Skip to content
What are you looking for?. Open searchSR

Tags

Claude Code

27 items
CLAUDE CODE2.1.294hooks written as instructions now block what t
Agentsmedium signal

Claude Code 2.1.294 fixes prompt hooks that let through the actions they were written to block

Anthropic released Claude Code 2.1.294 on October 8, 2026. It fixes prompt and agent hooks phrased as instructions, which could allow exactly the actions they were meant to stop. Version 2.1.295 followed the same day with an onFailure setting that makes a crashed or timed-out command or HTTP hook block the action. Releases 2.1.292 and 2.1.293 from earlier in the week closed several permission and sandbox gaps.

Claude Code Releases (GitHub)verified

CLAUDE CODE2.1.291fixes a session-loss regression from 2.1.288
Agentsmedium signal

Claude Code 2.1.291 fixes a four-day-old bug that could lose the last messages of a session

Version 2.1.291, out on October 6, 2026, closes a regression that shipped in 2.1.288 on October 2, 2026 and could drop the last messages of a session when you quit. It also fixes a regression from 2.1.290, released on October 5, 2026, in cloud sessions. The day before, 2.1.290 had tightened several permission checks, including rules that were skipped after a hook rewrote a tool call. If you are on any version from 2.1.288 to 2.1.290, update.

Claude Code Releases (GitHub)verified

Anthropic's illustration for the mods announcement: a hand-drawn hand placing a white block onto a wall of outlined bricks, on an orange background.
Agentsstrong signal

Claude Code mods are not sandboxed, and version 2.1.289 fixes a deny rule they could override

Anthropic introduced mods for Claude Code on October 1, 2026. They are TypeScript functions, shipped inside plugins, that can rewrite prompts, change tool calls, and redraw parts of the interface. The documentation says mods are not sandboxed and run with your permissions, which covers your files, environment variables, and API keys. On Team and Enterprise plans a built-in mod named sec-default loads first and restricts the mods that users install. Versions 2.1.288 and 2.1.289 fix several cases where permission rules did not hold.

Anthropicverified

Agentsmedium signal

Claude Code 2.1.287 adds Mods and makes a 1M context window the default on cloud platforms

Anthropic released Claude Code 2.1.287 on October 1, 2026. The release adds Claude Mods, which let plugins modify deeper behavior, and a built-in mod in which a side agent flags things you might miss. Opus 4.7 and later and Fable now use a 1M context window by default on Bedrock, Vertex, Foundry, and the Claude apps gateway. Some MCP servers may stop connecting until you add one line to their configuration, and several shell writes that used to run now wait for approval.

Claude Codeverified

Agentsmedium signal

Claude Code 2.1.286 fixes four cases of exposed credentials and tightens plugin install sources

Anthropic released Claude Code 2.1.286 on September 30, 2026. Four fixes stop credentials from appearing in MCP error messages, logs, and transcripts that were supposed to be redacted. Plugin installs now refuse npm sources that are git repositories or folders, and Remote Control sessions disconnect when an organization's policy turns the feature off. The release also corrects a spend meter that priced some cache writes at the cheaper rate, and it changes what bare mode does.

Claude Codeverified

Agentsmedium signal

Claude Code 2.1.285 lets admins restrict API providers and fixes a token login that skipped org policy

Anthropic released Claude Code 2.1.285 on September 29, 2026. A new managed setting, allowedProviders, limits which API providers a machine may use. Two fixes matter for teams: sessions that authenticate with an auth token never loaded the organization's policy, and redacted logs could show a URL password. The release also adds a switch that turns off WebFetch and a command that opens the desktop app.

Claude Codeverified

Agentsmedium signal

Claude Code 2.1.284 stops plugins from pre-approving their own tools under managed permission rules

Anthropic released Claude Code 2.1.284 on September 28, 2026. The release closes a gap that let plugins from marketplaces, claude.ai, and npm pre-approve their own tools even when managed settings allowed only managed permission rules. It also validates a Foundry setting that went straight into a hostname, and adds Claude Sonnet 5.5.

Claude Codeverified

Agentsmedium signal

Claude Code 2.1.282 stops repository settings from switching on telemetry export

Anthropic released Claude Code 2.1.282 on September 24, 2026. Project and local settings files can no longer turn on OpenTelemetry export, set where it goes, or capture content. The release also closes several ways a repository's files could weaken settings an administrator manages.

Claude Codeverified

Agentsmedium signal

Claude Code 2.1.280 and 2.1.281 fix four cases where permission checks let an action through

Two Claude Code releases on September 22 and 23, 2026 close four gaps in how the tool decides what needs your approval. A write through a symlink could land outside the project, and a recursive delete aimed at a command substitution ran without a prompt in auto mode. A rule containing a NUL byte matched everything. One behavior change also reaches every user: the y and n keys no longer answer dialogs.

Claude Codeverified

Agentsstrong signal

Claude Code 2.1.278 moved auto mode's safety checks to the server, where they are not billed

In auto mode a classifier inspects shell commands and network requests before they run, and those checks were separate model requests charged as token usage. From this version Claude Code asks the server to perform them inside the session's own requests, and does not charge for them when the server answers. The default covers Enterprise plans, Claude API accounts, and the AWS, Bedrock, Agent Platform, and Foundry paths, subject to each platform's rollout. Where the server's checks cannot reach a session, the earlier billing returns and a one-time notice says so.

Claude Codeverified

Agentsmedium signal

Claude Code 2.1.275 stops running the install scripts inside a plugin from npm

Anthropic published the release on September 17, 2026. A plugin installed from npm is now fetched with packing that skips scripts and is integrity-verified, so the package's install scripts never execute. The same build stops printing a password or token that was stored in a git, ssh or marketplace address, and repairs a rewind that could restore a zero-filled or truncated file. A regression it introduced broke every request for anyone whose base URL points at a proxy or gateway, and 2.1.276 fixed that the next day.

Claude Code Releases (GitHub)verified

Agentsmedium signal

Claude Code 2.1.268 closes several ways a deny rule failed to apply

The release published on September 10, 2026 is mostly a permissions release. Deny and ask rules did not apply to symlinked directories when a path was spelled by its real location, and a deny rule on a file could be stepped over by putting an unparseable command on the same line. Two separate fixes stop secrets from being printed into plugin and MCP output. The same build also repairs third-party endpoints, which had been failing every turn with HTTP 400 since 2.1.265.

Claude Code Releases (GitHub)verified

Agentsmedium signal

Claude Code 2.1.261 changes what Ctrl+W does and stops auto-approving diagram-renderer links

The release that landed on September 4, 2026 is mostly fixes, but four entries change behavior that was already there. The prompt's word-editing keys now match Bash, and the setting that used to select a keybinding style has no effect at all. Auto mode now treats a link that packs your content into a public diagram renderer's URL as an upload to that site, so it is no longer approved without you. Two new settings raise how much command output reaches the model inline, up to 128,000 characters.

Anthropicverified

Agentsmedium signal

Claude Code 2.1.260 fixes four ways a permission rule quietly failed to apply

The release published on September 3, 2026 is mostly about permission rules that were written correctly and then did not do what they said. A path containing parentheses could be dropped as invalid, leaving a folder marked read-only writable. One malformed pattern could break every file edit. A zsh command could hide a command substitution inside a variable assignment and be auto-approved. And a rule with stray text after the closing parenthesis matched nothing at all, silently. If you rely on deny rules, the interesting part of this release is not what Claude Code can now do but what your settings were not doing.

Anthropicverified

Agentsstrong signal

Claude Code 2.1.257 closes several ways a permission rule could be walked around

Anthropic shipped two Claude Code releases on September 1, 2026. Version 2.1.257 adds a containment-escape rule to auto mode and a prompt before the first file read outside the working directories, and it fixes five places where a differently written command slipped past a deny rule. A project settings file can no longer put a session into bypass mode. Version 2.1.258 restores launching on macOS 12, broken since 2.1.255.

Claude Code Releasesverified

Agentsmedium signal

Claude Code 2.1.251 closes six ways a project could widen its own permissions

Anthropic published the release on August 28. Six of its fixes share one shape: something declared inside the working directory — a symlink, a plugin entry, a workflow script, a settings file — reached past the boundary the session had approved. Several changes now stop managed or project settings from weakening the sandbox or injecting credential headers without an explicit approval. The same release adds hooks that fire around a model switch and a per-session prompt-cache line in the cost command.

Anthropicverified

Agentsmedium signal

Claude Code 2.1.248 adds a restricted mode and stops leaking credential leftovers

One flag now strips the tools that run code, keeps file access inside the working directory, refuses bypassPermissions and ignores every settings file. The same release stops cloud reviews from uploading tfvars files and editor backups of private keys. Version 2.1.250 followed hours later with fixes only.

Anthropicverified

Agentsstrong signal

The classifier let the malware start and then refused to let Claude kill it

Johann Rehberger chained benign-looking steps until Claude Code wrote its own loader for an attacker's Python module. Three variants succeeded in three, three and four runs out of five. In some runs Claude noticed the compromise and tried to stop the process, and Auto Mode denied that command. Anthropic closed the report as informative.

Embrace The Redverified

Agentsweak signal

Claude Code now warns about the permission rule that looks narrow and is not

Version 2.1.246 adds a startup warning for Bash allow rules that put a wildcard before the subcommand, such as Bash(git * main). It also puts auto mode's classifier rules into the permissions screen where they can be read and edited.

Anthropicverified

Agentsweak signal

Claude Code crashed on startup on glibc 2.44, and 2.1.245 says so by name

The release published at 05:13 UTC on August 25 fixes a startup crash on Linux distributions shipping glibc 2.44 — Arch Linux, CachyOS and Fedora Rawhide are named. If the CLI stopped opening on a rolling-release machine this week, this is why.

Claude Code Releasesverified

Agentsmedium signal

A proxy that stripped one header was doubling Claude Code's API bill

Version 2.1.239 fixes streaming on Bedrock behind proxies that remove the response Content-Type header. Claude Code silently fell back to re-running every turn without streaming, and each turn was billed twice. The same release makes cost estimates show the 1.1× premium that data-residency workspaces pay.

Anthropicverified

Agentsstrong signal

Claude Code vs Cursor: same $20, different shape

Both start at $20 a month, both speak MCP, both run skills and hooks, both reach CI. The difference is not the feature list. It is whether the agent lives inside an editor you adopt or inside the terminal you already have.

Anthropic, Cursorverified

Agentsweak signal

Claude Code 2.1.238 stops memory growth in long sessions

The August 20 release fixes what got in the way during long stretches of work rather than adding features. Tool results returned by subagents are now freed as soon as they leave the recent-view window, so memory in long interactive sessions stops growing without a ceiling. The release also fixes custom output styles sliding back to the default tone mid-session, along with a run of stalls in Remote Control. A new keybindingFlavor setting restores Bash behavior, where Ctrl+W deletes back to the previous space, and claude mcp list no longer starts disabled servers just to check their status.

Anthropicverified

Agentsmedium signal

Claude Code sessions can now message each other

Two open sessions can talk: Claude finds the others with ListAgents and sends a message through SendMessage, either because you asked or on its own when a change in one session affects the work in another. Only text Claude writes crosses over — never conversation history, never files. Since version 2.1.232 you can also address a session directly by typing @ followed by its name. The feature runs on macOS and Linux and needs version 2.1.224 or later, and /list-agents shows what is available. It pays off most when you keep the frontend and backend of the same project in separate sessions.

Anthropicverified

Agentsmedium signal

Auto mode becomes the default permission mode

Since August 14, auto mode is the default permission mode for new sessions on the Pro, Max, and Team plans. Instead of interrupting at every action, a classifier in the background lets safe actions through and stops risky ones. If you set a default mode yourself, it stays in force until you accept a one-time offer to switch, and a mode an organization mandates does not change automatically. One detail matters for your quota: the classifier calls auto mode makes do not count against usage limits, except on Enterprise plans and on accounts running through the Claude API, Bedrock, Google Cloud's agent platform or Foundry, where they consume tokens.

Anthropicverified

Agentsweak signal

Claude Code 2.1.235 to 2.1.237: Concise style, ANTHROPIC_DEFAULT_MODEL, and spell checking

Three releases in three days change several things about daily work. Version 2.1.237 introduces a built-in Concise output style, in which Claude leads with the result and skips the preamble and the recap, and fixes prompt caching for sessions that go through a proxy gateway or a custom base URL. Version 2.1.236 adds the ANTHROPIC_DEFAULT_MODEL environment variable, which sets the model new sessions start on, and a notify_when_idle option that asks another session to report when it frees up. Version 2.1.235 introduces optional spell checking through aspell, hunspell, or ispell, and reduces memory and processor use for sessions running in the cloud.

Anthropicverified