$ cat ai-agents/week/2026-09-28.log
the week in review · Sep 28 – Oct 4, 2026
Claude Code makes Sonnet 5.5 the default
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
The same release hardens permission denies against plugins you install, and a Goose advisory lands in 1.53.0.
v2.1.284 anthropics/claude-code
The new default Sonnet on the Anthropic API is claude-sonnet-5-5 at 1M context and $2/$10 per Mtok, with cache reads at $0.20/Mtok, so the cost profile of your existing Claude Code runs changes without any config edit. Auto mode also gains a "Yes, but ask again next time" answer before a read outside your working directories, which is the middle ground between one-off approval and a lasting allow.
sec-default: a settings deny rule holds over an allow or ask from a plugin the person installed anthropics/claude-code
A settings deny rule's verdict now wins when a mod you installed answers allow or ask over it on tool.check; organizations can opt out in managed settings. If you run Claude Code on a shared machine or against sensitive repos, this closes the path where installing a plugin quietly widened what the agent could touch.
v1.53.0 aaif-goose/goose
Goose 1.53.0 adds a resizable picture-in-picture window for MCP Apps, live model metadata from models.dev with a bundled fallback, and a quoting action that appends selected conversation text. Treat this as the version to be on: it carries the fix for the advisory remediated under GHSA-6mg9-3cvh-9939.
CLI v3.0.67 cline/cline
When an MCP tool returns more output than fits in context, the agent now gets a preview plus a link it can page through with read_files, so output past the cutoff stops disappearing from the turn. Custom providers defined in providers.json and models.json also work when you run a task, which is the difference between them appearing in the picker and actually being usable.
fix(auth): prevent infinite auth loop from file contention, headless keyring, and supervisor state drops (#28341) google-gemini/gemini-cli
An infinite auth loop that hit Windows, WSL, and headless users is fixed, along with file contention collisions against companion tools such as the Gemini Code Assist VS Code extension. Encrypted file storage now serves as automatic fallback when a headless keyring is unavailable, which matters if you run the CLI in CI or over SSH.
SDK v0.0.89 cline/cline
Oversized MCP and Composio tool results now land in a per-session in-memory cache, and the model gets a bounded preview plus a cline://cache/... URI that read_files pages through by line range. Custom tools can opt in through resultPolicy, so wrappers you wrote around noisy tools can stop truncating their own output.
fix(opencode): apply provider timeouts to Cloudflare AI Gateway models anomalyco/opencode
headerTimeout, chunkTimeout, and timeout live in the fetch wrapper resolveSDK adds, but the Cloudflare AI Gateway path never received them, so routed requests could hang instead of failing fast. Models served through the gateway now honor the same timeouts as direct providers.
Render `/status` without borders and wrap long values openai/codex
The /status card drops its border and wraps long values onto continuation lines aligned under the value column. In narrow terminals, that means session IDs and paths are no longer cut off mid-string during debugging.
$ ls ai-agents/week/ # the briefings behind this review
Keep up with Agentic Coding in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.