Tags
No item matches the filter.
Anthropic released Claude Code 2.1.283 on September 25, 2026. Interactive sessions on third-party providers, or with telemetry off, now start in auto mode when no permission mode is configured. Administrators get two managed settings that decide which model versions a team may use.
Claude Codeverified
Two Claude Code releases on September 22 and 23, 2026 close four gaps in how the tool decides what needs your approval. A write through a symlink could land outside the project, and a recursive delete aimed at a command substitution ran without a prompt in auto mode. A rule containing a NUL byte matched everything. One behavior change also reaches every user: the y and n keys no longer answer dialogs.
Claude Codeverified
In auto mode a classifier inspects shell commands and network requests before they run, and those checks were separate model requests charged as token usage. From this version Claude Code asks the server to perform them inside the session's own requests, and does not charge for them when the server answers. The default covers Enterprise plans, Claude API accounts, and the AWS, Bedrock, Agent Platform, and Foundry paths, subject to each platform's rollout. Where the server's checks cannot reach a session, the earlier billing returns and a one-time notice says so.
Claude Codeverified
The release that landed on September 4, 2026 is mostly fixes, but four entries change behavior that was already there. The prompt's word-editing keys now match Bash, and the setting that used to select a keybinding style has no effect at all. Auto mode now treats a link that packs your content into a public diagram renderer's URL as an upload to that site, so it is no longer approved without you. Two new settings raise how much command output reaches the model inline, up to 128,000 characters.
Anthropicverified
Anthropic shipped two Claude Code releases on September 1, 2026. Version 2.1.257 adds a containment-escape rule to auto mode and a prompt before the first file read outside the working directories, and it fixes five places where a differently written command slipped past a deny rule. A project settings file can no longer put a session into bypass mode. Version 2.1.258 restores launching on macOS 12, broken since 2.1.255.
Claude Code Releasesverified
Johann Rehberger chained benign-looking steps until Claude Code wrote its own loader for an attacker's Python module. Three variants succeeded in three, three and four runs out of five. In some runs Claude noticed the compromise and tried to stop the process, and Auto Mode denied that command. Anthropic closed the report as informative.
Embrace The Redverified
Version 2.1.246 adds a startup warning for Bash allow rules that put a wildcard before the subcommand, such as Bash(git * main). It also puts auto mode's classifier rules into the permissions screen where they can be read and edited.
Anthropicverified
Since August 14, auto mode is the default permission mode for new sessions on the Pro, Max, and Team plans. Instead of interrupting at every action, a classifier in the background lets safe actions through and stops risky ones. If you set a default mode yourself, it stays in force until you accept a one-time offer to switch, and a mode an organization mandates does not change automatically. One detail matters for your quota: the classifier calls auto mode makes do not count against usage limits, except on Enterprise plans and on accounts running through the Claude API, Bedrock, Google Cloud's agent platform or Foundry, where they consume tokens.
Anthropicverified
