Devin Desktop 3.8.20 turned on ACP terminal sharing by default in August 2026

Summary. Cognition shipped Devin Desktop 3.8.20 on 21 August 2026 with two new settings that control "whether integrated terminal activity and local user-edit activity are shared with ACP agents", and the release notes state plainly that "both remain on by default". Agent Client Protocol agents run inside Devin Desktop for Pro ($20/month), Max ($200/month) and Teams ($80/month minimum) users. Cognition's own ACP page warns that when an external ACP agent is used, "Devin Desktop's privacy policy and legal terms do not apply, and billing is directly between you and the third-party agent provider". The FedRAMP Security Admin Guide, which promises "a reference table of all admin-controlled security settings", lists exactly three settings and was last updated 28 January 2026. It contains no ACP entry at all.

That gap is the story. Two defaults changed on a Friday; the pages an administrator would read to govern them did not.

What actually shipped

The Devin Desktop changelog for v3.8.20, dated 21 August 2026, is mostly workspace ergonomics: the Agent Command Center now follows the selected space rather than a single folder, a new devin.agentWindow.location setting splits it into its own window, and switching between Agent and Editor mode with Ctrl/Cmd+G got faster. Two items in the Devin Local section matter more than the rest.

The first: "New settings control whether integrated terminal activity and local user-edit activity are shared with ACP agents (both remain on by default)." The second, in the enterprise block, adds "a link to request more usage when hitting ACU limits" - which maps to the Request more button documented in Cognition's usage policies page.

Read together, those two say something specific. Your organisation can now cap what a developer spends on Devin, and at the moment they hit that cap the product offers them a route to a third-party agent whose spend it does not meter and whose terms it does not govern.

Why "on by default" is the load-bearing phrase

ACP is an open protocol, published at agentclientprotocol.com, that standardises how editors talk to coding agents the way LSP standardised language servers. It runs over JSON-RPC 2.0, and the spec is explicit that agents "typically run as subprocesses of the Client". The client feeds the agent context; the agent acts.

Cognition lists OpenAI's Codex CLI, Anthropic's Claude Agent, OpenCode, JetBrains Junie and Google's Gemini CLI as agents you can plug in. Each is a separate vendor with separate terms. The 3.8.20 defaults mean that, unless someone changes them, an enabled ACP agent receives a stream of what your engineer types into the integrated terminal and what they edit locally.

Integrated terminal output is not incidental data. It is where connection strings get echoed, where kubectl prints cluster context, where a failing test dumps a fixture containing production-shaped records, where an environment variable shows up in a stack trace. Local user-edit activity is the working diff before review. Both are being handed to a process governed by someone else's privacy policy, and Cognition says so in its own documentation.

The governance gap, control by control

Cognition's Local Agent Controls page tells enterprise admins the control surface covers "features, models, permissions & security, MCP/ACP, codebase intelligence, sharing, and compliance", and points readers to the Devin CLI team settings page for "the individual settings and their meanings". Follow that pointer and the ACP controls are not there. The team settings page documents models, web search, MCP servers, MCP registry, terminal permissions, sandbox enforcement, attribution filtering and the CLI install toggle. No ACP section. No sharing section.

The contrast with MCP is the clearest way to see the maturity gap.

Two further mechanics make this harder to fix quickly than it looks. Local Agent Controls are cached, and Cognition asks admins to "allow up to 15 minutes for an update to reach members' clients". And an organisation-level override is a pure replacement, not a merge: the docs warn that if the root allows MCP servers A and B and an organisation overrides with C, members in that organisation get only C. An admin tightening ACP settings for one org can silently drop the rest of the enterprise baseline for that org.

ACP work does not consume ACUs, so your usage policy does not reach it

Devin Enterprise is billed in Agent Compute Units at a rate set in the customer's order form; Cognition publishes no list price and directs buyers to sales. Admins can cap consumption in two places. Organisation ACU limits stop all Devin activity for that org once the limit is reached. Per-user limits, currently in beta and requiring enablement by the account team, cap each member's monthly ACUs across both local usage (Devin Desktop, Devin CLI) and cloud usage, and Cognition states that "new work is blocked on all surfaces once the limit is reached".

All surfaces means all Devin surfaces. The ACP page puts external agents outside that boundary: billing "is directly between you and the third-party agent provider". A developer who has exhausted a 500 ACU tier can enable Codex CLI or Claude Agent through the Agent Command Center and keep working, on their own or a departmental card, with terminal and edit sharing left at the shipped default.

The blunt version: the tighter your ACU policy, the stronger the incentive it creates to route work through the one surface you cannot see.

How to tell whether this is you

Four checks, in order of speed.

Confirm the version. Help then About in Devin Desktop, or the changelog entry for v3.8.20. Anything at 3.8.20 or later on the stable channel has the new defaults.

Check whether ACP is reachable on your plan. Cognition states ACP agents are available for Pro, Max and Teams users, and that Enterprise admins "should contact their account team about enabling third-party agents". If your fleet is Teams rather than Enterprise, the feature is live without an account-team conversation.

Look for a local registry. The file is ~/.windsurf/acp/registry.json, or ~/.windsurf-next/acp/registry.json on the Next channel. Its presence on an endpoint means a user configured an agent themselves rather than taking a team registry.

Check the agent selector. Enabled ACP agents appear in the bottom-right selector when starting new conversations, alongside Cascade and Devin Local. If a third-party name is there, sharing is on unless someone turned it off after 21 August.

What to do this week

The MDM route is the only one in that list that an individual developer cannot undo. Cognition documents the full policy list as shipping in the sample policy.json inside resources/app/policies in the installation directory rather than in the docs, so read the file from an installed 3.8.20 build rather than assuming the documented AllowedExtensions example is the whole set. The real work here is inventory, not configuration - you cannot turn off a setting on a laptop you did not know had the agent enabled.

What is still unknown

Cognition has not published the setting identifiers for the two sharing toggles, so there is no confirmed key to write into a policy file yet. It has not said whether the toggles are exposed as Local Agent Controls at the enterprise root level, or only as user settings on the client. It has not stated whether the pre-3.8.20 behaviour was to share the same data with no toggle at all, or to share nothing - the release notes describe new settings, not a new data flow, which is a meaningfully different thing to disclose to a security team. And the FedRAMP deployment on AWS GovCloud is described as lacking "some features described in other Devin Desktop documentation for the SaaS offering", without saying whether ACP is among them.

Those are questions for an account team, not for a changelog. Ask them in writing.

India-specific considerations

For an Indian engineering organisation, the exposure is a processor question. Under the Digital Personal Data Protection Act 2023, a data fiduciary stays accountable for personal data handled by processors acting on its behalf. Terminal output and working diffs on a laptop connected to a staging environment routinely contain personal data. Routing that stream to a third-party agent whose provider you have no contract with, because a client-side default was set to on, is a processor relationship nobody signed.

Teams running mixed fleets across Gurugram and offshore delivery centres have a second problem: the effective control set depends on the user's primary billing org, which Cognition resolves automatically to "the first organization the user can access" unless an admin assigns it. Two engineers on the same project can end up under different ACP rules. Assign the billing org explicitly before you tune anything else. The same discipline applies to enterprise AI agent governance layers generally: policy that is not deterministic is not policy.

FAQ

How eCorpIT can help

We run agent-tooling inventories for engineering organisations: which editors are installed at which version, which agents are enabled on which endpoints, and which of those data paths leaves the estate. Our senior engineering teams then convert that into enforceable policy through MDM rather than through settings a developer can toggle back. If you are rolling out Devin Desktop, Cursor or Copilot across a mixed fleet, book an AI coding agent governance review and we will start with the inventory, because that is where the surprises are. Our AI coding agent rollout governance service covers the same ground for teams standardising on one harness.

For the wider picture, see our guide to enterprise AI agents in production, the comparison of AI coding agent harnesses, and the write-up of Copilot MCP allowlists and enterprise managed settings.

References

1. Devin Desktop changelog, v3.8.20, 21 August 2026, Cognition

1. Agent Client Protocol in Devin Desktop, Cognition

1. Building a custom ACP agent, Cognition

1. Local Agent Controls, Cognition

1. Devin CLI Team Settings, Cognition

1. FedRAMP Security Admin Guide, Cognition

1. Enterprise Policies for Devin Desktop, Cognition

1. Usage policies: per-user ACU limits, Cognition

1. Enterprise billing and organisation ACU limits, Cognition

1. Self-serve plans and pricing, Cognition

1. Devin Local Agent and Restricted Mode, Cognition

1. Agent Command Center, Cognition

1. Agent Client Protocol v1 overview, Zed Industries

1. Plans and usage for Devin Desktop, Cognition

1. Security at Cognition, Cognition

Last updated: 23 August 2026.