Devin Desktop v3.8.20 shares terminal output and local edits with third-party ACP agents by default

Summary. Devin Desktop v3.8.20, released 21 August 2026, added settings that control "whether integrated terminal activity and local user-edit activity are shared with ACP agents", and states plainly that "both remain on by default". ACP is the Agent Client Protocol, the mechanism Devin Desktop uses to run third-party agents such as OpenAI's Codex CLI, Anthropic's Claude Agent, JetBrains' Junie, Google's Gemini CLI and OpenCode inside its Agent Command Center. Devin's own Agent Client Protocol page warns that when an external ACP agent is in use, "Devin Desktop's privacy policy and legal terms do not apply". So the default posture is that your terminal activity and your local file edits flow to an agent process governed by somebody else's terms. That page does not mention either new setting. Neither does the custom ACP agent page. The toggles exist only in the changelog entry that announced them. The team registry has a second gap: Devin's published sample still declares OpenCode version 1.15.7, released 21 May 2026, while the current OpenCode release is v1.18.21 from 21 August 2026, and Devin states it does not fetch the archive at all.

What v3.8.20 actually changed

The Devin Desktop changelog entry for v3.8.20, dated 21 August 2026, lists the change under Devin Local: "New settings control whether integrated terminal activity and local user-edit activity are shared with ACP agents (both remain on by default)."

Two things follow from that sentence. The settings are new, which means until 21 August 2026 there was no toggle at all. And the defaults are unchanged, which means an existing installation that updates keeps sharing both streams until somebody goes looking for a setting that no documentation page describes.

The same release added a related control in the opposite direction. The agent sidebar, composer and welcome page now warn when a workspace is untrusted and offer a trust prompt before local agents activate. That is a genuine improvement, and it is also absent from the ACP documentation.

Control added in v3.8.20	Default	Documented on the ACP page?
Share integrated terminal activity with ACP agents	On	No
Share local user-edit activity with ACP agents	On	No
Untrusted-workspace warning and trust prompt	Warn	No
Agent Command Center location (devin.agentWindow.location)	Combined with editor	Not on the ACP page

Why the default matters more here than in most tools

Most editor telemetry settings send data to the vendor you already have a contract with. ACP does not work that way, and Devin says so directly. The ACP page carries this note: "When using an external ACP agent, all agent operations are delegated to the agent. Devin Desktop's privacy policy and legal terms do not apply, and billing is directly between you and the third-party agent provider."

Read that alongside the default. Terminal activity in a working repository routinely contains connection strings printed by a failed migration, tokens echoed by a misconfigured script, internal hostnames, customer identifiers in test fixtures and the full output of whatever kubectl command someone ran. Local user-edit activity is the shape of your unreleased code. Both were shared by default with a process that Devin's terms explicitly do not cover, and until this release there was no switch.

The agents Devin names as examples are not obscure. Its page lists Codex CLI, Claude Agent, OpenCode, Junie and Gemini CLI. Each of those has its own data handling, its own retention policy and its own jurisdiction. A team that has approved one of them has not approved the other four, and the registry mechanism does nothing to stop a developer adding any of them locally. The same fragmentation shows up whenever a team compares an AI coding agent harness across Claude Code, Codex and Copilot CLI: the agents differ far more in what they read than in what they write.

The team registry is a launcher, not a distribution channel

Devin gives administrators an "ACP Registry Config" setting so a team can maintain "a static registry of approved ACP agents". The obvious reading is that the registry controls what runs. It does not.

Devin's own note is explicit: "For security reasons, Devin Desktop does not currently download agent distributions directly from the registry. The agent binary is expected to already be installed on the user's machine, the registry config tells Devin Desktop how to launch it. The distribution.binary.<platform>.archive URLs in the sample below are part of the ACP registry schema for compatibility with the wider ecosystem, but Devin Desktop does not fetch them today."

So the registry entry declares a version, points at an archive, and then launches whatever binary the named command resolves to on the user's PATH. There is no download, no checksum and no version check.

The published sample makes the gap concrete. Devin's sample team config for OpenCode declares "version": "1.15.7" and archive URLs under the v1.15.7 tag. OpenCode v1.15.7 was released on 21 May 2026. The current OpenCode release is v1.18.21, published on 21 August 2026, the same day Devin Desktop v3.8.20 shipped. An administrator who copies the sample gets a registry that says 1.15.7 and a developer machine that runs whatever ./opencode happens to be.

Registry field	What it looks like it does	What Devin says it does
distribution.binary.<platform>.archive	Downloads the agent binary	Not fetched today, present for ecosystem compatibility
version	Pins the agent version	Declarative only, no check against the installed binary
cmd and args	Names the executable	The only field that has an effect, resolved from PATH
Team registry as a whole	Approved-agent allowlist	A launch manifest for binaries installed by other means

That is worth stating plainly, because it changes what an approval means. Approving an ACP agent in the team registry approves a name and a command, not an artefact.

Who is affected, and how to tell

ACP is not unique to Devin. Zed runs Devin's CLI as a custom ACP agent in its own Agent Panel, and the Zed 1.16.1 release sits in the same weekly cadence, so a developer may be reaching the same agents from two editors. ACP agents are available to Pro, Max and Teams users. Devin tells Enterprise administrators to contact their account team about enabling third-party agents, so Enterprise is gated separately.

Check three things. First, whether any ACP agent is enabled at all: the toggles live in Devin User Settings under the Agents tab, reachable from the command palette with Cmd+Shift+P on macOS or Ctrl+Shift+P on Windows and Linux. Second, whether a local registry file exists. On Devin Desktop that is ~/.windsurf/acp/registry.json, and on Devin Desktop Next it is ~/.windsurf-next/acp/registry.json. A developer can create either without any administrator involvement. Third, whether your build of Devin Desktop is at least v3.8.20, because on anything older the two sharing settings do not exist and cannot be turned off.

One escape hatch is documented. Devin's Devin Local page says that in Restricted Mode "agents are unavailable in it: Cascade, Devin Local, and every ACP agent are disabled, and hooks neither load nor run". That is a blunt instrument and it also disables the agents your team paid for, but it is the one setting that stops everything.

The judgement here is straightforward. A default that shares data with a party your vendor's terms do not cover should be a decision somebody makes, not a decision somebody inherits from an update. Teams that already run an AI coding agent rollout governance process will recognise the pattern: the control arrives after the capability, and the default carries the risk in between.

What to do this week

Set both sharing toggles to off unless a named person has approved the specific third-party agent and read its retention policy. Treat the local registry file as a configuration artefact worth monitoring, because it is a user-writable file that determines which external binary the editor launches. If you maintain a team registry, record the agent version you actually expect on developer machines somewhere the registry cannot silently contradict, since the version field does not enforce anything. And pin the Devin Desktop version in your rollout, because the settings only exist from v3.8.20 onward.

The same release fixed a Linux packaging bug worth knowing about if you deploy the .deb: uninstalling or upgrading it previously removed the shared Microsoft apt keyring, which broke other repositories signed by that key. That is fixed in v3.8.20 and is a reason to move rather than hold.

What is still unknown

Devin has not published the setting identifiers for the two sharing toggles, only their description in the changelog, so they cannot be scripted or audited from a configuration file with confidence yet. The ACP documentation has not been updated to describe them, the untrusted-workspace prompt or Restricted Mode's interaction with third-party agents in one place. Devin also gives no guidance on what "terminal activity" and "local user-edit activity" include precisely, which is the detail a security review needs before it can sign off either default.

FAQ

What changed in Devin Desktop v3.8.20?

The release, dated 21 August 2026, added settings controlling whether integrated terminal activity and local user-edit activity are shared with ACP agents, with both remaining on by default. It also added an untrusted-workspace warning with a trust prompt, a separate Agent Command Center window setting, and a Linux fix for the shared Microsoft apt keyring.

Which agents can run inside Devin Desktop via ACP?

Devin's Agent Client Protocol page names Codex CLI from OpenAI, Claude Agent from Anthropic, OpenCode, Junie from JetBrains and Gemini CLI from Google as examples, and states that any agent implementing ACP can be plugged in. Custom agents are supported through a separate page on building a custom ACP agent.

Does Devin's privacy policy cover third-party ACP agents?

No. Devin's ACP page states that when an external ACP agent is used, all agent operations are delegated to that agent, Devin Desktop's privacy policy and legal terms do not apply, and billing runs directly between the customer and the third-party agent provider. That is why the sharing defaults matter more than usual here.

Does the team ACP registry control which binary runs?

Not by itself. Devin states it does not download agent distributions from the registry, that the binary is expected to be installed already, and that the archive URLs exist for ecosystem compatibility rather than being fetched. The registry supplies the command and arguments, resolved against the user's PATH.

Where does the local ACP registry file live?

On Devin Desktop the local registry is ~/.windsurf/acp/registry.json, and on Devin Desktop Next it is ~/.windsurf-next/acp/registry.json. Devin also exposes an "Open Local ACP Registry Config" command in the command palette. Any individual user can create or edit this file without administrator involvement.

How do I disable every agent at once?

Open the workspace in Restricted Mode. Devin's Devin Local documentation says that in Restricted Mode, Cascade, Devin Local and every ACP agent are disabled, and hooks neither load nor run. Agents become available again once the workspace leaves Restricted Mode, so it is reversible but indiscriminate.

Which Devin plans include ACP agents?

Devin's ACP page says third-party agents are available for Pro, Max and Teams users, and directs Enterprise administrators to contact their account team about enabling them. Enterprise is therefore gated separately rather than enabled by default, which changes who needs to act on the sharing settings first.

Is the OpenCode version in Devin's sample config current?

No. The published sample declares version 1.15.7 with archive URLs under that tag, and OpenCode v1.15.7 was released on 21 May 2026. The current release is v1.18.21, published 21 August 2026. Because Devin does not fetch the archive, the declared version has no effect on what runs.

How eCorpIT can help

eCorpIT builds coding-agent governance into engineering rollouts rather than bolting it on afterwards, covering agent allowlists, data-sharing defaults and the audit trail that a security review asks for. We are CMMI Level 5 and ISO 27001:2022 certified, and our senior engineering teams review developer-tool defaults the same way they review production configuration. If your developers are running third-party agents inside Devin Desktop, request an AI coding agent governance review and we will map what leaves the machine.

References

1. Devin Desktop changelog, Cognition, v3.8.20 dated 21 August 2026.
2. Agent Client Protocol in Devin Desktop, Devin Docs, retrieved 24 August 2026.
3. Building a custom ACP agent, Devin Docs, retrieved 24 August 2026.
4. Devin Local, Devin Docs, Restricted Mode section.
5. Agent Command Center, Devin Docs, retrieved 24 August 2026.
6. Agent Client Protocol, the open protocol Devin Desktop implements.
7. ACP registry specification, referenced by Devin's registry config format.
8. OpenCode releases, v1.18.21 published 21 August 2026 and v1.15.7 published 21 May 2026.
9. OpenCode, the open source coding agent named in Devin's sample registry.
10. Codex CLI, OpenAI's coding agent, listed as an ACP example by Devin.
11. Gemini CLI, Google's coding agent, listed as an ACP example by Devin.
12. Junie, JetBrains' coding agent, listed as an ACP example by Devin.
13. Devin documentation index, Devin Docs, page list retrieved 24 August 2026.

Last updated: 24 August 2026.