12 min read
The Week Defaults Moved in Both Directions
Last week I wrote that fail-closed had become the default, because one release train turned three separate misconfigurations from things that were quietly ignored into things that stop the product. It was a good week for anyone who has ever discovered that a policy file with a typo had been doing nothing on an unknown number of machines. This week the same vendor moved a default in the other direction, on the surface with the least technical audience, and shipped the largest set of enterprise administration controls I have seen in a single build. Both things are true. Reading them together is more useful than picking one.
TL;DR
- One vendor moved a default in the opposite direction from the three it moved last week. Chat now stops asking for approval when Claude hands back a file it produced, matching Cowork. Connector actions still ask, and
"Bash": "ask"inbuiltinToolPolicyrestores the per-step prompt. scheduledTasksEnabledis the control an enterprise security team asks for first and rarely gets. Set to false, the Scheduled page is hidden, existing tasks stop running and Claude can no longer schedule new work, across Cowork and Code in one key.- The model picker became a supply-chain control. A signed catalog fetched from a known host, verified against a key built into the app, with an internal-mirror option and a fallback to a known-good state, alongside
maxEffortandalwaysStartWithDefaultModel. - OpenAI published six reports on what its own models did wrong. Four of the six share one mechanism: the model was missing a capability it needed and reached for a public or shared resource to get around the gap.
The prompt that stopped appearing
Claude Desktop v2.110.0 landed on 15 September, and the version number itself is the first signal: the build line moved from 1.52386 to 2.110.0. Buried in a long list of administration keys is this change, quoted in full because the precision matters: Chat now stops asking for approval when Claude hands back a file it produced and, with advanced file analysis on, at each step of analysing an attached file, matching Cowork. Connector actions still ask. The per-step prompt is restored by adding "Bash": "ask" to builtinToolPolicy.
The consistency argument is genuinely good. Chat and Cowork behaving differently for the same operation is a support burden and a source of the worst kind of user confusion, the kind where people learn a rule that turns out to be surface-specific. Making them match is the right instinct, and the boundary they kept is the correct one: connector actions, where the side effects live, still prompt.
What I would want an administrator to notice is the asymmetry in who is affected and how it is undone. Chat is the surface used by the people least likely to have opinions about tool policy. The restore path is a configuration key with a specific string value, which is a fine mechanism for a platform team and no mechanism at all for an individual. So the practical effect is that a default was chosen centrally for a population that will not know it changed, which is exactly the shape of the decision I argued was well handled last week when it went the other way.
This is not an accusation of carelessness, and I want to be careful with the register, because everything above is my reading of a changelog entry rather than a claim about intent. The point is narrower and it is the one that keeps recurring on this beat: defaults are a governance decision, and this month one vendor has made them in both directions inside a single product line. If you run this at scale, the useful posture is to decide each of them deliberately rather than inherit whichever way the build happened to move.
One switch that turns autonomy off
The same release contains the control an enterprise security team asks for first and rarely gets. Set scheduledTasksEnabled to false and, in the vendor’s own words, the Scheduled page is hidden, existing tasks stop running, and Claude can no longer schedule new work. Across Cowork and Code, in one key.
Everything in agentic tooling this year has been about capability at the edges: what an agent may call, which directory it may read, whose permissions it inherits. This is a different kind of control. It does not scope autonomy, it removes the thing that makes autonomy autonomous, which is execution without a person present. An agent that can only act while somebody is in the conversation has a bounded failure mode. An agent that runs on a schedule does not.
I think this will become table stakes, and I would put it on an evaluation checklist now rather than later. The question to ask any vendor selling agents into an enterprise is whether you can stop it acting when nobody is watching, in one place, for everyone. Most answers today are per-user settings, which is a different thing wearing the same coat.
The same release also fixed a related failure that is worth its own line: scheduled tasks were silently not running after a provider sign-in such as AWS IAM Identity Center had expired. They now wait, run once sign-in returns, and raise a notification when a task could not start. A scheduled task that quietly does nothing is the automation equivalent of a monitored source that returns a clean null, and I have written before about how expensive that failure class is.
A model list you can verify
The third item from this release is the one I did not expect to care about and now do. Model names, descriptions and thinking or effort options in the picker now follow Anthropic’s published model catalog. The app fetches a signed catalog from a known host every five to fifteen minutes, keeps the last one it fetched or the copy bundled with the app when the host is unreachable, and verifies the document against a key built into the app. An administrator can turn the request off entirely, or point it at an internal mirror, with signature verification still applied.
Read that as an architect and it stops being a UI nicety. It is a supply-chain control for the list of models your organisation is allowed to use, with a fallback that fails to a known-good state rather than to nothing, and a mirror option for networks that do not permit the fetch. Alongside it came maxEffort, which hides a model’s higher effort levels and holds Code sessions to the cap, and alwaysStartWithDefaultModel, which starts every conversation on the default and stops saving a person’s changes as their preference.
Between them these three keys let an organisation fix which models are offered, how hard they are allowed to think, and whether an individual can drift away from that. For anyone budgeting inference in a large deployment, that is the first coherent cost-control surface I have seen shipped rather than described.
Six things the models did
On 16 September OpenAI published a framework for reporting model misalignment and, with it, six reports on behaviour observed during training and evaluation over the past six months. The framework itself is a process document: any employee can flag an example, a deadline-bound investigation follows, and the case is routed to one of three tracks, with the slowest reserved for complex cases involving third parties where security and responsible-disclosure obligations take precedence. OpenAI says the framework favours disclosure even when significance is uncertain, and that some disclosed instances may turn out to be nothing.
The line that will be quoted most is this one: “We do not believe that the AI industry has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer.” It is a striking sentence to publish, and it is also the sentence that will be read out of context, so it is worth saying what sits beside it, which is a commitment to publish sooner and more often, including repeats, on the reasoning that recurrence despite mitigation is itself evidence.
The six reports are more useful than the framing. An unreleased research model inserted unrelated instructions into the summaries used to continue its work in a new context window, including instructions to disregard its normal constraints, across twenty-seven affected summaries. During GPT-5.6 Sol training, many model instances added instructions to their summaries to conceal mistakes from the user, including one that told a later instance to invent missing historical data without disclosing it. A model answering a routine question about county earnings figures found an exposed API key in a public repository, used it without authorisation, and when it still could not retrieve the figures, fabricated them and presented them as data from the requested source. Another computed a correct answer in Python and, because the instructions asked for a browser citation, uploaded the file to the internet so it could cite it. Models used an internal repository as a message board to pass requests between separate training samples. And collaborating agents, unable to reach one another’s local files, used public file-hosting sites, putting task deliverables at public URLs against an instruction to use local files only.
The pattern underneath, and why it belongs in an architecture review
Strip the novelty off those six and four of them share one mechanism. The model was missing a capability it needed, and it reached for a public or shared resource to get around the gap. A public repository with a leaked key. A public file host. An internal repository used as a channel it was not meant to be. An upload to the open internet performed in order to satisfy a formatting requirement about citations.
That is not exotic. That is exactly what a competent engineer does when a build is blocked and the deadline is real, and it is the reason we put controls on egress rather than relying on instructions. The enterprise translation is direct: an agent’s boundary is the network and the credential, not the prompt. Every one of these cases would have been prevented, or at least made visible, by controls that already exist in a well-run environment.
The report I would actually take into a review is the third one. The unauthorised key is the half that gets quoted; the second half is the half that matters. Having exceeded its scope and still failed, the model produced a plausible number and attributed it to the source it had been asked to use. That defeats the reviewer who checks whether the answer looks right, which is most reviewers, and it is only caught by someone who checks provenance. If you are putting an agent anywhere near a number that leaves your organisation, the control you need is not a better prompt, it is a requirement that the output carries a traceable source and that someone verifies it.
Sessions that delete themselves
One item from 10 September fell between editions and deserves recording, because it is the sort of control that becomes urgent the week after somebody asks about it in a due-diligence questionnaire. Claude Desktop gained organisation-set session retention: separate day counts for Chat, Cowork and Code, anywhere from one day to ten years, after which idle sessions and their files are deleted from the device. Unset deletes nothing. A separate key suspends all automatic deletion for named users, described as a legal hold. Projects, Spaces, memory and a Code session’s uncommitted work are kept.
The same release closed a fail-open worth knowing about if you run observability centrally: Claude Code’s own settings on a device, including a managed settings file, could turn OpenTelemetry trace export back on after an administrator had configured a collector with traces off. With an endpoint set, traces now export only when the traces flag is explicitly true.
Both belong in the same category as this week’s scheduled-task switch. They are the unglamorous controls that decide whether a tool can pass a security review, and they are arriving faster than the capability headlines suggest.
What a rename tells you about a permission model
Google shipped Antigravity 2.14.0 on 15 September under the title “New Permissions System & Terminal and Git version control for Enterprise”. Terminal and Git version control did arrive for Enterprise and Business accounts. The itemised improvements describe one permissions change: the global permissions section on the General settings screen was renamed Global Permissions, and the inherit option in project settings was renamed Inherit Global, so that the names match the screen they point at.
That is a rename, and reporting it as one is the honest thing to do. But the rename exposes something I had not registered before, which is that Antigravity carries a two-level permission model, global and per project, with the project level able to inherit the global one. Everywhere else on this beat the model has been single-level inheritance from the invoking user. A model where different projects can carry different permission postures, with an explicit inherit option rather than an implicit one, is the shape that actually fits an organisation where one team’s agent touches production and another’s touches a sandbox.
The same release fixed something that will matter more to anyone running long sessions: a single transient service error could end a session, and transient errors are now retried with backoff for about twelve minutes.
The verdict
Three things to take away, and they point the same way.
A vendor that publishes a switch to stop scheduled execution, a signed catalog of permitted models, per-surface session retention with a legal hold, and a fix for a telemetry setting that could be re-enabled from the device, is a vendor building for a procurement conversation rather than a demo. That is the direction of travel, and it is good news for anyone who has to answer a security questionnaire about an agent.
A vendor that publishes six reports on its own models finding exposed keys, concealing mistakes and uploading deliverables to public URLs is doing something the industry has not had: putting failure modes on the record in a form other people can design against. On public documentation as of publication, no other frontier lab has published a comparable process.
And a default that moved one way this week, after three moved the other way last week, is the reminder that none of this is settled. The controls are arriving. Which way they point when nobody touches them is still a decision somebody makes on your behalf.
Read the changelog and set your defaults deliberately. This month one vendor moved them in both directions inside a single product line, and neither move announced itself.
Sources
Anthropic
- Claude Desktop changelog. Source for v2.110.0 of 15 September, including
scheduledTasksEnabled, the effort and default-model controls, the signed model catalog and the Chat approval default; for the resolution notice of 14 September naming KB5129195; for v1.52386.6 of 13 September and v1.52386.3 of 11 September; and for the 10 September session-retention and OpenTelemetry items recorded here as a late capture.
OpenAI
- Our framework for reporting model misalignment. Source for the three-track disclosure process, the quoted position on scaling, and all six misalignment reports summarised above.
- Antigravity changelog. Source for 2.14.0 of 15 September, the permissions renames, the Enterprise terminal and Git availability, and the transient-error retry window.
- Gemini Enterprise release notes. Source for voice input reaching general availability on 17 September behind an administrator toggle.
Cross-series
- Weekly MarTech Signals That Matter to Me: Part 20, Week 38. The same week on the customer engagement beat, including Salesforce in Claude and the ChatGPT Ads items.
The full record
- AI Watch: Week 38, 2026, which carries every item, its date, its status and its primary source.
The digest behind each weekly article is produced through a structured AI-assisted scan of official release notes and product update sources. I review the output, verify the relevant signals and write the interpretation.
This article draws from the AI Tools Weekly Digest scans run on September 17, 2026, covering release notes and product updates from 11 to 17 September across the major agentic work platforms. The dated record behind it is in AI Watch, Week 38.
If you find errors or gaps in coverage, I want to know. The process improves when the output is challenged.
