Devin Desktop 3.8.20 turned on ACP terminal sharing by default in August 2026

Summary. Cognition shipped Devin Desktop 3.8.20 on 21 August 2026 with two new settings that control "whether integrated terminal activity and local user-edit activity are shared with ACP agents", and the release notes state plainly that "both remain on by default". Agent Client Protocol agents run inside Devin Desktop for Pro ($20/month), Max ($200/month) and Teams ($80/month minimum) users. Cognition's own ACP page warns that when an external ACP agent is used, "Devin Desktop's privacy policy and legal terms do not apply, and billing is directly between you and the third-party agent provider". The FedRAMP Security Admin Guide, which promises "a reference table of all admin-controlled security settings", lists exactly three settings and was last updated 28 January 2026. It contains no ACP entry at all.

That gap is the story. Two defaults changed on a Friday; the pages an administrator would read to govern them did not.

What actually shipped

The Devin Desktop changelog for v3.8.20, dated 21 August 2026, is mostly workspace ergonomics: the Agent Command Center now follows the selected space rather than a single folder, a new devin.agentWindow.location setting splits it into its own window, and switching between Agent and Editor mode with Ctrl/Cmd+G got faster. Two items in the Devin Local section matter more than the rest.

The first: "New settings control whether integrated terminal activity and local user-edit activity are shared with ACP agents (both remain on by default)." The second, in the enterprise block, adds "a link to request more usage when hitting ACU limits" - which maps to the Request more button documented in Cognition's usage policies page.

Read together, those two say something specific. Your organisation can now cap what a developer spends on Devin, and at the moment they hit that cap the product offers them a route to a third-party agent whose spend it does not meter and whose terms it does not govern.

Why "on by default" is the load-bearing phrase

ACP is an open protocol, published at agentclientprotocol.com, that standardises how editors talk to coding agents the way LSP standardised language servers. It runs over JSON-RPC 2.0, and the spec is explicit that agents "typically run as subprocesses of the Client". The client feeds the agent context; the agent acts.

Cognition lists OpenAI's Codex CLI, Anthropic's Claude Agent, OpenCode, JetBrains Junie and Google's Gemini CLI as agents you can plug in. Each is a separate vendor with separate terms. The 3.8.20 defaults mean that, unless someone changes them, an enabled ACP agent receives a stream of what your engineer types into the integrated terminal and what they edit locally.

Integrated terminal output is not incidental data. It is where connection strings get echoed, where kubectl prints cluster context, where a failing test dumps a fixture containing production-shaped records, where an environment variable shows up in a stack trace. Local user-edit activity is the working diff before review. Both are being handed to a process governed by someone else's privacy policy, and Cognition says so in its own documentation.

The governance gap, control by control

Cognition's Local Agent Controls page tells enterprise admins the control surface covers "features, models, permissions & security, MCP/ACP, codebase intelligence, sharing, and compliance", and points readers to the Devin CLI team settings page for "the individual settings and their meanings". Follow that pointer and the ACP controls are not there. The team settings page documents models, web search, MCP servers, MCP registry, terminal permissions, sandbox enforcement, attribution filtering and the CLI install toggle. No ACP section. No sharing section.

The contrast with MCP is the clearest way to see the maturity gap.

Control	MCP (documented)	ACP (undocumented)	Consequence for an admin
Master on/off	Yes, a team-level toggle disables MCP server usage entirely	Not documented on the team settings page	No published way to disable third-party agents team-wide
Allowlist	Yes, Allowlisted MCP Servers; if empty, all servers are allowed	Team ACP Registry Config exists, but no enforcement toggle is documented	An allowlist you cannot prove is exclusive
Strict enforcement	Yes, MCP registry enforcement restricts users to your registries	Not documented	Users can edit ~/.windsurf/acp/registry.json themselves
Data sharing	Governed by MCP tool permissions (allow / ask / deny)	Two new client-side toggles, both on by default as of 21 Aug 2026	Default is share, and the default is set on the endpoint
Named in the FedRAMP settings table	No	No	The table lists three settings: RBAC, service key permissions, SSO

Two further mechanics make this harder to fix quickly than it looks. Local Agent Controls are cached, and Cognition asks admins to "allow up to 15 minutes for an update to reach members' clients". And an organisation-level override is a pure replacement, not a merge: the docs warn that if the root allows MCP servers A and B and an organisation overrides with C, members in that organisation get only C. An admin tightening ACP settings for one org can silently drop the rest of the enterprise baseline for that org.

ACP work does not consume ACUs, so your usage policy does not reach it

Devin Enterprise is billed in Agent Compute Units at a rate set in the customer's order form; Cognition publishes no list price and directs buyers to sales. Admins can cap consumption in two places. Organisation ACU limits stop all Devin activity for that org once the limit is reached. Per-user limits, currently in beta and requiring enablement by the account team, cap each member's monthly ACUs across both local usage (Devin Desktop, Devin CLI) and cloud usage, and Cognition states that "new work is blocked on all surfaces once the limit is reached".

All surfaces means all Devin surfaces. The ACP page puts external agents outside that boundary: billing "is directly between you and the third-party agent provider". A developer who has exhausted a 500 ACU tier can enable Codex CLI or Claude Agent through the Agent Command Center and keep working, on their own or a departmental card, with terminal and edit sharing left at the shipped default.

Surface	Metered by Devin	Covered by per-user ACU limits	Governed by Devin's terms
Cascade	Yes	Yes	Yes
Devin Local	Yes	Yes	Yes
Devin cloud sessions	Yes	Yes	Yes
Devin Review	Yes	No, explicitly excluded	Yes
Third-party ACP agent	No	No	No, per Cognition's ACP page

The blunt version: the tighter your ACU policy, the stronger the incentive it creates to route work through the one surface you cannot see.

How to tell whether this is you

Four checks, in order of speed.

Confirm the version. Help then About in Devin Desktop, or the changelog entry for v3.8.20. Anything at 3.8.20 or later on the stable channel has the new defaults.

Check whether ACP is reachable on your plan. Cognition states ACP agents are available for Pro, Max and Teams users, and that Enterprise admins "should contact their account team about enabling third-party agents". If your fleet is Teams rather than Enterprise, the feature is live without an account-team conversation.

Look for a local registry. The file is ~/.windsurf/acp/registry.json, or ~/.windsurf-next/acp/registry.json on the Next channel. Its presence on an endpoint means a user configured an agent themselves rather than taking a team registry.

Check the agent selector. Enabled ACP agents appear in the bottom-right selector when starting new conversations, alongside Cascade and Devin Local. If a third-party name is there, sharing is on unless someone turned it off after 21 August.

What to do this week

Action	Where	What it buys you
Turn both sharing settings off	Devin User Settings, per client; verify the effective value on a test machine	Stops terminal and edit streams to external agents
Set the team ACP Registry Config	Devin Settings, team level	A static list of approved agents instead of per-user files
Push settings by MDM policy	policy.json on Linux at /etc/windsurf/policies/policy.json, ADMX on Windows, .mobileconfig on macOS	A policy value "overrides the Devin Desktop setting configured at any level"
Use Restricted Mode on sensitive repos	Per workspace	Cascade, Devin Local and every ACP agent are disabled, and hooks neither load nor run
Assign a primary billing org explicitly	Enterprise settings	Makes it deterministic which org's overrides apply, instead of automatic resolution

The MDM route is the only one in that list that an individual developer cannot undo. Cognition documents the full policy list as shipping in the sample policy.json inside resources/app/policies in the installation directory rather than in the docs, so read the file from an installed 3.8.20 build rather than assuming the documented AllowedExtensions example is the whole set. The real work here is inventory, not configuration - you cannot turn off a setting on a laptop you did not know had the agent enabled.

What is still unknown

Cognition has not published the setting identifiers for the two sharing toggles, so there is no confirmed key to write into a policy file yet. It has not said whether the toggles are exposed as Local Agent Controls at the enterprise root level, or only as user settings on the client. It has not stated whether the pre-3.8.20 behaviour was to share the same data with no toggle at all, or to share nothing - the release notes describe new settings, not a new data flow, which is a meaningfully different thing to disclose to a security team. And the FedRAMP deployment on AWS GovCloud is described as lacking "some features described in other Devin Desktop documentation for the SaaS offering", without saying whether ACP is among them.

Those are questions for an account team, not for a changelog. Ask them in writing.

India-specific considerations

For an Indian engineering organisation, the exposure is a processor question. Under the Digital Personal Data Protection Act 2023, a data fiduciary stays accountable for personal data handled by processors acting on its behalf. Terminal output and working diffs on a laptop connected to a staging environment routinely contain personal data. Routing that stream to a third-party agent whose provider you have no contract with, because a client-side default was set to on, is a processor relationship nobody signed.

Teams running mixed fleets across Gurugram and offshore delivery centres have a second problem: the effective control set depends on the user's primary billing org, which Cognition resolves automatically to "the first organization the user can access" unless an admin assigns it. Two engineers on the same project can end up under different ACP rules. Assign the billing org explicitly before you tune anything else. The same discipline applies to enterprise AI agent governance layers generally: policy that is not deterministic is not policy.

FAQ

What changed in Devin Desktop 3.8.20?

Cognition released v3.8.20 on 21 August 2026. Among workspace changes to the Agent Command Center, it added new settings controlling whether integrated terminal activity and local user-edit activity are shared with Agent Client Protocol agents. The release notes state both settings remain on by default, so no action means data is shared.

Which third-party agents can receive this data?

Cognition names OpenAI's Codex CLI, Anthropic's Claude Agent, OpenCode, JetBrains Junie and Google's Gemini CLI as ACP-compatible agents that plug into Devin Desktop. Any agent implementing the protocol can be added through a local or team registry file, so the practical list is larger than the five examples documented.

Does Devin's privacy policy cover an external ACP agent?

No. Cognition's ACP documentation states that when using an external ACP agent, all agent operations are delegated to that agent, Devin Desktop's privacy policy and legal terms do not apply, and billing runs directly between the customer and the third-party provider. The contractual relationship sits outside Cognition entirely.

Do ACP agents count against per-user ACU limits?

No. Per-user limits cover local usage in Devin Desktop and Devin CLI plus cloud sessions, blocking new work on all Devin surfaces once reached. Because external ACP agents bill directly to the third-party provider, their usage is not metered by Cognition and is not constrained by an organisation or per-user ACU cap.

Can an administrator disable ACP agents across a team?

Not through any control documented on the Devin CLI team settings page, which covers MCP servers, registries, terminal permissions, sandbox enforcement and attribution filtering but has no ACP entry. Admins can push client settings through MDM policy files, which override the setting at any level, or use Restricted Mode per workspace.

What is Restricted Mode and does it help?

Restricted Mode is a per-workspace state in which agents are unavailable: Cascade, Devin Local and every ACP agent are disabled, and hooks neither load nor run. It is the one documented control that reliably stops third-party agent access, but it is scoped to a workspace rather than applied across a fleet centrally.

How long do enterprise control changes take to apply?

Cognition asks admins to allow up to 15 minutes for root-level or organisation-level control changes to reach members' clients, because both levels are cached. Organisation overrides replace root values rather than merging with them, so an override on a list control drops every root entry not restated explicitly.

Which Devin plans expose ACP agents?

The ACP documentation lists availability for Pro, Max and Teams users, priced at $20 per month, $200 per month and an $80 per month Teams minimum respectively. Enterprise administrators are told to contact their account team about enabling third-party agents, which implies a separate gate on that plan.

How eCorpIT can help

We run agent-tooling inventories for engineering organisations: which editors are installed at which version, which agents are enabled on which endpoints, and which of those data paths leaves the estate. Our senior engineering teams then convert that into enforceable policy through MDM rather than through settings a developer can toggle back. If you are rolling out Devin Desktop, Cursor or Copilot across a mixed fleet, book an AI coding agent governance review and we will start with the inventory, because that is where the surprises are. Our AI coding agent rollout governance service covers the same ground for teams standardising on one harness.

For the wider picture, see our guide to enterprise AI agents in production, the comparison of AI coding agent harnesses, and the write-up of Copilot MCP allowlists and enterprise managed settings.

References

1. Devin Desktop changelog, v3.8.20, 21 August 2026, Cognition
2. Agent Client Protocol in Devin Desktop, Cognition
3. Building a custom ACP agent, Cognition
4. Local Agent Controls, Cognition
5. Devin CLI Team Settings, Cognition
6. FedRAMP Security Admin Guide, Cognition
7. Enterprise Policies for Devin Desktop, Cognition
8. Usage policies: per-user ACU limits, Cognition
9. Enterprise billing and organisation ACU limits, Cognition
10. Self-serve plans and pricing, Cognition
11. Devin Local Agent and Restricted Mode, Cognition
12. Agent Command Center, Cognition
13. Agent Client Protocol v1 overview, Zed Industries
14. Plans and usage for Devin Desktop, Cognition
15. Security at Cognition, Cognition

Last updated: 23 August 2026.