Changelog — September 11, 2026

Start with the one that lasted three days. v2.1.268 fixes "every turn failing with HTTP 400 on third-party Anthropic-compatible endpoints (ANTHROPIC_BASE_URL) since 2.1.265: a regex in the Artifact tool's input schema that those endpoints reject." Read what that means for the affected population: if you route Claude Code through a proxy, a gateway, or a non-Anthropic provider that speaks the same API, the tool was completely non-functional — not degraded, not slower, every turn failing — for three days across three releases. And the cause is a detail nobody would think to check: a schema that the first-party API accepts and a compatible-but-stricter endpoint does not. If you self-host or proxy, "compatible" is a claim about the endpoints you actually exercise, and a new tool's schema is exactly the kind of thing that quietly falls outside it.

The second regression from the same release is a lesson about inert configuration. v2.1.266 fixes a bug where the undocumented CLAUDE_CODE_USE_GATEWAY environment variable — previously ignored unless ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN were both set — began forcing Cloud-gateway sign-in on its own in 2.1.265. Setups that had it set alongside an API key, an apiKeyHelper, or custom auth headers failed every request with "Not signed in to the Cloud gateway". The fix restores the old behaviour and requires no configuration change. The general point is worth keeping: an undocumented variable that currently does nothing is not the same as one that is safe to leave lying around. It was inert by accident of a condition, and when the condition changed it became load-bearing. If you have environment variables set "just in case" from an old debugging session, this is the failure mode they carry.

Three managed settings changed from fail-open to fail-closed, and this is the security fix of the window. v2.1.267 fixes managed allowedHttpHookUrls, httpHookAllowedEnvVars and allowedChannelPlugins to admit nothing, not everything, when unreadable. An allowlist that silently becomes "allow all" the moment it cannot be parsed is worse than no allowlist, because the administrator who configured it has every reason to believe it is in force. If you rely on any of these three in managed settings, the behaviour you thought you had only started being true in v2.1.267.

Two more containment bypasses in the same family as last week's. v2.1.265 fixes a plugin path containing a backslash bypassing the symlink containment check on macOS and Linux, and v2.1.267 fixes a marketplace entry path containing a backslash bypassing the containment check for fetched marketplaces, also macOS and Linux. Same root cause both times: a backslash is a path separator on Windows and an ordinary character everywhere else, so a containment check written with one platform in mind lets the other through. This is the third consecutive window in which a path-resolution bug defeated a rule that was itself correct.

maxEffortLevel is the cost control this line has been missing. v2.1.267 adds it as a top-level setting or per-model under modelSettings, and it caps the effort level on every provider — including Bedrock, Vertex and Foundry — while still letting users pick a lower one. Until now, effort was a per-session choice with a default; an organisation could publish guidance about it but not enforce a ceiling. Given that effort level is the single biggest lever on what a run costs, a cap that holds across providers is a more useful control than most of what appears in a release note. Same release: --system-prompt-snapshot off renders the system prompt fresh on every request instead of reusing the conversation's recorded one, which is what you want while iterating on prompt text and not otherwise.

WebFetch could hang forever; now it cannot. v2.1.268 fixes WebFetch hanging indefinitely on a server that keeps the response open without finishing. A fetch now fails after 300 seconds, and CLAUDE_CODE_WEBFETCH_DEADLINE_MS overrides the deadline (0 turns it off). An unattended routine that hits a slow-loris endpoint previously had no way out at all, which is the kind of bug that looks like "the agent got stuck" and is actually a missing timeout. The same release fixes sustained high CPU from a busy loop in long-running idle sessions — relevant to anyone leaving sessions open.

Gateway operators get pricing parity and a network warning. v2.1.268 adds: with pricing: set in gateway.yaml, signed-in Claude Code clients receive the same rates through managed settings, so /cost and telemetry match the spend meter — closing a gap where the tool's own cost display and the organisation's billing disagreed. Also a startup warning when access_control.allow_cidrs is empty, plus a one-time warning the first time a request arrives from a public address, and the gatewayInternalNetworks managed setting for organisations whose own public IPv4 block should be allowed to /login. An empty allowlist that warns is a meaningful improvement on an empty allowlist that does not.

Everything else, briefly. v2.1.265 added a 1 GB cap on tool results saved to disk (the in-conversation preview now says when a saved file was truncated), --plugin-dir pointing at a folder of plugins with children picked up as they are added or removed, and user.email/user.groups in gateway telemetry. It also fixed three separate prompt-cache reuse breakages involving resumed subagents and agent teammates, and made resume-after-crash keep the interrupted tool call and mark it interrupted rather than rewriting the last prompt. v2.1.267 fixed Cowork scheduled tasks in the cloud failing at startup for organisations whose managed settings require sandboxing, resuming a transcript over 5 MB dropping parallel tool calls and hook output, and expired AWS or Google Cloud credentials retrying ten times behind a generic error before showing the real one. v2.1.268 added --json to claude plugin install/uninstall/update/enable/disable and configDirectory to claude auth status --json.

Full changelog → Affects: /openclaw/, /openclaw/configuration/, /openclaw/security/, /openclaw/cost-optimisation/, /claude-cowork/, /security/

Managed Agents gained a server-side middle ground between allow and deny. The new auto permission policy has the server evaluate each agent or MCP tool call and then run it, deny it, or pause for approval — a three-way decision made where the agent runs rather than in the client. The evaluation is visible: agent.tool_use and agent.mcp_tool_use events now report it in an evaluation field alongside evaluated_permission. That last detail is what makes this auditable rather than magical — you can reconstruct why a call was allowed after the fact, which is the part most permission systems cannot give you.

You can now attach a terminal to a running managed session. ant beta:sessions connect lets you follow a session live, send messages into it, and allow or deny tool calls from the command line; --web serves the Console's session viewer locally instead. For anyone running agents they cannot currently see into, this closes the observability gap that makes unattended sessions uncomfortable.

Smart reports are the interesting one for teams, and the framing is unusual. Launched in beta for Enterprise on September 10, they analyse how a team uses Claude and report on the work getting done, what it costs, where sessions run into friction, and which repeated patterns are worth packaging as shared skills. The first three are standard usage analytics. The fourth is not — surfacing "this pattern recurs often enough to be a skill" is a recommendation about how to organise your work, not a measurement of it, and it is the same instinct behind the skills workshops now shipping in OpenClaw and Hermes. Three vendors independently deciding that agents should mine their own history for reusable procedures is a trend worth naming.

A pricing note we checked rather than assumed. The API release notes summarise Mythos 5.1 as $50/$250 per MTok. The authoritative pricing table says $10/$50 — identical to Fable 5.1, with both models' cache hits at 0.025× base input ($0.25/MTok) against the standard 0.1× everywhere else. Our cost calculator carries $10/$50 and is correct. We are recording the discrepancy because a summary and a table disagreeing about a five-fold price difference is exactly the case where quoting the convenient one is how an error gets published.

Release notes → Affects: /claude-cowork/, /claude-cowork/vs-api/, /claude-cowork/pricing/, /tools/cost-calculator/

Three launches in three days, and the Agents API is the structural one. Announced September 10 in public beta, it supports managed sessions, durable work across turns, and custom tool and MCP server integration. That is the same shape as Anthropic's Managed Agents, which means both major vendors now offer a server-side agent runtime rather than expecting you to build the loop. The harness is roughly 80% of an agent, so a vendor offering to run it changes the build-versus-buy question for anyone currently maintaining their own.

GPT-Live 1 is priced by the minute, and that is the news. Released September 10 for full-duplex voice conversations at $0.05 per minute — not per token. A duplex voice model has no clean token boundary to bill against, so the unit changed. We are not adding it to our cost calculator, deliberately: that calculator compares per-MTok rates, and mixing in a per-minute price would produce a column that looks comparable and is not. A $0.05/minute model costs $3/hour of conversation, which is the number to hold alongside a token estimate rather than inside one.

The rest. GPT Image 2.5 Sunburst and Flare (September 8) arrive with new quality settings at GPT Image 2 token rates. Prompt Cache Diagnostics reached general availability in the Responses API on September 8 — the same class of tooling Claude Code shipped as a cache-miss reason in v2.1.260, and a sign that "why did my cache miss" has become a first-class question on both platforms. And September 10 added expiration dates on project API keys, with administrators able to enforce a maximum key lifetime at organisation or project level — a control Anthropic added in July, now matched.

Changelog → Affects: /chatgpt/, /chatgpt/pricing/, /chatgpt/agent-mode/, /chatgpt/api-vs-chat/

The pull-request loop that has been assembling for three weeks is now closed. v7.6.0 lets you ask the agent to commit and push when you send CI failures or review comments from the Agent Manager PR panel, or update a worktree from its base — so the pull request updates without a follow-up prompt. Permission prompts still confirm each commit and push, and a "Push Pull Request Fixes" setting turns it off entirely. Put beside v7.5.16's CI-failure forwarding and inline review threads, Kilo Code now has a complete cycle: CI fails, the failure goes to the agent, the agent fixes it, and the PR updates — with a human confirming each write. That is a more honest automation boundary than either extreme.

Two smaller things worth knowing. v7.6.0 adds an opt-in one-time import of global Claude Code instructions, simple skills and disabled MCP definitions — notable because it is the first migration path between agent harnesses we have seen shipped as a feature, and it lands the same week we measured how poorly skills actually port. It also adds /caffeinate with notifications explaining when Kilo keeps the machine awake, following v7.5.16's default-off Keep Awake toggle. v7.6.1 adds an @ model picker that inserts a @provider/model mention inline for Agent Manager or subagent instructions, and v7.6.2 puts the experimental Kilo Swarm shared agent board behind KILO_EXPERIMENTAL_SHARED_AGENT_BOARD.

Releases → Affects: /kilocode/, /kilocode/orchestrator/, /kilocode/setup/

A patch release containing more change than most projects ship in a year. v0.21.1 rolls up 5,139 non-merge commits across 4,364 files (+601,014 / −768,419) and 632 merged PRs since v0.21.0 eleven days earlier. The release explicitly does not attempt to enumerate what is in it, listing only areas: codebase modularization, file-operation and startup performance, provider and model updates, desktop session controls and browser annotations, MCP authorization, cron scheduling and delivery fixes, and delegation reliability. Curated notes are deferred to v0.22.0.

We are flagging the deferral rather than repeating it neutrally. This is the same pattern that ran from early August to v0.21.0, when documentation for six patch tags arrived weeks after the code. Tagging for downstream consumers is a legitimate reason to cut a release; publishing 601,000 added lines under "this patch does not attempt to enumerate" means anyone deciding whether to update is choosing between an unknown and staying behind. Update with hermes update; the net −167,000 lines suggests the modularization is real, and that is about all anyone can say from here.

Releases → Affects: /hermes/, /hermes/setup/, /hermes/tasks/, /hermes/mcp-tools/

The fix most likely to save someone a confusing afternoon rejects a placeholder. #11404 makes the Discord channel setup reject a token placeholder rather than accepting it. Accepting a placeholder means the configuration validates, the gateway starts, and nothing works — with the failure surfacing somewhere unrelated. Refusing obviously-fake credentials at the point of entry is a small change with a large diagnostic payoff.

Onboarding got two genuine capability additions. #11508 supports providerless component onboarding, and #11427 reuses Hermes dashboard and API forwards rather than re-establishing them. #11521 raises the Gemini probe budget — worth knowing if Gemini onboarding was timing out for you. On the security side, #11517 makes offline image rebuilds consume verified audits rather than trusting unverified ones, and #11419 repairs Tavily credential setup. v0.0.123 documentation is staged (#11447), and the OpenShell 0.0.116 cutover completed (#11251).

Commits → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/switching-providers/, /nemoclaw/policy/