exists (configurable in /config), adds gateway proxy support via CLAUDE_GATEWAY_PROXY_IS_EGRESS_BOUNDARY=1 and an optional headers: map on gateway upstreams, and fixes crashes on slow machines, rare screen-rendering errors, and Windows tool-execution crashes among 100+ other bug fixes.
Claude Code v2.1.278 (Sep 19)
Defaults auto mode to the server-side classifier for Claude API/Enterprise, Bedrock, Vertex, Foundry and gateway users so classifier overhead isn't billed; adds CLAUDE_CODE_AUTO_MODE_SERVER=0 to opt out, a billed-fallback warning, and an Auto mode server row in /status.
claude-agent-sdk-typescript v0.3.277–v0.3.278 (Sep 18–19)
Adds a builtin field on SlashCommand, pasted_content on SDKUserMessage, remote-session latency fields, and a 'userSettings' updateSettings() source; fixes resumed/forked sessions reporting cost and usage totals starting at zero instead of continuing prior turns, then syncs to Claude Code v2.1.278.
claude-agent-sdk-python v0.2.156 (Sep 18)
Bundles the Claude CLI forward to v2.1.276, trailing the TypeScript SDK and CLI itself by one to two point releases.
Compliance API adds Claude in Chrome session transcripts (Sep 18)
Extends the Compliance API's local-session endpoints to return transcripts from Claude in Chrome sessions under a new claude_in_chrome product-surface value, in beta for Claude Enterprise orgs using the existing Compliance Access Key scope.
🔌 Claude Code Plugins
Plugin tracking skipped this run — official marketplace install-count cache unavailable.
🛠️ Skills
addyosmani/agent-skills
Merges a skill-local security-and-hardening reference split out of SKILL.md, adds hook regression coverage plus a bash 5.2 fix for the simplify-ignore path, reuses shared fence parsing in the reference-link validator, clears stale grading and records run identity in evals, and adds reference-led UI finish checks to frontend-ui-engineering (Sep 18–20).
Unchanged in window: eugeniughelbur/obsidian-second-brain (vault-plugin-coexistence fix already reported Sep 18–20), cloudflare/security-audit-skill (last real commit Sep 14), K-Dense-AI/scientific-agent-skills (only a CODEOWNERS update Sep 18), tt-a1i/archify, ayghri/i-have-adhd, affaan-m/ECC (only automated scan-report commits), agentskillexchange/skills.
🤖 Agents & Subagents
nicobailon/pi-subagents v0.70.1
Fixes delegated read-only tasks reporting false failures, applies configured model preferences to runtime-added agents, and surfaces each workflow child's resolved model settings in status output (Sep 21) — a same-week follow-up to v0.70.0's child-extension access controls (Sep 20).
Unchanged in window: VoltAgent/awesome-claude-code-subagents (only a README edit Sep 21), anthropics/commerce-agents (no commits since Aug 31).
🔗 MCPs & Integrations
DeusData/codebase-memory-mcp
Ships new fixes beyond last week's memory/spill race fixes: a shared argument-string release point for handle_index_repository, a worker-scope test correction, resource-discovery and freshness-merge-loss merges, and a dotnet XML-extensions fix (Sep 20–21).
ChromeDevTools/chrome-devtools-mcp
Opens a "prepare for SDK v2" refactor (#2771) alongside a BrowserManager extraction (#2787), fixes a WaitForHelper timeout (#2772) and cumulative page-title timeouts (#2775), preserves element identity across renderer changes in snapshots (#2788), and removes daemon pid-file polling for a perf win (#2774) (Sep 18–21).
oraios/serena
Fixes tuple-typed C# properties losing their name to the method branch and updates the managed Kotlin LSP to build 263.4702.0 (Sep 21), on top of last week's MCP SDK v2.2.0 upgrade and LanguageBackendRegistry work.
upstash/context7
Documents Docs7 login/deployment commands, fills in required quickstart docs.json fields, clarifies CLI site retention on the Free tier, and drops a stale theme field from the quickstart config — four doc-only commits (Sep 18–21).
Unchanged in window: github/github-mcp-server (last commit Sep 16), modelcontextprotocol/ext-skills (only a CODEOWNERS update Sep 18).
💡 Community — Workflows & Ideas
No relevant news today.
📰 Quick Mentions
- Plugin4Shell hits Claude Code, Codex, Copilot and Gemini CLI — AIR Security discloses a zero-click flaw exploiting Git's hash-shaped branch names to swap pinned plugin code past version locks; Anthropic ships a fix, Google leaves Gemini CLI unpatched as deprecated (Sep 18).