Claude Code 2.1.277-278: AGENTS.md, sandbox gap closed, server-side auto mode

Claude Code 2.1.277 and 2.1.278, released September 18 and 19, 2026, read like two very different releases. 2.1.277 packs roughly a hundred fixes: three of them harden Claude Code against prompt injection, one closes a real Bash sandbox bypass, and one changes which file Claude Code reads by default for project instructions. 2.1.278, out the next day, ships exactly one change, but it hits your bill directly if you're on the Claude API, on Enterprise, or behind Bedrock, Vertex, or Foundry. Here's what matters.

AGENTS.md: one less file to write

As of 2.1.277, Claude Code reads an AGENTS.md file as project instructions, the same way it reads a CLAUDE.md. The memory docs put the point plainly: "a repository already set up for other coding agents works without adding a CLAUDE.md, an import, or a setting." If your repo already has an AGENTS.md for another coding agent, Claude Code uses it directly.

The default behavior is worth reading twice: Claude only reads AGENTS.md when no CLAUDE.md, .claude/CLAUDE.md, or CLAUDE.local.md exists in your working directory or above it, that last one included even if it only holds your own personal notes. Not counted for that check, and still loaded alongside AGENTS.md: your ~/.claude/CLAUDE.md, your organization's managed CLAUDE.md, and your .claude/rules/ files. You change this under "Project instructions" in /config: the default claude-md-or-agents-md, claude-md-and-agents-md to load both every time, claude-md to never read AGENTS.md, or managed-only to stick to your organization's managed CLAUDE.md alone.

Two real limits: direct AGENTS.md reading isn't available on Bedrock, Vertex, or Foundry, nor in a session without Anthropic's feature flags, telemetry turned off included, so you import it from a CLAUDE.md with @AGENTS.md instead. And an AGENTS.md loaded this way doesn't show up in /memory or in Memory files under /context: to confirm it was read, look for AGENTS.md loaded at session start.

Security: three new layers against prompt injection

Three separate 2.1.277 fixes target the same risk: text Claude reads, that you didn't write, passing itself off as a legitimate instruction.

The first cleans the prompt itself: invisible Unicode, formatting, and tag characters are stripped before the prompt is sent, and the cleaned version is shown for review. The second strengthens a protection in place since 2.1.210, subagent output scanning, which "inserts a backslash into text that imitates Claude Code's own output" and flags a subagent report that imitates a system tag. 2.1.277 goes further: a subagent's result now arrives under a header that marks it explicitly as such, indented, so nothing inside it can pass as an instruction from the session itself.

The third is scoped to Bedrock, Vertex, and Foundry only: prompts a workflow script computes through agent() now reach the subagent framed as script-authored text rather than a user request. On those platforms, the safety classifier could previously read that generated text as if you'd typed it yourself. The security docs frame this as context-aware analysis to catch hidden instructions: these three fixes are another layer of it, not a separate mechanism.

A sandbox exclusion that let a whole command through

The Bash sandbox confines what a command can touch, files and network, at the operating-system level. The excludedCommands setting is the deliberate escape hatch: list a command there, docker * for instance, and it runs unsandboxed because it's incompatible with isolation anyway.

The bug fixed in 2.1.277 affected compound commands chained with &&, ;, or a pipe. If just one segment matched an excludedCommands glob, the entire command ran outside the sandbox, including segments unrelated to that pattern. A rule meant to let git status through unsandboxed could end up exempting a whole git status && rm -rf /sensitive/path tacked on right after it. As of 2.1.277, every segment has to match. The sandbox docs are blunt about why this matters: without properly enforced network or filesystem isolation, "a compromised agent could exfiltrate sensitive files," exactly the scenario this bypass opened up. If you have excludedCommands configured at all, this release is worth checking.

Auto mode: the classifier moves server-side, and that changes who pays

In auto mode, a classifier reviews every shell command or network request before it runs, standing in for your manual approvals. Until now, that check always went out as a separate model request, billed like any other. 2.1.278 changes that by default on the Claude API, on Enterprise, and on Bedrock, Vertex, and Foundry: the classifier now runs server-side, folded into the current turn's own model request, at no extra charge.

The catch shows up behind a gateway or proxy that rewrites headers, drops fields it doesn't recognize, or edits responses: the server never receives the check, and Claude Code falls back to its own classifier requests, billed the same as before. The dedicated docs are clear that nothing breaks in that case: the session keeps working in auto mode, only the billing path changes, with a one-time notice per session. /status now shows an Auto mode server row telling you whether server-side checks are actually reaching this session.

If your gateway can't relay these checks, CLAUDE_CODE_AUTO_MODE_SERVER=0 goes straight to classic billing, no notice shown. Worth knowing too: on Bedrock, Vertex, Foundry, and connected Claude apps gateways, auto mode only works at all with Sonnet 5, Opus 4.7 or later, and Fable. Pro, Max, and Team plans never see this notice.

Everything else, in brief

• claude -p and Agent SDK sessions that could hang with no result after an internal error now report the error and exit with code 1.
• Conversations that failed on every request with "text content blocks must be non-empty," when an earlier assistant turn held an empty text block beside other content, including after a --resume, now work again.
• The Write tool no longer silently ends the turn as a declined permission when the target path is an existing directory; it now reports a clear error.
• Grep and Glob now return an explicit error, instead of "no matches," when a search can't even start because the system is out of processes, memory, or file handles.
• Messages typed while Claude is still working were sometimes ignored by the model; that's fixed.
• The TaskOutput tool is gone: reading a background task's output now goes through Read on its output file. taskOutputMaxChars and TASK_MAX_OUTPUT_LENGTH no longer do anything.
• Project skills weren't loading in --worktree sessions when .claude/skills was untracked by git; fixed.
• A headless resume (claude -p --resume, the SDK, a reloaded VS Code window) used to start cost and usage totals back at zero; those totals now save at exit.
• Three prompt-cache misses are fixed: resumed subagents and teammates re-rendered MCP tool definitions they'd already loaded, older attachments were re-rendered after a resume and dropped extended thinking with them, and a session continued after /clear lost part of its first message when a SessionStart hook printed output.
• One malformed entry in strictKnownMarketplaces or blockedMarketplaces used to silently disable an entire enterprise marketplace policy; a bad entry is now ignored without taking down the rest.

The bottom line

If you only take one thing from 2.1.277: prompt-injection defenses just gained three layers at once, from cleaning the prompt itself to framing subagent output, plus a real sandbox bypass closed. AGENTS.md changes a real habit if you're migrating from another coding agent, but check carefully which of your files actually wins before you rely on it. 2.1.278 needs no action on a Pro, Max, or Team plan: only a non-compliant gateway, or Bedrock, Vertex, and Foundry, keep auto mode's billing shift worth watching.