What AI Update Did You Miss Today?

Claude Code Tightens Auto Mode and the rm Safety Prompt

Claude Code 2.1.261 closed two gaps in how the tool decides what it can do without asking first. Auto mode now treats a link that packs content into a public diagram renderer's URL as an upload to that site, so it is no longer auto-approved unless the user explicitly asked for it, closing a route for content to leave the sandbox without a prompt. Separately, Anthropic widened the dangerous-`rm` safety check to also catch `rm -rf` invoked through positional shell parameters and inside double-quoted `sh -c` scripts, two phrasings that previously slipped past the safety prompt. Both fixes continue Anthropic's near-weekly pattern of narrowing the gap between documented and actual permission behavior in Claude Code.

Claude Code

Claude Code Adds /skill-doctor and Bigger Inline Output Limits

Claude Code 2.1.261 added `/skill-doctor`, a new command that reports which loaded skills go unused and how much context budget each one costs, so users can prune their setup. The same release added `bashOutputMaxChars` and `taskOutputMaxChars` settings that raise how much command and background-task output Claude receives inline, up to 128K characters, before it gets saved to a file instead. Together the two additions target two everyday friction points: bloated, unused skills silently eating context, and long build or test output getting truncated mid-command.

Claude Code

Claude Code Adds a Diff Panel for Reviewing Changes in Fullscreen Mode

Claude Code 2.1.260 introduced a diff panel that opens beside the conversation when running in fullscreen mode, showing uncommitted changes as Claude edits files in real time. Users toggle the panel with the new /diff command. The addition gives developers a persistent, live view of what an agent is changing without having to switch to a separate terminal or editor tab to run git diff.

Claude Code

Claude Code Patches Four Permission-Enforcement Gaps

Claude Code 2.1.260 closed four separate ways a permission rule could fail to actually enforce what a user configured. A path containing parentheses could be dropped as invalid, leaving folders that were meant to be read-only writable; certain zsh variable assignments could hide a command substitution past the approval prompt; Glob and Grep probed whether a search path existed on disk before the permission decision was made; and a malformed deny rule with trailing text was silently ignored instead of flagged. Together the fixes continue a pattern of near-weekly, narrow corrections to Claude Code's permission layer through August and into September 2026.

Claude Code

Claude Code Exempts Manually Typed ! Commands From Strict Sandbox Mode

Claude Code 2.1.260 changed how strict sandbox mode treats commands typed directly at the ! bash-mode prompt, letting them run outside the sandbox even when sandbox.allowUnsandboxedCommands is set to false. Anthropic's reasoning is that a command a user types themselves at the ! prompt is equivalent to typing directly into their own terminal, not an action the agent is taking on the user's behalf. Teams that enabled strict sandbox mode specifically to force every shell command, including their own, through the sandbox should be aware the setting no longer covers manually typed ! commands.

Claude Code

Claude Code Closes a Bash Deny-Rule Gap and a Silent Policy-Enforcement Failure

Claude Code 2.1.259, released September 2, 2026, closed two more narrow gaps in how the tool enforces rules a user or an organization had already configured. A Bash `Read()` deny rule protecting a file such as `.env` previously did not cover that file when it appeared as an option value, as a `git diff` or `git grep` file operand, or inside a directory read by `grep -r` or `cp -r`, letting a crafted command read a supposedly blocked file without ever triggering the approval prompt. Separately, Anthropic changed what happens when a managed-settings file, a drop-in, an MDM plist, or a Windows registry value cannot be parsed: instead of silently starting the session with the organization's policy unenforced, Claude Code now refuses to start and names the broken source. Both fixes continue a pattern of weekly, narrow corrections to the permission and policy-enforcement layer that Anthropic has been shipping through August and into September.

Claude Code

Claude Code Makes Claude Fable 5.1 Its Default Fable Model

Anthropic released Claude Fable 5.1 and Claude Mythos 5.1 on September 1, 2026, and Claude Code 2.1.257 immediately made claude-fable-5-1 the default Fable model, defaulting to High effort in the CLI. The new model keeps Fable 5's list pricing but cuts cache-read costs by 75%, delivering roughly 25% lower costs on typical workloads and up to 45% on heavily agentic tasks. It also posts large benchmark gains, more than doubling Fable 5's Terminal-Bench-Science score and beating Opus 5 on Terminal-Bench 4.0. Mythos 5.1, the restricted-access counterpart, cuts cybersecurity false positives by 60% and biology false positives by 85%, while gaining the ability to discover (not exploit) software vulnerabilities.

Claude Code

Claude Code Patches Twelve Permission, Sandbox, and Auto Mode Gaps

Claude Code 2.1.257 closed twelve separate ways a session could act outside boundaries a user had approved, continuing a pattern of weekly permission-hardening clusters through August. The fixes span auto mode (a new Containment Escape rule blocking cloud metadata-credential theft and cross-tenant reach, a bypass in compound commands and subshells, an auto-approved zsh conditional gap), the sandbox (unblocked trailing-dot domains, a Remote Control consent prompt that counted a dismissal as approval), and policy enforcement (MCP servers reconnecting past a managed block list, deny rules dropped after a settings reload, plugins escaping their own directory through a symlink). Anthropic also closed off a route where a project's own committed settings file could silently turn on full permission bypass.

Claude Code

Claude Code VS Code Extension Redesigns Session Panel and Model Picker

Claude Code 2.1.257 reworked several core parts of the VS Code extension's interface. The session list gained collapsible account, usage, and session-manager sections with a live usage meter, and Delete session became Archive session, moving old sessions into a collapsible archive instead of removing them outright. A new model pill in the input footer opens a model and effort picker directly, and the command menu gained output-style selection alongside its existing slash-command support. Anthropic also fixed third-party provider deployments incorrectly showing claude.ai-only features and repaired several screen-reader announcement bugs.

Claude Code

Claude Code Speeds Up Rendering in Long Conversations

Claude Code 2.1.257 reduced how much the terminal UI re-renders during a turn, so streaming replies no longer slow down as they grow and background-agent updates stop forcing a full-screen redraw. Prompt input got snappier too, with less rendering work happening per keystroke. A related fix stopped the token counter from freezing or crawling after switching to another subagent's transcript, and background subagents' and teammates' token counters now update live while a response streams instead of lagging behind.

Claude Code

Claude Code Closes Two More Bash Sandbox and Permission Gaps

Claude Code 2.1.251, released August 28, 2026, closed two more ways a session could act beyond what a user had approved. Bash permission checks were auto-approving commands that assigned an arithmetic expression to an integer shell variable, letting a crafted command such as `OPTIND=1/0` or `RANDOM=2+2` skip the approval prompt entirely. Separately, Anthropic changed how sandboxed Bash commands create and read back their own output files, so a command running inside the sandbox can no longer redirect or replace them. Both fixes follow the same pattern as several earlier August patches, closing a corner of the permission or sandbox boundary that a crafted command could quietly step around.

Claude Code

Claude Code Streams Subagent Activity Live to Remote Control

Claude Code 2.1.251 lets Remote Control clients (the browser and mobile companion for a running local session) watch a foreground subagent's tool calls and results as they happen, rather than only a status indicator. Background subagents still show status only, keeping the busiest sessions from flooding a phone screen. The change makes Remote Control a genuine window into what an agent is doing while it runs, not just whether it is still working.

Claude Code

Claude Code Makes Opus 5 the Default Model for Enterprise Seats

Claude Code 2.1.251 changed the default model for seat-based Enterprise subscriptions to Opus 5, bringing it in line with Max, Team Premium, and other premium plans that already defaulted to Opus 5. Enterprise seat-based subscribers previously defaulted to Sonnet 5 even though Opus 5 had been available as an option since it shipped in July. The change means Enterprise developers get Anthropic's most capable model out of the box without needing to switch it manually.

Claude Code

Claude Code Patches Nine Permission, Sandbox, and Isolation Gaps

Claude Code 2.1.251 closed nine distinct ways a session could act outside boundaries a user had explicitly approved, the second such cluster in a week following six similar gaps patched on August 25. Fixes span file tools following a swapped symlink, Grep/Glob ignoring deny rules through symlinked paths, plugin commands and Workflow tool scripts escaping their allowed directories, a tracing bypass around a pinned OTLP collector, Claude in Chrome skipping Claude Code's own permission checks when telemetry was off, and several settings-approval gaps that let a server push weaken sandbox isolation or inject credential headers without asking first.

Claude Code

Claude Code Adds a Restricted Mode Flag

Claude Code 2.1.248 introduced a new --restricted flag (also settable via CLAUDE_CODE_RESTRICTED=1) that strips out the built-in tools capable of running arbitrary commands or code, along with WebFetch unless it is explicitly named in --tools. In this mode Claude Code refuses bypassPermissions outright, confines file tools to the working directory, and ignores user, project, and local settings files so an untrusted or scripted context cannot quietly loosen its own rules. The feature gives teams a hardened, opt-in profile for running Claude Code in CI pipelines, review bots, or other automated contexts where a full-permission agent would be unacceptable.

Claude Code