What Claude Code does
October 14 review of v2.1.299: Anthropic reports a server-managed settings request to Anthropic could carry a third-party gateway API key when a managed settings file sets ANTHROPIC_BASE_URL. The release also fixes a teammate description retaining a credential fragment from its prompt. These are vendor-reported fixes for specific paths, not evidence that your credentials were exposed or that earlier copies were removed.
Plugin and run boundaries in v2.1.299: a sandboxed shell could write into a --plugin-dir folder whose code is reloaded and executed outside the sandbox. A mod submitting a prompt after every turn could keep a headless run going past --max-turns, --max-budget-usd, an interrupt or the host conversation's end. Anthropic reports fixes for these paths; remotely disabled mods now unload between turns. A configured sandbox or budget limit alone is not proof of effective enforcement.
October 10 review of v2.1.296: Anthropic reports that headless sessions could start a folder-disabled .mcp.json or plugin MCP server after directory changes or plugin reloads. The release also corrects incomplete secret masking in shared transcripts and debug logs, including some shell-embedded JSON. It fixes Bash permission checks that silently allowed certain BASH_ARGV0 assignments followed by use. These are vendor-reported fixes for specific paths, not proof of blanket safety or absence of earlier exposure.
Browser scope in v2.1.296: cloud sessions correct an auto-mode check skipped for saved browser permissions before feature flags loaded. VS Code now requests approval for browser actions in every session, including @browser; a site approval lasts for that session. This does not authorize unrelated sites or actions.
October 9 review of v2.1.295: Anthropic reports corrected --tools and --restricted enforcement for late-registering built-in tools and deprecated names. It also fixes truncated inputs reaching mod guard hooks, reload-time calls bypassing another mod's guard, and tampered server-policy caches treating personal plugins as organization-managed. These are vendor-reported fixes, not independent verification of prior enforcement.
The hooks reference documents opt-in onFailure: "block" for command and HTTP hooks in v2.1.295 or later; the default remains "continue". For applicable events, it can block on startup failure, timeout, unexpected exit codes, HTTP errors or invalid JSON output. The effect follows the event: PreToolUse blocks the tool call and PermissionRequest denies the request. It has no effect on Stop, SubagentStop, TaskCompleted, TeammateIdle or background command hooks. This is separate from v2.1.294's prompt/agent-hook fix and does not make every hook fail closed.
October 8 review of v2.1.294: Anthropic reports a fix for instruction-style prompt and agent hooks permitting actions they were meant to block. It also improves instruction-style prompt-hook judgments on Stop and SubagentStop to reduce premature stopping. The release describes these hook cases, not a guarantee that every hook or completed task is correct.
October 7 review of v2.1.292: Anthropic reports corrected approval checks for network (UNC) file reads, including PreToolUse hook approvals and auto mode. Managed sandbox read-deny paths that appear or change destination during a session now remove covered project grants and stop credential injection from covered files. The release also closes access to staged /ultrareview upload copies from sandboxed commands.
The same release addresses tampered cached server-managed settings disabling the policy plugin during a failed fetch, first-run plugin commands preceding organization-policy loading, and tool calls missing permission hooks during a plugin worker restart. These are vendor-reported fixes for specified paths, not evidence that every plugin or previously running session was safe.
October 6 review of v2.1.289: Anthropic reports fixes for compound-command deny/ask rules being overridden by user-installed mods on managed machines, Read restrictions missing IDE-selected files reached through symlinks, and Bash rules missed under sandbox auto-allow with variable prefixes or preceding assignments. The release also prevents plugins from rewriting organization-managed MCP sign-in tool descriptions. These are version-specific vendor reports, not a blanket safety claim.
October 1 review of v2.1.286: Anthropic documents additional credential-redaction fixes for MCP errors, encoded Bearer tokens, invisible characters in secret key names, and complex URL passwords in logs and transcripts. Remote Control sessions now disconnect with a notice when the organization disables Remote Control. These are vendor-reported fixes, not proof that historical logs contain no secrets.
September 30 review: v2.1.284 fixes plugin self-preapproval under allowManagedPermissionRulesOnly, preserving exceptions for Anthropic or managed-trusted sources. Elicitation and ElicitationResult hooks returning a block decision now decline MCP elicitation. These controls are not blanket trust in a plugin or MCP server.
v2.1.285 fixes PowerShell deny/ask checks being skipped when its parser cannot start, URL-password redaction, and /ultrareview credential-file filtering for unusual names. It also removes tools when an MCP server added mid-session is disabled in SDK or -p sessions.
Managed-policy exception in v2.1.285: OS-denied access to the managed settings file now produces a warning and startup without that file's policies. Other read failures or unparseable files still stop sessions. Do not equate successful startup with loaded policy. Unconfigured -p and Python Agent SDK sessions on third-party providers or with telemetry disabled now start in auto mode; --permission-mode overrides it.
Claude Code is Anthropic's coding agent for analyzing projects, editing files, and running development commands from terminal and desktop workflows.
September 28 review of v2.1.283: invalid nested managed sandbox settings now fail closed without discarding the remaining policy. The release also fixes Windows deletion safeguards and a VS Code indicator that could show Default while auto or bypass mode remained active. Third-party-provider or telemetry-disabled interactive sessions now start in auto mode if no permission mode is configured; permissions.defaultMode still overrides this.
Telemetry boundary: with OTEL_LOG_TOOL_CONTENT=1, v2.1.283 includes MCP, WebFetch and WebSearch outputs in tool.output telemetry events. The release also reverses v2.1.282's claude-ai namespace reservation; matching Skill rules are ordinary prefix rules again, not a reserved-name safeguard.
Claude Code v2.1.280 fixes permission checks for writes through symbolic links: approval now reflects the actual destination rather than a path that appears inside the working tree. acceptEdits, allow rules and auto mode no longer approve the affected out-of-tree writes on that basis. Auto mode also stops retrying an action when a safety check declines to review it; unanswered safety checks back off and stop the turn after ten consecutive failures.
Claude Code v2.1.277 fixes malformed strictKnownMarketplaces or blockedMarketplaces entries disabling enterprise marketplace policy. It also narrows sandbox.excludedCommands matching: all parts of a compound Bash command must qualify for exemption, not just one part.
The same release adds AGENTS.md fallback when CLAUDE.md is absent, with a Project instructions choice in /config; Bedrock, Vertex and Foundry are excluded at this release.
In v2.1.278, auto mode defaults to server-side classification for Claude API and Enterprise users, plus Bedrock, Vertex, Foundry and gateways. That route has no classifier-overhead charge; billed fallback triggers a warning. Task inference and subscription costs remain separate.
Claude Code v2.1.269 documents fixes for session plugin archives being readable by other local users, retaining world-writable permissions, and leaving stale files after re-extraction. It also fixes Edit() deny rules and write-path checks not applying to Bash tee destinations: allowing Bash(tee:*) no longer authorizes writes outside the working directories.
Claude Code v2.1.271 corrects stale organization policy after account or credential changes. An unreadable or malformed enterprise managed-mcp.json now retains exclusive MCP control and raises a warning rather than loading user, project, or plugin servers. The release also documents fixes to Bash path checks, including chained directory changes.
In v2.1.273, MCP restrictions supplied through MDM or managed-settings.json are respected alongside server-managed settings. The release also fixes missed prompts for Bash commands the checker cannot fully analyze, a dangerous removal command hidden in a subshell in bypass mode, and repository-selected memory escaping the configured working-directory read boundary.
Claude Code v2.1.274 documents fixes for MCP errors and login descriptions exposing secrets expanded from configuration variables, missed Bash permission prompts for certain special shell variables, and nested shell expansions accepted in worktree-isolated sessions. It also corrects edit-approval previews for multibyte text. v2.1.275 redacts credentials embedded in plugin and marketplace URLs from messages, logs and listings; npm-source plugins are fetched with npm pack --ignore-scripts and integrity verification, without running package install scripts.
Its value depends on the surrounding engineering discipline: scoped requests, visible permissions, reviewable diffs, deterministic checks, and a repository state that can be recovered.
With the Fable 5.1 release, Anthropic documents High as Claude Code's default effort, versus Medium in Claude.ai and Cowork. Record the selected model and effort explicitly when comparing runs across surfaces.
The preserved-thinking API change does not apply to ordinary Claude Code use. For custom Messages API integrations using Fable 5.1, it applies to API accounts or projects created on or after August 31, 2026 at 00:00 UTC; integrations that rewrite earlier turns need a separate compatibility review.