โ† All digests
AI Developer Digest

Wed, Sep 30, 2026

11 signals that cleared the gate20 scanned19 min read
The Signal โ€” start here
The day after OpenAI DevDay is a follow-through day. Anthropic fires the first shot in the 4.x model sunset cycle: claude-sonnet-4-5-20250929 gets its November 30 retirement notice โ€” two months out, migrate to Sonnet 5.5 now. Claude Code v2.1.286 drops with three separate log-redaction security patches (zero-width-space credential leaks, partial Bearer token masking, MCP error messages exposing secrets) plus a gateway billing bug that was charging cache writes at the wrong rate. Separately, Gemini CLI quietly gains autonomous plan execution in non-interactive mode, which is the capability gate for using it unattended in CI/CD pipelines. No new model launches today; the action is in hardening and cleanup.
Must-reads today
1
Claude Sonnet 4-5 (claude-sonnet-4-5-20250929) retires November 30 โ€” if you haven't migrated to Sonnet 5.5, you have 61 days; read the five breaking changes in the September 28 digest first
2
Claude Code v2.1.286 โ€” three security fixes around log/transcript credential exposure; update and audit if you use MCP servers with auth tokens or run gateway deployments

๐Ÿ† Repo of the Day

1

tobi/disktree โ€” visual treemap for finding and removing what fills your disk

Build from source (requires Rust 1.97+):

git clone https://github.com/tobi/disktree && cd disktree

cargo build --release

Run against your home directory:

./target/release/disktree ~


Breaking Changes

1
โ—Breaking

Claude Sonnet 4-5 deprecation โ€” `claude-sonnet-4-5-20250929` retires November 30, 2026

What changed
Anthropic announced a November 30, 2026 retirement date for claude-sonnet-4-5-20250929 โ€” the September 2025 snapshot of Claude Sonnet 4-5. After this date, API calls to this model ID will return errors.
TL;DR
claude-sonnet-4-5-20250929 retires November 30, 2026 โ€” 61 days from today; Anthropic's recommended replacement is claude-sonnet-5-5, which launched September 28 with five breaking API changes (see September 28 digest).
Developer signal
This is the start of the 4.x model sunset cycle. If your codebase uses claude-sonnet-4-5-20250929 directly (as a pinned snapshot ID, not the rolling alias), the model stops responding on November 30. Migration path: target claude-sonnet-5-5. However, before you do: the September 28 digest documented five breaking API changes between Sonnet 5 and Sonnet 5.5 โ€” thinking: disabled, tool_choice: any/tool, computer_20251124 toolset, old-generation advisor pairings, and conversation-bound thinking blocks. Run through that checklist before swapping the model ID. If you need more runway, the older claude-sonnet-5 is not yet deprecated and remains available. Also check personal/sources/ai-dev-sources.md model deprecations page for the full schedule; further 4.x retirements are likely to follow within the next 30โ€“60 days.


Affects you ifYou use the pinned model ID claude-sonnet-4-5-20250929 in production code, SDKs, or CI pipelines; you have hardcoded model IDs (not rolling aliases) that haven't been audited since Sonnet 5.5 launched.EffortModerate โ€” the model ID swap is Quick, but the Sonnet 5.5 migration checklist (5 potential breaking changes) requires code review.

Model Releases

No new model releases today.


API & SDK Changes

No new API or SDK releases today.


Research

arXiv.org was egress-blocked; full paper text for cs.AI/cs.CL submissions could not be read. See Near-misses for details. One candidate worth tracking: EngiWorld: What Can Frontier Agents Deliver in Professional Engineering Environments? (arXiv:2609.37686) โ€” see Trends section.


Tooling

2
Medium

Claude Code v2.1.286 โ€” three credential-exposure security fixes, gateway pricing bug, VSCode bookmarks

What changed
Three log/transcript security fixes (credentials visible in redacted logs via zero-width spaces, percent-encoded Bearer tokens only partly masked, MCP error messages exposing credential values), one gateway billing bug (cache writes at wrong pricing tier), plus credential refresh fixes, parallel-tool-call session resume fix, API 400 fix for non-text tool return values, and VSCode bookmarks.
TL;DR
v2.1.286 patches three separate ways Claude Code was leaking credentials into logs and transcripts, fixes a gateway spending meter that underbilled prompt cache writes, and adds VSCode response bookmarks.
Developer signal
Three security items to review immediately:

  1. Zero-width-space credential leak in redacted logs/transcripts: Redacted logs and session transcripts included in feedback zip files were retaining secrets surrounded by invisible characters (U+200B zero-width spaces). If you have exported sessions or submitted feedback that included API keys, tokens, or passwords โ€” and your feedback zip was sent to Anthropic or stored elsewhere โ€” those secrets may have been readable despite appearing redacted. Update to v2.1.286 and audit any transcripts generated before this fix.

  1. Percent-encoded Bearer tokens only partly masked: Bearer tokens with percent-encoding (e.g., OAuth tokens containing %2B, %2F) were only partially obscured in logs โ€” the unencoded portion after the last encoded character was visible. Affects anyone using MCP servers with OAuth-style auth tokens.

  1. MCP error messages exposing credential values: When an MCP server returned an error, the error message could include literal credential values if the token appeared before a key name in the error string (Bearer <key>). Fixed: error messages now sanitize these patterns.

Additionally: the Claude apps gateway was pricing 1-hour prompt cache writes at the cheaper 5-minute rate, resulting in underbilling. This is now corrected โ€” gateway spend meters will show higher costs for cache writes going forward. Review your recent gateway billing if cost predictability matters.

New features: VSCode extension gains a bookmarks feature to save and revisit Claude's responses within a conversation; Claude Tag (Slack) can now set spend limits directly from a channel ID or Slack link.


Affects you ifYou use Claude Code with MCP servers that require authentication; you run Claude Code gateway deployments and monitor cost; you have submitted session feedback or exported transcripts that contained sensitive values; you use the VSCode extension.EffortQuick โ€” Claude Code auto-updates; review prior transcripts if you've submitted feedback with sensitive data present.
Notable

Gemini CLI v0.64.0-nightly โ€” autonomous plan execution in non-interactive mode

What changed
v0.64.0-nightly enables autonomous plan execution without requiring user interaction in non-interactive (headless) mode; fixes folder trust state propagation in headless runs; adds V1โ†’V2 settings migration for the A2A server integration.
TL;DR
Gemini CLI can now autonomously execute agent plans in headless/non-interactive mode โ€” previously it required user confirmation for plan steps, blocking unattended use in CI/CD pipelines.
Developer signal
Before v0.64.0-nightly, running Gemini CLI in headless mode (--no-interactive or piped stdin) would stall on plan execution steps that normally require user confirmation. This blocked use cases like: running Gemini CLI as a CI step, scripting multi-step agent tasks, or integrating it as a backend tool in orchestration pipelines. The autonomous plan execution change removes this gate โ€” Gemini CLI will now proceed through plan steps without prompting when invoked non-interactively. The companion fix (folder trust state propagation in headless mode) is equally important: without it, agents running in a subdirectory outside the initially-trusted root would hit trust failures mid-run. Together these two changes make Gemini CLI a viable tool for unattended agent automation. Note: this is a nightly (pre-release) build โ€” use in CI should be pinned to a stable tag once one ships with these changes. The A2A server V1โ†’V2 settings migration is relevant for teams using the experimental agent-to-agent protocol integration.


Affects you ifYou run Gemini CLI in CI/CD pipelines or as a backend automation tool; you use the A2A (agent-to-agent) server integration; you've been blocked by Gemini CLI requiring interactive confirmation in headless environments.EffortQuick โ€” pull the nightly; no config changes needed for autonomous mode (it activates automatically in non-interactive sessions).

Rising Dev Tools

1
Notable

tobi/disktree โ€” visual treemap for disk space analysis built on GPUI

Developer signal
Clone and cargo build --release, then run disktree <path>. The interactive treemap lets you navigate into subdirectories, see individual large files within their directory context (an improvement over ncdu which requires drilling down), and mark/delete directly without leaving the UI. Free space is always visible. If you're regularly cleaning up after agent sessions or managing large model/artifact caches, this is faster than the du -sh | sort -rh | head + manual drill pattern.


Affects you ifYou manage disk space on macOS or Linux machines with large codebases, model weights, agent artifacts, or build caches.
GitHub Trending (Rust, daily) | Stars: ~1,935 (โ†‘ trending at #4 today) | Link: github.com/tobi/disktree

Benchmarks & Leaderboards

No confirmed new leaderboard entries or SOTA changes within the 24-hour scan window. lmarena.ai was egress-blocked. The September 2026 Arena snapshot (claude-opus-5-max at ~1505โ€“1531 ELO; highest open-weight model kimi-k3-max at ~1476) was not updated for September 30 specifically.


Technical Discussions

Nothing cleared the quality bar this period. HN threads on Claude Code v2.1.286 security fixes were not yet at score >200 at time of scan. simonwillison.net egress-blocked.


Quick Hits

  • OpenAI Codex rust-v0.159.2 โ€” Backported bug fix only: console windows no longer flash on Windows when Codex launches background processes and sandboxed commands. No new features. Published September 29. github.com/openai/codex/releases/tag/rust-v0.159.2

Worth Watching (Announced, Not Yet Shipped)

5

GPT-6.1 Sol Ultrafast โ€” still "coming days"

Announced at DevDay September 29 but not yet available in the API as of September 30. Watch platform.openai.com/docs/changelog for release. [openai.com/index/devday-2026-recap/]

OpenAI Decisions API โ€” broad release "coming days"

Limited preview only as of September 30; no public endpoint, model ID, or price published yet. 10ร— faster than GPT-6 Luna standard API (~150ms latency). [openai.com/index/devday-2026-recap/]

Claude Haiku 5.5 โ€” "coming weeks" (announced Sept 22)

No model card, pricing, or date as of September 30. The Opus 5.5 โ†’ Sonnet 5.5 gap was 6 days; Haiku 5.5 timeline remains unconfirmed. [Anthropic Sonnet 5.5 release, September 28, 2026]

**5 days left: GPT-6 Astra billing starts October 5, 2026**

Free billing period ends October 4. Standard pricing applies from October 5. [platform.openai.com/docs/changelog]

**5 days left: Google Antigravity `antigravity-preview-05-2026` shuts down October 5, 2026**

Migrate to antigravity-preview-09-2026; rename snake_case built-in tool parameters to PascalCase. [ai.google.dev/gemini-api/docs/changelog]



Filtered from 30+ primary sources against a published quality rubric. No press releases, no fluff โ€” only what changes what you build.