What's New in Claude Code — Week 35 (August 25–28, 2026)

Source: ai-research/claude-code-docs-changelog-2026-08-28.md — full changelog for v2.1.246–v2.1.251 (August 25–28, 2026), fetched 2026-08-28. Note: v2.1.243 (Loops in /usage, modelPicker, promptCacheTtl) and v2.1.245 (glibc 2.44 crash fix) are documented at the end of Week 34. Week 35 covers August 25–28 at the time of writing; the official W35 digest page was not yet published (404).

v2.1.251 is among the largest releases this wiki has recorded, with 50+ entries. Its centre of gravity is security: five separate permission-bypass vulnerabilities fixed in a single release, the largest security hardening batch since W14. The week also introduces two new hook lifecycle events, a locked-down --restricted execution mode, broader cloud-provider feature parity, and a wave of operational visibility improvements. Continues Week 34.

Key Takeaways

• Five security vulnerabilities fixed in v2.1.251 — the largest batch in a single release in the wiki’s history: (1) file tools (Read, Write, Edit) following a symlink swapped inside the working directory after the permission check, enabling reads/writes outside the approved path; (2) plugin commands pointing outside the plugin directory; (3) project settings enabling detailed beta tracing that bypassed an OTLP collector pinned by managed settings; (4) the Workflow tool reading a scriptPath outside the session’s read permission before the permission check ran; (5) Grep and Glob not applying Read(...) deny rules to files reached through a symlinked search path. All five are permission-bypass bugs, not data-corruption bugs — the attacker needs control of the working directory, plugin files, or project settings. Users in shared or adversarial environments should update immediately.
• PreModelSwitch and PostModelSwitch hook events (v2.1.251) — two new lifecycle events let hooks block, confirm, or annotate a model switch before and after it happens. This closes a control gap: until now, hooks could gate tool calls but not model changes, so a prompt-injected /model switch inside a session was outside the hook system’s reach. SessionStart resume hooks now also receive session staleness and the estimated re-cache cost, enabling hooks that decide whether to resume or restart based on economic signal.
• --restricted mode (v2.1.248, CLAUDE_CODE_RESTRICTED=1) — a new execution mode that removes Bash, computer use, and WebFetch; keeps file tools inside the working directory; refuses bypassPermissions; and ignores user, project, and local settings files. Designed for untrusted content, sandboxed pipelines, and locked-down CI runs where a session should not be able to call arbitrary shell commands. Complementary to, not a replacement for, permission rules — an --allowed-tools list can selectively restore specific tools.
• CLAUDE_CODE_SUBAGENT_MODEL behavior change (v2.1.251) — this env var now sets the default subagent model rather than overriding everything. Agent definition model: fields and explicit per-spawn model arguments now take precedence over it. Existing workflows that relied on CLAUDE_CODE_SUBAGENT_MODEL to force a uniform model across all subagents, including those with explicit model: in their definition, will see different routing after this update. Check your agent definitions.
• Enterprise default model → Opus 5 (v2.1.251) — seat-based Enterprise subscriptions now default to Opus 5, matching Max and Team. Previously Enterprise seat accounts started on Sonnet unless /model was changed. Organizations that routed new sessions to Sonnet as a cost policy should review their model settings.
• /effort saves per-model (v2.1.251) — the effort level is now stored per model, so switching from Opus to Sonnet and back keeps each model’s own setting. Previously, picking /effort high on Sonnet and switching to Opus would inherit Sonnet’s effort setting.
• /loop now available everywhere (v2.1.248) — self-paced dynamic mode and the no-prompt autonomous default are now available on Bedrock, Vertex AI, and Foundry, and when telemetry is disabled. Previously /loop required the Anthropic API. Cross-session messaging (SendMessage/ListAgents) also extended to Bedrock, Vertex, and Foundry in the same release.
• /cost now shows per-session prompt-cache detail (v2.1.251) — a new line in /cost reports hit ratio, misses, tokens re-cached, and warm/cold status for the current session. A matching prompt_cache object is available for status line scripts. Operational visibility that was previously only inferrable from cost delta is now surfaced directly.
• Agent teams fix: teammate final answer now arrives (v2.1.251) — a bug caused a teammate’s final answer to not reach the team lead; the lead received a content-free “available” notice instead. The fix routes the answer through the idle notification. Teams that reported silent teammate completions should update.
• SendFeedback tool (v2.1.247) — Claude can now draft a feedback report during a session for the user to review and send from /feedback. Turn off with feedbackDrafts: false in settings.
• /claude-api cost-optimize (v2.1.247) — a new built-in skill command profiles an existing project’s Claude API spend and works through cost levers (caching, token hygiene, batch API, effort, model choice) one measured change at a time. The /claude-api skill was also updated with Admin API coverage (organization members, invites, workspaces, API keys, rate limit reports, workload identity federation, CMEK).
• Auto mode tab in /permissions (v2.1.246) — /permissions now has a dedicated Auto mode tab for viewing and editing the auto mode classifier rules. Previously, auto mode rule inspection required reading settings files directly.
• Spend limit bar in /usage (v2.1.251) — a visual bar appears in /usage for sessions behind a Claude apps gateway with spend limits. A matching rate_limits.spend_limit field is available for status line scripts.
• Bash wildcard allow-rule warning (v2.1.246) — Claude Code now warns at startup when a Bash allow rule has a wildcard before the subcommand (e.g. Bash(git * main)), since such rules also match options inserted before the subcommand — a common misconfiguration that widens the allow surface beyond intent.

The security batch in v2.1.251

Five fixes in one release is unusual. The pattern across all five: a permission check that fires too early, a path that bypasses the check, or a scope that doesn’t cover symlinks.

Symlink swap in file tools. The most impactful: Read, Write, and Edit were permission-checking the path, then following the symlink. An attacker who controls a symlink inside the approved working directory could swap it between the permission check and the file operation — the “TOCTOU” (time-of-check/time-of-use) vulnerability. The fix is to resolve the symlink before the permission check, then operate on the resolved path.

Plugin path traversal. A plugin command declared in a marketplace entry was allowed to point outside the plugin directory. Such paths are now rejected with a path-traversal error at load time. Affects organizations running third-party marketplaces.

Beta tracing scope bypass. Project settings could enable detailed beta tracing or raw API body logging, and a lower-scope beta tracing endpoint was able to bypass an OTLP collector pinned by managed or host-app settings. Fixed: project-scope settings can no longer escalate tracing past managed settings.

Workflow scriptPath pre-check read. The Workflow tool was reading (and including in error messages) a scriptPath outside what the session is permitted to read, before the permission check ran. This could leak file contents from outside the approved path into error text.

Grep/Glob deny-rule bypass. Read(...) deny rules were not applied when Grep or Glob reached files through a symlinked search path. Deny rules now follow symlinks.

The full five-fix batch in one release suggests a targeted audit rather than incidental discovery. Users in CI environments, organizations with untrusted plugin sources, or anyone running sessions with restricted read permissions should treat this as a mandatory update.

--restricted mode (v2.1.248)

--restricted (or CLAUDE_CODE_RESTRICTED=1) is a new execution floor for sessions where the default set of tools is too broad. It removes:

• Bash, computer use, and WebFetch (unless explicitly named in --tools)
• The ability to bypassPermissions
• User, project, and local settings files (only managed settings apply)

File tools (Read, Write, Edit, Glob, Grep) still work, but are constrained to the working directory.

This is different from permission rules: --restricted removes tool classes entirely rather than gating their use. The intended cases are untrusted content pipelines (processing user-supplied files without risk of executing their contents), locked-down CI runs, and sandboxed code review sessions.

Because --restricted ignores local settings, it cannot be weakened by a project .claude/settings.json — a managed settings file is the only override path.

PreModelSwitch and PostModelSwitch hooks (v2.1.251)

Two new lifecycle events:

• PreModelSwitch fires before the model changes. A hook can block the switch (e.g. enforce a model policy), confirm it (add a condition-based approval step), or annotate it (log which model is being switched to and why).
• PostModelSwitch fires after the switch completes, for side effects (update a project setting, notify a logging system).

SessionStart resume hooks gain two new input fields: sessionStaleness (how long the session has been idle) and estimatedRecacheCost (the projected cost to re-cache the context on the first turn). A hook can use these to decide whether resuming is worth the cost, or whether to start fresh.

These two events close a notable gap in the hook system: until now, all lifecycle hooks operated on tool calls, not on Claude Code’s own state changes. A model switch was the one operation a hook system could not observe or gate.

// ~/.claude/settings.json — block model switches to Fable in cost-sensitive projects
{
  "hooks": {
    "PreModelSwitch": [{
      "matcher": "fable",
      "hooks": [{"type": "command", "command": "echo '{\"decision\": \"block\", \"reason\": \"Fable disabled for this project\"}'"}]
    }]
  }
}

CLAUDE_CODE_SUBAGENT_MODEL precedence change (v2.1.251)

Before v2.1.251: CLAUDE_CODE_SUBAGENT_MODEL overrode the subagent model in all cases, including when the agent definition’s frontmatter specified model: and when the spawning call named a model explicitly.

After v2.1.251: CLAUDE_CODE_SUBAGENT_MODEL is the default. An agent definition’s model: takes precedence, and an explicit per-spawn model argument takes precedence over that.

Migration: If you use CLAUDE_CODE_SUBAGENT_MODEL to enforce a uniform model across all subagents regardless of agent definition, that enforcement is now broken for agents with explicit model: in their frontmatter. Either remove the model: fields from agent definitions, or switch to a PreModelSwitch hook to enforce the constraint.

/loop parity on Bedrock, Vertex, and Foundry (v2.1.248)

/loop — both self-paced dynamic mode and the no-prompt autonomous default — now works on Bedrock, Vertex AI, and Foundry, and when telemetry is disabled. Previously it required the Anthropic API.

The same release extended cross-session messaging (SendMessage/ListAgents) to Bedrock, Vertex, and Foundry. Combined with /code-review gaining Bedrock/Vertex/Foundry support in the same release, this completes a feature-parity push for cloud-provider users that started in W33 (GitLab) and W34 (Windows SendMessage).

For teams on AWS Bedrock or Vertex AI: the automated agent patterns (scheduled tasks, cross-session workflows, code review automation) that previously required the Anthropic API are now available without migrating providers.

Operational visibility improvements

Three entries across v2.1.246–251 give sessions more financial and performance signal:

Prompt-cache line in /cost (v2.1.251): a new line reports the session’s cache hit ratio, misses, tokens re-cached, and warm/cold status. A matching prompt_cache object is available for status line scripts. Previously you could only infer prompt-cache performance from the cost delta between turns; now it’s a first-class metric.

Spend limit bar in /usage (v2.1.251): sessions behind a Claude apps gateway with org spend limits now see a spend bar in /usage and a rate_limits.spend_limit status line field. Useful for teams tracking spend against a budget set by their organization administrator.

/claude-api cost-optimize (v2.1.247): a new skill command that walks through a project’s Claude API spend and works through cost levers one measured change at a time. The approach is structured: pick one lever (caching, token hygiene, batch API, effort reduction, model downgrade), measure the impact, then move to the next. The /claude-api skill was also updated with Admin API coverage for organization-level management.

v2.1.246: the bug-fix release

v2.1.246 is a cleanup release with 50+ fixes and three user-visible additions:

• Auto mode tab in /permissions — a new tab for viewing and editing auto mode classifier rules. Previously, inspecting auto mode rules required reading settings files directly.
• Wildcard Bash rule startup warning — a warning when a Bash(git * main) style allow rule has a wildcard before the subcommand. Such rules match git --force main as well as git commit main — a broader allow surface than most users intend.
• Turn completion time in the duration line — the end-of-turn line now reads ✻ Processed for 23s · done 6:05 PM so you can correlate output with the time you walked away.

Notable fixes in v2.1.246: plugin skills with a doubled plugin:plugin:skill prefix in the slash menu; claude plugin update failing for bare plugin names; plugin installation with UTF-8 BOM; /fork starting with an empty conversation from a backgrounded session; Markdown rendering disabled for a whole message when its first 500 characters had no Markdown; background sessions failing to open with EACCES when another process was re-installing the npm package; auto mode safety-check deadline not scaling with prompt size.

v2.1.247: SendFeedback and /claude-api cost-optimize

SendFeedback tool is a new tool Claude can invoke when something goes wrong — it drafts a feedback report with the relevant session context, presents it for your review, and lets you send it from /feedback without having to describe the problem from scratch. Turn off with feedbackDrafts: false.

/claude-api cost-optimize profiles your project’s Claude API spend and works through levers in order. The structured one-lever-at-a-time approach avoids the common failure mode of applying caching, batch, and model changes simultaneously and being unable to attribute the cost change to any single cause.

Spinner tips customization (spinnerTipsOverride): organizations can now add {id, text, cooldownSessions, priority} entries, a tipsFile, and a label to rotate custom tips alongside the built-in ones. Useful for onboarding messaging or policy reminders surfaced during Claude’s processing time.

---

The security story of the week

v2.1.251 is a large release by any measure, but its defining characteristic is not a new feature — it is five security fixes arriving together. That number in a single release is more consistent with a targeted audit sweep than with incidental bug discovery.

The underlying pattern in four of the five is the same: a path boundary that was checked at the wrong point in the execution chain. Symlinks, path traversal in plugin manifests, scope escalation in beta tracing, and deny rules on search results — each one is a case where the permission system’s check was logically correct but applied to the wrong representation of the resource.

The fifth (Workflow scriptPath) is structurally different: the check was in the right place, but an error path read the target file before the check could run, leaking content into the error message.

For wiki readers: these fixes matter most to users in multi-tenant or adversarial environments — shared CI, third-party marketplace plugins, sessions processing untrusted content. For solo practitioners on a trusted machine, the practical risk was low. But the existence of the batch is worth noting: it suggests the permission architecture was audited systematically, and five edge cases were found. There may have been a triggering event (an external report, a production incident) that is not named in the changelog.

Try It

• Update immediately if you are in a shared or multi-tenant environment. The five security fixes in v2.1.251 address permission-bypass issues that matter in adversarial contexts. claude update.
• Check your agent definitions if you use CLAUDE_CODE_SUBAGENT_MODEL. Definitions with explicit model: now take precedence over the env var. Run a test subagent spawn and confirm the model that actually runs.
• If you have Enterprise seat accounts, check the model. New sessions default to Opus 5 instead of Sonnet. Update /config or set ANTHROPIC_DEFAULT_MODEL if Sonnet is your cost-preferred default.
• Add PreModelSwitch hooks if model consistency matters in your project. This is the first release where model changes can be blocked deterministically. Example snippet is in the hooks section above.
• Run /cost mid-session and check the prompt-cache line. If your hit ratio is below ~80% on a long session, you may be invalidating the cache on every turn — common causes are tool definitions changing (OAuth token refresh was one; fixed in v2.1.248) or a dynamic system prompt.
• Test --restricted on any pipeline that processes untrusted files. It is a safer default than permission rules for pipelines where Bash access should simply not exist.
• If you are on Bedrock or Vertex AI, try /loop and SendMessage. Both are now available without requiring the Anthropic API. Scheduled agent patterns documented in Scheduled Tasks apply directly.
• Run /claude-api cost-optimize on any project where API spend is growing. The one-lever-at-a-time structure is the practical value — it forces attribution before you move to the next change.

Open Questions

• What triggered the five-fix security audit? The changelog does not name a CVE, an external report, or a production incident. The clustering suggests a deliberate audit, but the precipitating event is not known.
• Does --restricted apply to MCP tool calls? The changelog says it removes “tools that run commands or code” — it is not explicit about MCP servers, which can run arbitrary code on the MCP host. Not fetched from the docs.
• What exactly does sessionStaleness measure in SessionStart resume hooks? Is it wall-clock time since last turn, or since the session was backgrounded? The changelog does not define the unit.
• What is the estimatedRecacheCost calculation? Is it based on token count × cached price, or does it account for the warm/cold distinction in prompt cache tiers? Not documented in the changelog entry.
• Will the W35 official digest page promote different features than the changelog? The W34 digest promoted /design (v2.1.233) and Remote Control phone cards prominently — features that were understated in changelog-sourced coverage. The W35 digest page was not yet published at the time of this sweep (404). When it publishes, compare against this article.
• Is the teammate final-answer fix in v2.1.251 a regression from v2.1.232 (subagent forking)? The v2.1.232 forking changes were significant; it is plausible the answer-routing was broken in that release. Not confirmed.
• Does experimental.cacheTtl in agent frontmatter interact with promptCacheTtl and subagentPromptCacheTtl settings? The changelog says it is “used when no subagent TTL setting is configured” — which setting takes precedence when subagentPromptCacheTtl is set but the spawned agent has experimental.cacheTtl?

Related

• What’s New — Week 34 — the preceding digest (v2.1.234–245); /design skill, Concise output style, Remote Control phone start.
• Hooks — carries PreModelSwitch, PostModelSwitch, and the full lifecycle event table; updated this session.
• CLI Reference — --restricted, CLAUDE_CODE_RESTRICTED, /claude-api cost-optimize, CLAUDE_CODE_SUBAGENT_MODEL precedence change; updated this session.
• Scheduled Tasks — /loop now available on Bedrock/Vertex/Foundry; updated this session.
• Agent Teams — teammate final-answer routing fix (v2.1.251); affected users should update.
• Subagents — CLAUDE_CODE_SUBAGENT_MODEL precedence change affects all subagent routing.
• Plugins and Marketplaces — plugin path-traversal security fix (v2.1.251); plugin naming double-prefix fix (v2.1.246).
• Cost Intelligence Levers — /claude-api cost-optimize adds a structured workflow for the levers documented there.