Pentagon Ruling on Anthropic Upheld

Highlight

New restricted mode strips command execution and remote fetches

You can now start a session with --restricted (or CLAUDE_CODE_RESTRICTED=1) to remove every built-in tool that runs commands or code, plus WebFetch unless you name it in --tools. File tools stay inside your working directory, bypassPermissions is refused, and user, project, and local settings files are ignored entirely, which makes it a practical way to hand Claude an untrusted repository or run it inside automation you do not fully control.

Worth Knowing

Sonnet 5 auto-compacts later on the 1M context window

If you run Sonnet 5 with the 1M window, auto-compact now triggers at roughly 967K tokens instead of 934K, giving you about 33K more tokens of conversation before a summarization pass interrupts your work.

Hooks can now block or annotate model switches

Two new hook events, PreModelSwitch and PostModelSwitch, let you block, confirm, or annotate any change of model mid-session, which is useful if you want to keep expensive models out of certain repositories. Your SessionStart resume hooks also now receive session staleness and the estimated re-cache cost.

Cost and usage views gain cache and spend detail

/cost now shows a per-session prompt-cache line with hit ratio, misses, tokens re-cached, and warm/cold state, and exposes a matching prompt_cache object for status line scripts. /usage adds a spend limit bar with a rate_limits.spend_limit status line field if you work behind a Claude apps gateway with spend limits.

Auto mode rules are now editable from the permissions view

/permissions gained an Auto mode tab where you can inspect and edit the classifier rules that decide what runs without asking. Bash permission prompts now also offer a one-keystroke "Yes, and switch to auto mode" option.

Subagent streaming in Remote Control and per-model effort

Remote Control clients now stream a foreground subagent's tool calls and results live rather than showing status only. /effort remembers a separate default per model, and CLAUDE_CODE_SUBAGENT_MODEL now acts as a default that an agent definition's model: or an explicit per-spawn model can override.

Changing directories now reloads project configuration

When you run /cd, the new directory's project settings, hooks, skills, agents, and .mcp.json servers take effect immediately instead of waiting for a --resume, so moving between repos mid-session behaves the way you would expect.

Under the Hood

Symlink, sandbox, and permission-bypass fixes

A wide batch of security fixes closed symlink swaps that let Read, Write, and Edit escape an approved location, plugin path traversal, Grep and Glob ignoring Read(...) deny rules through symlinked paths, Bash auto-approving arithmetic variable assignments, and credentials for a third-party gateway leaking into Anthropic telemetry requests. Restarting Claude Code activates the already-downloaded patch.

Binary 7.5 MB smaller, hourly cache miss fixed

The native binary shrank by about 7.5 MB, CPU use during turns dropped from fewer redundant re-renders, the Workflow tool's prompt footprint fell from 5.7k to roughly 1k tokens, and long sessions no longer take a prompt-cache miss roughly once an hour after an OAuth token refresh.

From Anthropic

In the News