Two releases in one day: 2.1.276 landed overnight, 2.1.277 in the afternoon. At 87 lines it’s the longest entry in weeks, and the item at the top matters more than the rest of it.
AGENTS.md instead of CLAUDE.md
In a project with no CLAUDE.md, Claude Code now reads AGENTS.md. You can change it under “Project instructions” in /config. Not on Bedrock, Vertex or Foundry yet.
AGENTS.md is the cross-vendor format several coding agents have converged on. OpenAI moved Astra to it last week. Claude Code reading the file means a repository no longer needs two instruction files just because two tools work in it.
Three changes against smuggled instructions
The security half is the more interesting one this time. Subagent results now reach the main agent under a header marking them as subagent output, with the result indented, so text inside a subagent’s result can’t pass as the session’s own instructions. The same reasoning applies to workflow scripts on Bedrock, Vertex and Foundry: computed agent() prompts arrive framed as script-authored text rather than as the user.
There’s also a clean-up at the entrance. Invisible Unicode formatting and tag characters are removed from a prompt, and the cleaned version is shown for review before it goes out. Anyone who has ever pasted a prompt straight off a web page knows why that isn’t paranoia.
One sandbox hole got quietly closed too: a glob in sandbox.excludedCommands used to exempt an entire compound Bash command from the sandbox when only one part matched. Now every part has to match.
What else stands out
48 of the 87 lines are fixes. Among them: claude -p and Agent SDK sessions that could hang with no result after an internal error now report the error and exit with code 1. Conversations that failed every request with “text content blocks must be non-empty” work again. And running an older Claude Code build on the same machine — say, the CLI bundled with an IDE extension — no longer logs you out unexpectedly.
Gateway operators get CLAUDE_GATEWAY_PROXY_IS_EGRESS_BOUNDARY=1: when the only egress is a forward proxy, every outbound request hands the proxy the hostname instead of resolving it locally. There’s an optional headers: map for static headers to a proxy you run yourself.
The TaskOutput tool is gone; Claude reads a background task’s output file with Read instead. And the VS Code extension picks up a copy button, a sign-out row, and background shells in the agent map.
AGENTS.md is a concession, not a feature
One line in a changelog, and still the real story. Anthropic established CLAUDE.md as its own format and got a lot of repositories to create one. Reading another camp’s file costs nothing in capability and gives up a piece of lock-in.
You don’t do that out of generosity. You do it when enough developers run two agents side by side and get tired of maintaining the same instructions twice. The precedence is unchanged, by the way: where a CLAUDE.md exists, it wins.
Sources: