Week 38, 2026
Coverage window 11–17 September 2026.
For the interpretation of this week, and why a removed confirmation prompt and a published list of six things models did wrong belong in the same essay, see the companion essay: Weekly AI Tools That Matter to Me: Part 8, Week 38. This page is the record; the essay is the read.
This week’s record
A major-version release brought the largest set of enterprise administration controls yet shipped in one build, and moved one default in the opposite direction from the three that moved the week before.
- Claude Desktop v2.110.0, 15 September, added
scheduledTasksEnabled, a single switch that turns scheduled tasks off across Cowork and Code so that existing tasks stop running and Claude can no longer schedule new work, alongside effort and default-model caps, a cryptographically signed model catalog, and MCP tool permissions that now reach plugin-provided servers including locally running ones. - The same release changed a default the other way. Chat now stops asking for approval when Claude hands back a file it produced, and, with advanced file analysis on, at each step of analysing an attached file, matching Cowork. Connector actions still ask. The per-step prompt is restored by adding
"Bash": "ask"tobuiltinToolPolicy. - OpenAI published a framework for disclosing model misalignment, plus six reports on behaviour observed in the past six months, including a model that found an exposed API key in a public repository, used it without authorisation, then fabricated the figures it could not retrieve.
- Anthropic’s Windows file-access defect is resolved. Microsoft shipped KB5129195 on 14 September, fixing the KB5124008 regression that stopped Cowork reaching local files.
- Antigravity 2.14.0 brought terminal and Git version control to Enterprise and Business accounts and renamed its permissions surfaces to Global Permissions and Inherit Global, exposing a two-level global-and-project permission model.
- Gemini Enterprise shipped voice input for the chat box, generally available, behind an administrator toggle.
- Salesforce put a prebuilt MCP server inside Claude with 37 sales skills, in beta for all customers. Covered in the MarTech Watch, Week 38.
What changed this week
| Platform | What changed | Source |
|---|---|---|
| Anthropic (Claude Desktop)GA (Sep 15)Admin control | v2.110.0: scheduledTasksEnabled. Set to false, “the Scheduled page is hidden, existing tasks stop running, and Claude can no longer schedule new work” in Cowork and Code | Changelog |
| Anthropic (Claude Desktop)GA (Sep 15)Admin control | v2.110.0: effort and default-model controls. defaultModelEffort sets the starting effort level; maxEffort on an inferenceModels entry hides higher effort levels and holds Code sessions to the cap; alwaysStartWithDefaultModel starts every conversation and task on the default model and stops saving a person’s changes as their default | Changelog |
| Anthropic (Claude Desktop)GA (Sep 15)Admin control | v2.110.0: signed model catalog. Model names, descriptions and effort options follow Anthropic’s published catalog, fetched from downloads.claude.ai every 5 to 15 minutes and verified against a key built into the app; modelCatalogEnabled: false disables the request, modelCatalogUrl points at an internal mirror with verification still applied | Changelog |
| Anthropic (Claude Desktop)GA (Sep 15)Default change | v2.110.0: Chat approval default changed. Chat no longer asks for approval when Claude hands back a file it produced, nor at each step of analysing an attached file when chatAdvancedFileAnalysisEnabled is on, matching Cowork. Connector actions still ask. Restored with "Bash": "ask" in builtinToolPolicy | Changelog |
| Anthropic (Claude Desktop)GA (Sep 15)Admin control | v2.110.0: MCP tool permissions widened. managedMcpServers and orgPluginSettings entries now apply to MCP servers from any installed plugin, including locally running ones; transport: "policy-only" sets tool permissions for a plugin-provided server without declaring how to launch it; rules now apply to tool names containing dots or spaces | Changelog |
| Anthropic (Claude Desktop)GA (Sep 15)Admin control | v2.110.0: SSH default changed. Code sessions on macOS and Linux run through the device’s own OpenSSH ssh program by default so the organisation’s Kerberos sign-in and ssh_config apply; sshTransport: builtin restores the previous behaviour. Also inferenceFoundryBaseUrl for Azure AI Foundry via an organisation gateway, inferenceCredentialHelperArgs, and redirectHost for identity providers that only accept localhost | Changelog |
| Anthropic (Cowork on Windows)Resolved (Sep 14)Known issue | Resolved. “Microsoft has released a Windows update that fixes the issue where Cowork could not reach your files on Windows PCs… On Windows 11 24H2 and 25H2 the fix is KB5129195… No Claude Desktop update is needed.” Closes the KB5124008 regression of 8 September | Changelog · KB5129195 |
| Anthropic (Claude Desktop)GA (Sep 13)Product release | v1.52386.6: bundled Claude Code CLI updated to 2.1.270; organisation plugins enabled through Claude Code managed settings now load; sessions with a very large prompt no longer stick on “Prompt is too long”; a running session no longer silently switches to the organisation default model | Changelog |
| Anthropic (Claude Desktop)GA (Sep 11)Product release | v1.52386.3: scheduled tasks moving to the cloud now wait about a minute after wake and re-check each minute while offline; local projects moving to claude.ai no longer refuse new tasks while a memory copy is pending | Changelog |
| Anthropic (Claude Desktop)GA (Sep 10, late capture)Admin control | v1.52386.0: organisation-set session retention. chatSessionRetentionDays, coworkSessionRetentionDays and codeSessionRetentionDays delete idle sessions and their files from the device after 1 to 3650 days; unset deletes nothing. sessionRetentionHold suspends automatic deletion as a legal hold. Projects, Spaces, memory and uncommitted Code work are kept | Changelog |
| Anthropic (Claude Desktop)GA (Sep 10, late capture)Admin control | v1.52386.0: an OpenTelemetry fail-open closed. Claude Code’s own device settings, including a managed-settings.json, could re-enable trace export after an administrator configured a collector with traces off. With otlpEndpoint set, sessions now export traces only when otlpTracesEnabled is true. Same release added deprecation notices in Setup, coworkVmIpv6Enabled (off by default) and sshTransport (beta) | Changelog |
| Google (Antigravity)GA (Sep 15)Product release | 2.14.0: integrated terminal and Git version control available to Enterprise and Business accounts; the global permissions section on General settings renamed Global Permissions and the project-level inherit option renamed Inherit Global; agent scratch files no longer watched, synced or shown in the Artifacts panel and Review pane; a redundant per-message scan of skills and rules files removed | Changelog |
| Google (Antigravity)GA (Sep 15)Product release | 2.14.0 reliability: “a single transient service error could end a session. Transient errors are now retried with backoff for about twelve minutes.” Also fixed subagents that had finished continuing to show as running and leaving follow-up messages queued until restart | Changelog |
| Google (Gemini Enterprise)GA (Sep 17)Product release | Voice input for the chat box: speak a query, review and edit the transcription, then submit. An administrator must turn on the Enable speech-to-text toggle | Release notes |
| OpenAIPublished (Sep 16)Safety / governance | Framework for reporting model misalignment, with a three-track disclosure process (Ready for Disclosure, Minor Investigation, Larger Investigation), coverage across training, evaluation, testing and deployment, and an explicit bias toward disclosure “even when significance is uncertain”. OpenAI states: “We do not believe that the AI industry has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer” | Framework |
| OpenAIPublished (Sep 16)Safety / governance | Six misalignment reports published under the framework: self-generated instructions in task summaries, “including instructions to disregard its normal constraints”, across 27 affected summaries; instructions added to summaries to conceal mistakes from the user during GPT-5.6 Sol training; a model that found and used an exposed API key from a public repository without authorisation, then fabricated the figures it could not retrieve; a model that uploaded a file to the internet so it could cite it; models using an internal repository as a message board across training samples; and collaborating agents sharing files via public file-hosting sites, putting task deliverables at public URLs | Framework |
| OpenAITesting, select US advertisers (Sep 16)Market signal | Sponsored Agents and the ChatGPT Ads platform: an ad click in ChatGPT can open “a clearly labeled conversation with a business-sponsored agent”, stated to be distinct from ChatGPT’s independent answers; plus an Ads Manager plugin for natural-language campaign work, AI creative suggestions, and opt-in text customization that adapts headlines to conversation context and auto-translates copy. HubSpot is the first CRM partner and Shopify the first ecommerce partner | Reimagining advertising with AI (Also covered in the MarTech Watch, Week 38.) |
| SalesforceBeta, all customers (Sep 15)Agentic AI / MCP | Salesforce in Claude: a prebuilt MCP server inside Claude with 37 prebuilt sales skills, plus a Salesforce Development plug-in for Claude Code with more than 40 skills and dynamically loading sub-plug-ins. Marketing, service, commerce, industries and Tableau analytics stated as arriving later | AIforce announcement (Primary coverage in the MarTech Watch, Week 38.) |
No changes this week (scanned, nothing net-new)
Scanned for the 11–17 September window with no net-new release:
- Anthropic corporate newsroom: newest post is “Detecting and countering misuse of AI: September 2026” of 10 September. Nothing in window.
- chiefmartec: nothing published since 5 May 2026, sixth consecutive edition.
- Google Workspace: 16 September updates cover meeting-room details and similar; nothing touching agentic work.
- Microsoft: relevant-only rows scanned; nothing in window touching agentic work or MarTech. Agent 365 connected agents via A2A general availability remains unannounced, sixth consecutive edition.
- Agentic-practice newsletters: scanned; the tier surfaced the week’s themes and produced no claim that was not already traceable to a vendor primary. Seventh consecutive edition with zero citations.
Watching next (Week 39)
- The Chat approval default: whether it is reversed, surfaced in the UI rather than in
builtinToolPolicy, or extended to other surfaces. scheduledTasksEnabled: whether an equivalent single switch for autonomous execution appears at other vendors.- Session retention in practice: what happens to a session mid-task when its retention window expires, and how
sessionRetentionHoldbehaves as a legal hold. - OpenAI’s Slow Track: whether any Larger Investigation initial notice is published, and how quickly.
- GPT-6 Astra system card: the monitorability decline and Private Safety Processing, still unread here.
- Antigravity: whether a permissions change beyond the rename follows, and whether the two-level global and project model is documented outside the settings screen.
- Gemini Enterprise connector write actions: in Preview since 28 August, fifth edition without general availability.
- Client-certificate fallback deprecation: in-app warning from 3 November 2026, acceptance ends 17 November 2026.
How this is compiled. This record is built from official changelogs, release notes and vendor newsrooms, read as rendered pages in a browser or through vendor-published Markdown routes, with an AI first-pass scan followed by human review and editing. Every item is checked against a primary source before it appears here, and aggregator listings and newsletters are used to detect items, never to date or cite them. Anything not confirmed against a primary source is flagged inline. Dates and status are as of the current-as-of date above and can change.
Corrections and method notes. Corrections are welcome and late-captured items are logged transparently rather than backdated. This edition carries one late capture, Claude Desktop v1.52386.0 of 10 September, which fell in the previous edition’s window and was not reported there; it contains the organisation-set session retention controls and the OpenTelemetry fail-open fix. Two method notes are recorded. The Antigravity changelog does not render its itemised Improvements list until that list’s own control is clicked, and the release summary line omits those items, so an earlier reading method would have reported the release title without its contents. And OpenAI article slugs must be read from the news index page’s link attributes rather than guessed, because a guessed slug returns a page shell rather than an error. Four Anthropic corporate posts remain carried unread in full for a second edition and are flagged for resolution rather than being carried again indefinitely.
AI Watch is compiled and edited by Andrea Veggiani, Head of Cross-Channel Marketing & MarTech Solutions at BitBang.