Auto mode now default on Pro, Max, Team

Highlight

Auto mode becomes the default on Pro, Max, and Team plans

Anthropic is rolling out auto mode as the default permission mode for Pro, Max, and Team plans, replacing the per-tool prompt flow with a classifier that approves routine actions and stops to ask on anything risky. You'll notice longer autonomous runs before Claude pauses for input, and the classifier now catches more destructive commands than the old allowlist did. See the announcement and running auto mode in production for the rationale and safety posture.

Worth Knowing

Self-hosted runners host web, mobile, and desktop sessions

claude self-hosted-runner turns your own machines or containers into execution environments for Claude Code sessions started from the web, mobile, or desktop clients, keeping code and network access inside your infrastructure. It's in public beta on Team and Enterprise plans -- see the announcement.

Sessions can now message each other across machines

SendMessage and ListAgents let one Claude Code session address another by name, across machines, on macOS and Linux. Follow-up in 2.1.225 lets you initiate a conversation with a Remote Control session by name rather than only replying after it messages you first.

/review is now an alias for /code-review

/review now maps to /code-review, which reviews your current diff or a specific PR with /code-review <level> <pr#>. Use /code-review ultra for a deep cloud review; omitting the level reuses whatever you typed last.

VS Code gets a Focus view that hides tool activity

A new Focus view in the VS Code extension collapses tool activity behind an expandable per-turn summary with a live running-tool indicator. Toggle it with Ctrl+Alt+F or the "Claude Code: Toggle Focus view" command.

Install plugins from a zip over HTTPS

The new archive plugin source lets you install plugins directly from an HTTPS zip URL, with optional SHA-256 pinning, so you no longer need git or npm in the environment. Handy for locked-down machines and reproducible installs.

Forked sessions now get their own worktree

/fork now creates a fresh git worktree for the new session instead of sharing the parent's checkout, so forked work no longer stomps on the original branch. Combined with a fix in 2.1.222, worktree-isolated sessions and their subagents can no longer run destructive git commands against the main checkout.

Under the Hood

Permission-check bypasses in Bash and PowerShell closed

Several permission-check bypasses were fixed: zsh could hide commands inside [[ ]] regex conditionals, crafted Bash commands could obscure parts of themselves from the checker, tab- and invisible-Unicode padding could hide text from the approval dialog, workflow scripts could escape the sandbox via dynamic import(), and denyRead/denyWrite entries with a trailing slash were silently bypassable on Linux and macOS. Restart Claude Code to activate these patches.

Auto mode permission checks reuse the cached prefix

Auto mode now reuses the cached conversation prefix across parallel permission checks and switches modes cleanly when a check is pending, cutting cache costs on long sessions. The Stats panel also now counts cache tokens with a per-category breakdown.

From Anthropic

In the News