Claude Code 2.1.282 stops repository settings from switching on telemetry export

Most of the 2.1.282 release notes cover terminal rendering, vim mode, and resumed sessions. A smaller group of changes decides which settings win when a cloned repository and an administrator disagree. That group matters most if you open repositories you did not write.

Telemetry now comes only from you or your administrator

Project and local settings now ignore OpenTelemetry variables that turn on export, set the export endpoint, or capture content. The release notes give CLAUDE_CODE_ENABLE_TELEMETRY and the OTEL_LOG_* variables as examples.

Claude Code tells you when it ignores such a variable, or when one of them turns telemetry off. A notice appears at startup, and the same entries show up in /status and claude doctor.

Anthropic does not describe an attack. One possible explanation is that a .claude/settings.json file in someone else's repository could previously send your telemetry to an address its author chose. According to the monitoring documentation, OTEL_LOG_USER_PROMPTS adds prompt text to that telemetry.

Project files can no longer loosen managed settings

Four changes concern administrators who enforce policy through managed settings:

• sandbox.excludedCommands entries in project and local settings are ignored when managed settings or --settings set allowUnsandboxedCommands: false, or when managed settings set allowManagedDomainsOnly: true;
• skills, commands, and plugin manifests from a repository, the user directory, or --add-dir can no longer pre-approve their own tools through allowed-tools under allowManagedPermissionRulesOnly;
• a mistyped value for a boolean lock key such as disableClaudeAiConnectors now applies the lock, and startup names the key;
• one invalid nested value no longer voids the whole managed permissions, autoMode, worktree, or attribution block.

Two names are now reserved for synced skills

Skill folders, command files, and workflow commands in the anthropic-skills or claude-ai namespace no longer load. Allow rules written as Skill(anthropic-skills:*) or Skill(claude-ai:*) now cover only skills synced from claude.ai, not other skills that borrow the name.

MCP servers configured under either name keep their tools but list no skills or prompts. The release notes say renaming the server brings them back.

Auto mode and permission rules

On a direct Anthropic API connection with telemetry off, auto mode now uses the server-side classifier by default. Setting CLAUDE_CODE_AUTO_MODE_SERVER=0 opts out.

Bash permission rules with :* in the middle of a pattern used to be skipped in settings files, while --allowedTools honored them. They now apply from every source, and startup prints a warning that explains how they match.

Cloud sessions are generally available

On September 23, 2026, Anthropic added a note to its Claude Code on the web announcement. Cloud sessions, the new name for that feature, are now generally available on the Pro, Max, and Team plans, and for Enterprise users with premium seats or Chat + Claude Code seats.

According to the documentation, cloud sessions share rate limits with all other Claude and Claude Code usage on the account. Organizations with Zero Data Retention enabled cannot use them.