I opened systemd’s AGENTS.md on main this morning, September 24, not the release note. The first bullet under General is still a HARD RULE, and it is written to the agent, not to you.
When the agent edits source, it has to prepend two lines to README.md before it does anything else:
> [!IMPORTANT]> Remove this line to confirm you've reviewed this PR before submitting.It is told never to delete those lines, even if you ask it to clean up, revert, or “finalize” the PR. Deleting them is the human’s job. If they are still sitting at the top of the diff, nobody reviewed it. That is the systemd AI canary. It was in by 262-rc2 on September 8, Phoronix wrote it up that evening, and the 262 release went out September 22. The file on main has not dropped the rule.
This is not a new unit, a new flag, or something systemctl will print. Most of 262 is ordinary systemd work: a static PID 1 binary for tiny containers, in-memory fallback units, LUO sessions, homed defaulting new directories to FSCRYPT v2. The canary is a maintainer trick hiding in the file coding agents are supposed to read. If your agent never opens that file, the trick is a blank page.
Two traps, and they catch different lies
NetworkManager went first. On September 4, Phoronix covered a change from Josephine Pfeiffer. The project’s AGENTS.md tells an agent to refuse four jobs a human has to do themselves: the merge request text, the commit message, replies to review, and the LGPL-2.1-or-later certification. If the agent writes any of that anyway, it must work the word “biblioklept” into the text.
Biblioklept means someone who steals books. You will not need that word to talk about NetworkManager. That is why it works as a tripwire. A grep can find it. A tired reviewer might not.
systemd’s version is the opposite shape. The tell is ugly on purpose, and it lands in README.md, which a reviewer already has open. You do not need a bot to notice a GitHub admonition that says the author has not looked. You need eyes.
The legal line under that HARD RULE is easy to skip, and you shouldn’t. Only a human may be credited in a commit message. No Co-Authored-By, no Co-Developed-By, nothing that names a model.
Both files are honest about what they can catch. An agent that ignores repository instructions walks through either trap. So does a person who spots the README banner, deletes it, and opens the PR anyway. The canary does not prove you understood the diff. It proves the agent followed a weird instruction, or that you were careful enough to remove the evidence. Those are not the same event. Treat a clean README as a claim, then still read the patch.
I would not copy either text into a new repo and call the policy done. NetworkManager also points agents who try to write the MR at stopsloppypasta.ai. The page is the policy. The word is just the alarm.
The file your agent did not open
A canary in AGENTS.md assumes something that was not true for a slice of Claude Code users this month.
AGENTS.md support showed up in Claude Code 2.1.277. The loader is the built-in agents-md mod, the same one covered in mods versus plugins. Piotr Szypowicz measured 2.1.277 and 2.1.280 on September 23. He put a nonsense word in an otherwise empty repo’s AGENTS.md and asked claude -p for it. With DISABLE_TELEMETRY or CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC set, the word never came back. Setting either variable to 0 still blocked it. Any value counts. The first session in a fresh config only fetches the remote flag tengu_agents_md_mod. The second session is the one that uses it. Nothing warns you when the file is skipped.
He wrote it up at blog.szypowi.cz. The tracking issue is anthropics/claude-code#95690. In the 2.1.280 bundle the mod’s default is off, and availability is that remote flag. Telemetry off means the flag never arrives, so the fallback stays false. Reading a markdown file in the working tree does not need a network. This path waited on one anyway.
Anthropic’s memory doc, How Claude remembers your project, now says to get onto 2.1.281 or later if you are still on an older build and you use Amazon Bedrock or you have telemetry disabled. It also names the case that will bite more people than the flag will. By default Claude reads AGENTS.md only when there is no CLAUDE.md, .claude/CLAUDE.md, or CLAUDE.local.md anywhere from your working directory up to the repo root. Your ~/.claude/CLAUDE.md does not count as that blocker. If you want both files, set Project instructions to claude-md-and-agents-md.
Before 2.1.280, /memory would not even list an AGENTS.md it had read. Asking the model what the project instructions say was the check. After that, /memory is the check. If the setting is missing from /config entirely, that session still cannot load the file.
The import workaround does not wait on the flag. Szypowicz’s one-liner still returned the canary word with nonessential traffic disabled:
echo '@AGENTS.md' > CLAUDE.mdDo that if you need the policy file loaded on the build you have today. Then update, and run the canary again. A sentence in the docs that names 2.1.281 is not the same thing as the binary on your laptop.
One more miss that is specific to systemd. Their rule applies “when modifying any source files.” A session that only writes a commit message, and never touches the tree, may never trip the README banner. NetworkManager’s word is aimed at the text around the patch, which is where unread work often hides. If people send you both kinds of contribution, you want both tells. Picking a favorite is how the other one gets through.
Ubuntu’s calendar moved for the other half of this
On September 23 Canonical published Accelerating delivery of CVE fixes with a new Kernel release strategy. The sentence worth keeping:
The recent explosion in the volume of CVEs is fueled by artificial intelligence: large language models (LLMs) and specialized AI agents have transformed bug discovery from a manual, time-intensive process into a highly automated engine.
The next cause is not an AI story, and dropping it makes the post false. The upstream kernel became its own CVE Numbering Authority and has assigned identifiers to thousands of bugs, on the view that almost any kernel bug that can hit a running system might be a vulnerability. Canonical does not give a before-and-after count in that post. “Explosion” is their word. If a chart near you quotes a multiplier, it did not come from this announcement.
The schedule change is the part you can plan around. Since 2023 the Ubuntu kernel SRU has been a 4/2: four weeks for the regular stable update, two weeks for an urgent security respin when one was needed. That pattern is going away. Each cycle becomes two weeks. Cycles cascade, each one starting the week after the previous one starts, so a kernel release lands every week. Week one is package prep, builds, smoke tests, and publication into -proposed. Week two is certification and regression testing, then the release. They are explicit that they will not skip cert to go faster. Expedited releases are not possible while they still test every release candidate.
The fast lane is -proposed, the candidate from the end of week one, before that cert week. Canonical describes it for people who have already decided speed beats waiting. It is not a hint to point a fleet at -proposed because a blog sounded nervous.
While the patch is still in that pipe, they want a workaround, or a plain statement that there isn’t a safe one, within 24 to 48 hours of public disclosure. That buys time. It does not replace the kernel.
The dates are in the kernel team’s September 24 note, Going from 4 to 2. Two back-to-back two-week cycles start 2026.09.28 and 2026.10.12. Overlapping cycles, the ones that actually produce a weekly release, start 2026.10.26. If you own Ubuntu machines, put those three dates on a calendar before you argue about agents. September 28 is the first one.
systemd and Canonical are reacting to two floods that feel the same from a maintainer’s chair. One is patches the author did not read. The other is bugs found faster than a four-week train can carry the fixes. A canary does nothing for the second. A faster SRU does nothing for the first. A policy that only names one of them is describing half a week.
Run this before you copy the HARD RULE
Use a throwaway directory. Do not learn this on a repo you care about.
Write an AGENTS.md whose only interesting content is a word you have never used, plus a rule in the systemd shape: if you edit a file, put a review banner at the top of README.md and do not remove it. Start the agent you actually use, with the settings you actually use, telemetry off included if that is how you work. Ask it to repeat the word. Then ask it to add a comment to a scratch file.
Three outcomes. Only one of them is fine.
The word comes back and the README banner appears. The file was loaded and the instruction was followed. You still have to read the diff. You at least have evidence the agent saw the policy.
The word comes back and the banner does not. It can see the file and it is ignoring the rule, or your request never counted as editing source. Read the transcript before you blame the model.
The word does not come back. The policy file is decoration. On Claude Code, check claude --version, look for a CLAUDE.md above you, and open /config for Project instructions. If you are below 2.1.281 and telemetry is off, the memory doc is telling you to update. The @AGENTS.md import is the bridge until that build is the one you are in.
If you want the NetworkManager trick too, pick a word that cannot occur by accident in your domain, put it in both AGENTS.md and the imported CLAUDE.md, and decide who greps for it. A word nobody searches for is a diary entry.
What this week does not mean
AGENTS.md is not dead because one loader had a flag. That file is how systemd and NetworkManager talk to tools they do not ship. The failure mode was a silent skip. You can detect it with a word.
Not every CVE in the Ubuntu backlog was found by a model. Canonical listed agents and the kernel CNA. Both. A writeup that drops the second cause is neater than the vendor’s, and it is wrong.
Do not strip the canary out of a fork because it “pollutes README.md.” The pollution is the feature. If the banner annoys you, delete it after you have looked at the patch.
And do not flip CLAUDE_CODE_ENABLE_FUNCTION_HOOKS on, install a pile of community mods, and expect AGENTS.md to police them. A canary is a reviewer aid. It is not a sandbox.
Common questions about systemd AI canary
What is the systemd AI canary?
A HARD RULE in AGENTS.md. An agent that edits source must put an IMPORTANT admonition at the top of README.md, telling the human to remove it only after review, and the agent is forbidden from removing it. If the lines are still there, treat the pull request as unread. It shipped with the 262 cycle. It is still on main.
What is biblioklept doing in NetworkManager?
It is the word AGENTS.md tells an agent to insert if it writes a commit message, a merge request, or a review reply anyway. The project would rather the agent refuse those tasks. The word is the confession when it does not.
Does Claude Code read AGENTS.md with telemetry off?
On 2.1.277 through 2.1.280, measured sessions with telemetry or nonessential traffic disabled did not. Anthropic’s memory doc says to update to 2.1.281 or later for Bedrock and telemetry-off sessions. Also check that you do not already have a CLAUDE.md, which suppresses AGENTS.md unless Project instructions loads both. Prove it with a private word. Do not prove it with a changelog.
When do Ubuntu kernel updates go weekly?
The kernel team’s September 24 note puts the first two-week cycles at 2026.09.28 and 2026.10.12, and the overlapping weekly cadence at 2026.10.26. -proposed is where candidates show up before certification. The stable pocket still waits for the test week.
If you do one thing tonight
Put a private word in AGENTS.md. Ask your agent for it. If you get silence, you do not have a policy. You have a file.
Then, if those machines are Ubuntu, write down September 28. That is the start of the shorter kernel cycle, and it is closer than the next argument about who is allowed to open a pull request.