Claude Code 2.1.278 moved auto mode's safety checks to the server, where they are not billed

Claude Code 2.1.278 was published on September 19, 2026. It changes which side runs the checks that auto mode performs before a shell command or a network request executes, and with that, who pays for them. Those checks used to be separate classifier requests billed as ordinary token usage. Now Claude Code asks the server to carry them inside the session's own model requests, and a check the server answers costs nothing.

What changed in the billing

Auto mode exists to remove permission prompts: a classifier reads each action the model is about to take and decides whether a person has to see it first. Running that classifier consumes model requests, and until this version those requests were billed to the account like any other token usage. From 2.1.278 the check rides along with the session's own request, the server answers it, and nothing is added to the bill for it.

The default applies to Enterprise plans and accounts that use the Claude API, and to Claude Platform on AWS, Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry. Whether a particular platform or region performs the checks depends on that platform's rollout, so the default is a request rather than a guarantee. Pro, Max, and Team plans sit outside all of this and never see the notice.

What happens when the server cannot be reached

When the server's checks stop reaching a session, Claude Code returns to its own classifier requests, billed as before. It holds the next checked action and prints a notice once; pressing Enter continues with the old behavior for the rest of the session. Auto mode itself keeps working either way, so nothing is blocked.

The usual cause is an LLM gateway or proxy in the path that strips or rewrites request headers, drops fields it does not recognize such as safeguards, or edits responses by rewriting tool-use IDs or dropping keys such as safeguard_results. When the configuration or the responses identify a gateway, the notice names it, and acknowledging it keeps the notice away on that machine for 24 hours. The documented fix is for the gateway to pass requests and replies through unchanged.

In non-interactive mode with -p the same text goes to standard error, and in stream-json output it arrives as a system warning that Agent SDK applications can read from the message stream. In the VS Code extension it appears as a notice in the conversation, with nothing to acknowledge.

Where a session shows which side is checking

The release adds a row to /status. In a session that is in auto mode, the Auto mode server row reads Enabled while the server's checks are deciding that session's actions, and Disabled once the session has fallen back to its own classifier. That is the only place the answer is visible without waiting for the notice to appear.

An administrator who already knows a gateway cannot carry the checks can stop Claude Code from asking for them, by setting CLAUDE_CODE_AUTO_MODE_SERVER to 0 before the session starts, in the shell or through the env settings key. Classifier requests are then always local and billed as before, and the notice never appears. The variable is not read on a direct connection to the Anthropic API, and the documentation calls it temporary and says it may be removed in a later release.

What this means for a team behind a gateway

This suggests the line no longer runs between subscription plans but between network paths. A team that calls the Claude API directly gets the cheaper checks; the same team behind a proxy that rewrites requests keeps paying for them, and the difference is a piece of infrastructure nobody counted as part of the model bill. The documented remedy is a configuration change on the gateway, not in Claude Code.