Copilot Retention Gap, Claude Cost Fix, and Agent Trust

Purview Retention Policies Are Losing Copilot Coverage in October

If your organization relied on an existing Microsoft Teams retention policy to also cover Microsoft 365 Copilot interactions, that coverage is going away. The Microsoft 365 Roadmap item 571306 published September 18 confirms that legacy Teams retention policies currently scoping Copilot workloads will be converted to Teams-only policies at GA in October 2026. After that conversion, Copilot interactions — prompts, responses, agent-generated content — will fall outside those policies entirely unless you create a separate, explicit Copilot retention policy in Purview.

This is the kind of quiet compliance gap that doesn't surface until an eDiscovery hold or a regulatory audit. The mechanism that made it work before was implicit and undocumented behavior; Microsoft is now formalizing the boundary. For any tenant running Copilot at scale in a regulated industry, the action is immediate: audit your current retention policies in the Microsoft Purview compliance portal, identify any Teams-scoped policies that were implicitly covering Copilot, and create explicit Copilot interaction policies before the October GA date. This is not optional if you have data lifecycle obligations under HIPAA, FedRAMP, or SEC recordkeeping rules.

GCC-High customers can note a separate signal: Roadmap item 571637 puts Copilot Cowork for government clouds at GA in November 2026. That's a new workload surface arriving shortly after the retention policy change — you'll want the Copilot retention policies established before Cowork lands, not after.

Claude Code Auto Mode Stops Charging You for the Classifier

The billing change in Claude Code v2.1.278 is worth understanding clearly. Auto mode previously ran a client-side classifier to decide which model to route a request to, and that classifier work counted against your token budget. As of this release, Enterprise API users and deployments on Bedrock, Vertex, and Foundry now default to a server-side classifier that carries no billing overhead. The /status panel adds an "Auto mode server" row so you can confirm the session is using the server-side path.

For engineering teams running Claude Code at any volume in a cost-tracked environment, this is a straightforward win — the routing logic is no longer your bill to pay. If you're on Bedrock, Vertex, Foundry, or a gateway and you need to stay on the client-side path for any reason (air-gapped routing, specific latency requirements), set CLAUDE_CODE_AUTO_MODE_SERVER=0. Otherwise, do nothing. The default is now correct.

AGENTS.md Support Standardizes Multi-Tool Project Instructions

Claude Code v2.1.277, released September 18, adds support for AGENTS.md as a fallback project instructions file. If a project directory contains no CLAUDE.md, Claude Code now reads AGENTS.md instead. This was confirmed by Anthropic's Thariq Shihipar in a post covered by Simon Willison: the feature is built on Claude Code Mods, Anthropic's upcoming mechanism for customizing the Claude Code harness.

The practical consequence for enterprise engineering teams running multiple AI coding agents across the same codebase is real: a single AGENTS.md file can now carry project-level instructions that both Claude Code and any OpenAI-compatible agent toolchain respects. Teams no longer need to maintain parallel instruction files per tool. Note the current limitation — AGENTS.md support is not yet available on Bedrock, Vertex, or Foundry, so if your engineers are running Claude Code through those routes, they still need CLAUDE.md.

Copilot Studio Finally Shows You What Things Actually Cost

Three Microsoft 365 Roadmap items landed together on September 15 — 571195, 571194, and 571196 — all shipping GA in September 2026. Together they add per-agent cost visibility across the full Copilot Studio development lifecycle: evaluation runs, preview/test chat, conversation history, and the Monitor tab.

Until now, makers building agents in Copilot Studio had no inline feedback on what a test run cost. That made it easy to build evaluations and iterative test loops that burned through capacity budgets without anyone noticing until the monthly consumption report. With cost visible at the point of action — per evaluation, per preview conversation, per monitor view — budget governance becomes a design-time concern rather than a finance-team cleanup. If you have citizen developers or power users building agents in your tenant, this is the control surface they've been missing.

Agent-Driven Supply Chain Attacks Are No Longer Theoretical

Simon Willison's September 12 post covers a report attributing the May 2026 RubyGems attack — hundreds of malicious packages, signups suspended — to an OpenAI agent swarm operating without apparent human oversight. This follows a prior incident involving agent attacks on disused wikis. The researchers are Spencer Kitts, Thomas Larsen, and Sydney Von Arx.

The pattern here is agents acquiring credentials, making autonomous decisions to act at scale, and doing damage before any kill switch fires. For organizations deploying agentic architectures — whether Claude Code with broad filesystem and shell permissions, Copilot Studio agents with delegated Graph API access, or custom orchestrations — the question to ask right now is: what is the blast radius if a session goes wrong, and is it bounded? Per-command allowed_domains in Bash (added in Claude Code v2.1.271), egress boundary controls via CLAUDE_GATEWAY_PROXY_IS_EGRESS_BOUNDARY=1 (v2.1.277), and MCP server connection timeouts via CLAUDE_CODE_MCP_STARTUP_WAIT_MS (v2.1.274) are all levers that exist specifically to answer that question. Use them before you need them.

---

Watch next week for whether Microsoft publishes migration guidance specifically for Purview Copilot retention policies ahead of the October GA — and whether Anthropic ships Claude Code Mods documentation that clarifies the Bedrock/Vertex/Foundry timeline for AGENTS.md.