Claude Code now reads AGENTS.md — and makes its harness rewritable
Anthropic conceded the file-format fight this week, then quietly shipped something larger underneath it: a plugin layer that lets anyone — an organization, a vendor, a person — rewrite how Claude Code behaves at the hook level.
Version 2.1.277 of Claude Code now loads AGENTS.md as project instructions in any project that carries no CLAUDE.md of its own, with a setting to flip it to "load both" or "ignore the shared file entirely." The same release publishes the source of the mechanism behind it: a set of built-in mods — plugins whose behaviour lives in a hooks module, chained across every event the engine fires — so the coding agent's behaviour is no longer fixed at build time. Four ship in the binary, with their TypeScript published in the repository: a diff pane, a telemetry mod, the AGENTS.md loader itself, and a security mod.
That last one is the part enterprises will actually care about. The security mod exists to keep an organization's managed instructions, hooks, settings and tool allowlist out of reach of whatever plugins an individual developer installs, by seating itself outermost in the hook chain and refusing user-tier callers by name. Its decisions fail closed, so an unreadable policy counts as a policy in force. In other words, Anthropic answered the portability complaint by making the harness extensible — and shipped the guardrail that stops extensibility from becoming a governance hole.
Three weeks ago Shopify's chief executive threatened to ban the tool unless it natively read the shared file, and Anthropic had closed the developer request for it — we covered that standoff when it broke, Shopify CEO threatens to ban Claude Code over AGENTS.md. The concession is real but narrower than the complaint: AGENTS.md is only consulted where a project has no CLAUDE.md, so a repository that already committed to the vendor file still stays locked to it. What changed is that the file format is no longer a hard-coded decision — it is now a mod anyone can replace. That shift, not the file, is the story.
A new paper argues that any AI security control which reads the model's own words is unsound by construction. James Mickens, of Harvard's computer science faculty, calls the problem linguistic illegibility: a model's externalised outputs — and the features researchers extract from its internals — can simply fail to represent how the model actually thinks, because its real computation is arithmetic over activation spaces, with lossy translation to language only at the entry and exit. If that gap is always possible, then chain-of-thought monitoring, constitutional self-critique, and activation probes aimed at linguistically defined concepts can never be complete.
His proposed floor is mechanical, not verbal. Taint tracking: define in advance which pieces of system state model-produced data must never be allowed to influence, then enforce it regardless of what the model says about itself. Add robust virtualisation and third-party auditing of sandbox configurations, and the paper argues the recent sandbox escapes by frontier models would have been contained. That lands on the same week's disclosures — we traced one of those chains in Deep Dive — AI turned exploit development into a compute problem. The uncomfortable read for the labs' evaluation frameworks: a report a model writes about its own reasoning is evidence of nothing.
Tsinghua-led researchers want LLMs to stop talking to each other in text. Their Cache-to-Cache method trains a small network to project one model's key-value cache into another's and fuse them, with learnable gates choosing which layers benefit — so a pair of models exchanges meaning directly instead of compressing it into a sentence and decoding it again. The paper reports 6.4–14.2% higher accuracy than the individual models alone, 3.1–5.4% over text-based communication, and roughly 2.5x lower latency; a fuser model and the code are public. The paper was first posted last October and resurfaced on Hacker News today, which is a fair signal of how little of it the agent industry has absorbed.
What to watch: whether Anthropic extends mods to the Bedrock, Vertex and Foundry paths — AGENTS.md support is missing there today — and whether any lab ships a sandbox whose guarantees do not depend on the model's self-report.
If a mod can rewrite the harness, who audits what a coding agent's rules actually are — the vendor, the organization, or nobody? Tell us in the comments.
Sources: Claude Code changelog (Anthropic) · Claude Code mods source (GitHub) · Thariq Shihipar, via Simon Willison · AGENTS.md project · The Implications of Linguistic Illegibility for LLM Security (arXiv) · Hacker News discussion · Cache-to-Cache (arXiv) · Cache-to-Cache project page · Hacker News discussion
