The AI Engineering Brief

Issue #012 — 2026-09-21

What changed in AI engineering, September 14 – 20, 2026. Curated for senior engineers going AI-native. Every item sourced.

1. OpenAI's Agents API had its second week: turns stalled on Monday, containers overbilled by Friday

The harness we told you last week you could now rent instead of build spent its second public week on the status page twice. On September 14, from 13:30 Pacific (20:30 UTC), managed sessions on the Agents API could not start turns, or started them late; OpenAI marked the incident resolved at 23:39 UTC. On September 18 at 22:29 UTC a second incident opened: OpenAI-hosted containers in the Agent API were being charged more than they should have been. The mitigation landed early on September 19, with OpenAI stating that new sessions would not hit the problem and that it was identifying affected customers and calculating refunds. In between, on September 17, elevated error rates hit the API platform broadly — twelve listed components, from Chat Completions and Responses through Embeddings, Batch and Realtime — for about an hour: OpenAI's component record runs from 20:20 to 21:20 UTC, and the incident was marked resolved at 21:50 UTC.

Why it matters: none of this is an argument against renting the harness; it is the argument for renting it with your eyes open. A public-beta orchestration layer is a dependency that can fail in two ways, availability and metering, and this week it exercised both. If you have Agents API sessions running, reconcile container charges for the window from whenever you started through September 19 against your own session logs — the refund is OpenAI's to calculate, but the check is yours to make, and a metering bug that is caught by the vendor is still a bug your finance team will ask you about. More generally: every managed-agent product you adopt needs a budget alert you own, on a bill you can read, that fires before the vendor's status page does. That is the reconciliation half of our enforceable spend ceiling pattern, and it applied here within nine days of the product's launch.

Source: status.openai.com — Degraded Performance affecting Agents API, 2026-09-14 · status.openai.com — Overbilling for OpenAI-hosted containers in the Agent API, 2026-09-18/19 · status.openai.com — elevated error rates across API models, 2026-09-17.

2. Claude Code's auto-mode classifier moved server-side and became free — unless a gateway sits between you and the API

Before auto mode lets the agent run a shell command or make a network call, a safety classifier screens it, and until this week those screenings went out as separate model requests on your bill. From Claude Code 2.1.278 (September 19) Anthropic does the screening on its own side and charges nothing for it. That path is now the default on direct Claude API and Enterprise accounts, on the three cloud platforms (Bedrock, Vertex, Foundry), and behind gateways. It rides on the session's ordinary traffic as two fields: safeguards on the way out, safeguard_results on the way back. Both have to arrive intact, so any gateway that doesn't pass every header, field and stream event through untouched breaks the loop. Claude Code then pauses before its next checked action with a one-time notice (naming the gateway, if it can tell which one), and once you continue it runs the classifier calls itself again, and they land back on your bill. Two controls shipped alongside: an Auto mode server row in /status that reads Enabled or Disabled for the session, and CLAUDE_CODE_AUTO_MODE_SERVER=0, which skips the server attempt for a gateway you already know can't carry it. Anthropic describes that variable as temporary.

Gateway operators had more to absorb that week. On September 15, 2.1.273 gave them five hint headers, request class and agent type among them, which Claude Code only sends when CLAUDE_CODE_GATEWAY_HINT_HEADERS=1 is set; the same release made the local classifier the default on Bedrock, Vertex and Foundry; 2.1.278 undid that four days later. And on 2.1.275 (September 17), anyone whose ANTHROPIC_BASE_URL pointed at a proxy or gateway had every request broken with a 400, until 2.1.276 repaired it on the 18th.

Why it matters: if your team reaches Claude through a gateway, this was your week, and the decision is not whether to upgrade but whether your gateway passes traffic through unchanged. Check three things on Monday. First, pin or skip 2.1.275 in any image that sets ANTHROPIC_BASE_URL. Second, open /status in an auto-mode session and read the Auto mode server row — Disabled means you are still paying for the classifier. The usual cause is the gateway, not Claude Code, though on Bedrock, Vertex or Foundry it can also mean server-side checks have not reached your platform or region yet. Third, if you operate the gateway, the contract is now explicit: forward body fields you do not recognise, return response keys you do not recognise, and never rewrite tool-use IDs. Anthropic's gateway protocol page calls this feature pass-through, and it is the difference between a gateway that keeps working as features ship and one that quietly disables them. This is the same shape as the cache-accounting problem from #011: the request succeeds either way, and after the one notice is dismissed, the /status row is the only lasting record of which path you took.

Source: Claude Code changelog, 2.1.273 (Sep 15), 2.1.275 (Sep 17), 2.1.276 (Sep 18), 2.1.278 (Sep 19) · Auto mode classifier request charges, code.claude.com · Gateway protocol reference, code.claude.com.

3. Cloudflare AI Gateway can now refuse to bill your BYOK traffic to Cloudflare's credit balance — because until this week it silently would

Which credentials pay for an AI Gateway request comes down to a three-step fallback. A provider key carried on the request wins outright. Without one, the gateway uses a key you stored on it. Failing both, Cloudflare pays the provider with its own credentials and debits your credits. The trap is step two. On the Unified Billing endpoints (env.AI.run() and /ai/v1/chat/completions among them), Cloudflare's docs say "only the BYOK key stored under the default alias prevents fall-through to Unified Billing." Give your stored key any other name — production, staging, whatever you called it — and on that path it is never consulted: the request drops to step three, bills your credits, and raises no error. Cloudflare closed that gap on September 14 with a new switch: turn on Require provider credentials for the gateway (byok_only: true), or send the per-request cf-aig-no-wholesale: true header, and a third-party request with no matching credentials now gets a 400 instead of quietly running on your credits. Workers AI calls aren't touched by the setting, and the header can only make the gateway stricter — it can't override a gateway that already requires credentials.

Two smaller money facts landed on the same product. Cloudflare's 50% promotion on openai/gpt-5.6-sol through Unified Billing ended on September 18; the model is back to $5 / $30 per MTok ($0.50 cache read), from $2.50 / $15 ($0.25) during the promotion. And credits bought for Unified Billing carry a 5% purchase fee, which is the surcharge your fall-through traffic was paying without your knowing.

Why it matters: this is a spend-control fix, but the sharper consequence is contractual. A request that falls through is served on Cloudflare-managed credentials rather than your own provider account: a different bill (your prepaid credit balance), a different data-retention posture (the gateway's ZDR setting applies only to that path), and list rates rather than anything you negotiated with the provider. If you bring your own keys, turn the guard on now, and then go looking for the 400s: each one is a call site that has been running on someone else's credentials. If you rely on the fall-through deliberately as a failover, make that a decision in your configuration rather than an accident of alias naming. Either way, budget and credential path are two controls, not one — a ceiling on the wrong bill catches nothing, which is why the enforceable spend ceiling belongs in code that can see which path a request took.

Source: Cloudflare changelog — Prevent Unified Billing fallback for BYOK third-party providers, 2026-09-14 · Unified Billing docs — credential precedence, checked 2026-09-24 · Cloudflare changelog — GPT-5.6 Sol promotion, 2026-08-19, promotion end 2026-09-18.

4. Anthropic put compaction on demand: a signed summary block you request in the background and swap in when it lands

Until September 14, a Claude API conversation was compacted only when it crossed a token threshold you set, and the API then summarised it mid-request. The compact-2026-09-04 beta puts the trigger in your hands. A request that carries a top-level compaction: {"type": "summarize"} parameter gets no reply at all, just one signed compaction block. Every request after that leads with the block and drops the turns it covers. The summariser sees your tool definitions and system prompt but executes no tools. Its call is priced like any other request. If the default summarisation prompt doesn't suit you, replace it with your own instructions, capped at 16,384 characters. The doc lists the beta on the Claude API, Claude Platform on AWS, Google Cloud and Microsoft Foundry, with Amazon Bedrock marked not available, for the Fable, Mythos, Opus and Sonnet lines back to 4.6.

Why it matters: if you own a client-side summariser for long-running agents, this is the week to decide whether it earns its keep. The features people build those summarisers for — keeping the last few turns intact after the summary (their thinking too, on models that preserve it, as long as the system prompt and tools stay the same), and compacting without making the agent wait — are now the vendor's, with a signature that lets the server trust the block. Three details deserve a test before you switch. The summarisation response reports input_tokens: 0 and output_tokens: 0 at the top level, with the real spend under usage.iterations; a cost tracker that reads the top-level fields will book the call as free. The swap, where you delete the summarised turns and put the block in, can go wrong three ways, and only one of them is loud: a summarised message left ahead of the block gets the request rejected with a 400 (compaction_block_misplaced). The other two fail silently: drop the block from a later call and the model carries on with no record of the summarised stretch; leave a summarised turn after the block and the model reads that turn twice, once condensed in the block and again in full after it. And after the swap, re-send any image, document, uploaded container file or fetched URL the agent still needs; the block doesn't carry them. Where the summary boundary falls, and what has to survive it, is the core of our context engineering workflow; the API now gives you the primitive, but the decision about what the summary must retain is still yours to write into instructions.

Source: platform.claude.com release notes, September 14, 2026 · Compaction on demand, platform.claude.com.

5. Correction to #011: the deny-rule fix we pointed you at was reverted — and a settings command was writing rules that never matched

Last week we listed four Claude Code permission-rule fixes worth copying. One of them was gone within the week. The 2.1.273 entry in the changelog (September 15) records it: "Reverted a 2.1.268 change that checked Read and Edit deny rules on Bash lines the permission checker can't analyze (eval, env -C); commands like time -p make build prompt again instead of being denied". Put plainly, the check aimed at opaque commands was catching routine ones too, and those lines are back to asking you first. The same release tightened two other spots: bypass mode now sees a dangerous rm that a subshell used to hide, and with blockReadsOutsideWorkingDirectories on, a command too tangled for the checker to read now stops for a prompt instead of running unasked. A day earlier, 2.1.271 (September 14) had closed a separate set of checker blind spots: files a wildcard expanded to when it appeared in a pattern or option value, a file read that followed an option the checker didn't know, variable-declaration flags that disguised the real command, and cd+git chains that ran without a prompt in bypass and auto mode under that same read-blocking setting.

The smaller fix is the more instructive one. /update-config had been generating Write(path) rules — a shape the file permission checker simply doesn't recognize, so the rule sat in your settings doing nothing. 2.1.275 (September 17) fixed the command to write Edit(path) instead, the form the checker actually matches. Three more trust fixes landed that week, none of them about permission rules. Installing a plugin from npm no longer executes the package's install scripts, and the package is integrity-verified (2.1.275). In 2.1.277 (September 18), a subagent can no longer speak in the session's voice: its reply now comes back indented, under a header that labels it as subagent output. The same release's changelog also reads: "Improved prompt handling: invisible Unicode formatting and tag characters in a prompt are removed and the cleaned prompt is shown for review before it is sent".

Why it matters: the correction first. If you upgraded past 2.1.268 for the eval/env -C deny check, you no longer have it; a deny rule on Read/Edit is not applied to lines the parser cannot analyse, and your protection there is the prompt, not a block. Then the common thread: a fix that over-reached and was reverted, and a rule shape that was written by the tool itself and never matched, are both the same lesson as last week, stated harder. A permission config is a claim. grep -n 'Write(' ~/.claude/settings.json and every project's settings this morning is a five-second audit that would have found the second bug. And the three boundary changes are worth copying into any harness you build: never run a dependency's install scripts on an agent's behalf, frame anything a subagent returns as data rather than instruction, and normalise invisible characters before the model sees a prompt. The capability latch covers the next step: once a turn has taken in untrusted content, its write-capable tools switch off.

Source: Claude Code changelog, 2.1.271 (Sep 14), 2.1.273 (Sep 15), 2.1.275 (Sep 17), 2.1.277 (Sep 18).

6. Two managed-agent runtimes shipped new versions — one forces a migration in 18 days

Google shipped antigravity-preview-09-2026 on September 17 and put the May build on notice — it shuts down October 5, eighteen days out. How much that costs you depends on how you're using it. Reading text back from Google's remote sandbox, and nothing else, means swapping the agent string is the whole migration. Anyone running tools locally, or parsing function_call output, has more to do: parameters moved from snake_case to PascalCase, file edits switched from full rewrites to line-range replacements, file reads switched from byte offsets to line ranges, and two search tools showed up that didn't exist in May.

AWS took the opposite approach on September 18. The new AgentCore Runtime is something you ask for: you opt in per runtime by choosing platformVersion V2 at create or update time, in any of five regions (us-east-1, us-east-2, us-west-2, eu-west-1, ap-northeast-1), and a tenant that doesn't ask sees no change. AWS's own testing puts V2 at a "P75 cold start of 1.9 to 2.0 seconds" on images of 200 MB up to 2 GB, where V1 took 5.4–30 seconds, and AWS credits the gain to snapshot-restore startup. The cost change is memory: V2 gives back memory the agent stops using while the session is still running, so an agent that spikes once no longer pays for that spike until the session ends.

Why it matters: these are two answers to the same question — how much notice does a managed harness owe the code running inside it — and the two vendors gave opposite ones. Google moved the tool contract and set a clock; AWS versioned the runtime and left the old one where it was. The decision for you is the same either way: if your agent's behaviour depends on the shape of a vendor-supplied tool, pin the version string in config, own the parser for its outputs, and have a test that fails when a parameter name changes. On Antigravity the deadline is real and short: if you parse function_call steps, you have until October 5. On AgentCore, V2's cold-start figures are large enough to change a scale-to-zero decision you may have made against V1 — but measure it on your image before you re-plan around a vendor's P75. And on both, memory and cold start are now line items, so the cost model you built in the spring is stale.

Source: Gemini API changelog, September 17, 2026 · AWS What's New — The new AgentCore Runtime is now available, 2026-09-18.

The Brief is the filter, not the firehose — every item sourced, every one with a reason to care. Members go deeper in the curriculum; the sample lesson is open to everyone.