Restricted Mode, a Larger Context Ceiling, and the Pentagon Ruling

I'm Shannon, and this is the Claude Notes Brief -- your weekly rundown of Claude Code updates and Anthropic news for the week of Monday, August thirty-first. A new restricted mode removes command execution for untrusted code. Auto-compact now triggers later on the one million token window. And a federal judge ruled on the Pentagon's Anthropic ban.

Let's start with Claude Code, where a new restricted mode is now available for sessions where you don't fully trust the code in front of you. When you turn it on, Claude Code removes every built-in tool that can run commands or execute code, and it drops web fetching too unless you explicitly name it in your allowed tools. File tools stay inside your working directory, requests to bypass permissions are refused outright, and user, project, and local settings files are ignored entirely. That last part matters.

It means a repository can't quietly configure its own permissions on the way in, which makes this a practical option for handing Claude an untrusted codebase or running it inside automation you don't control end to end. Staying with limits for a moment, but a very different kind -- if you run Sonnet five with the one million token context window, auto-compact now waits longer before it steps in. The threshold moved from roughly nine hundred thirty-four thousand tokens up to about nine hundred sixty-seven thousand, so you get around thirty-three thousand more tokens of conversation before a summarization pass interrupts what you're doing. Control over models got more granular as well.

There are two new hook events that fire before and after a model switch, so you can block, confirm, or annotate any mid-session change -- useful if you want to keep expensive models out of particular repositories. Session-start resume hooks also now receive information about how stale a session is and what it would cost to re-cache it. The cost and usage views picked up matching detail. The cost view now shows a per-session prompt-cache line with hit ratio, misses, tokens re-cached, and whether the cache is warm or cold, and that data is exposed for status line scripts too.

The usage view adds a spend limit bar if you're working behind a Claude apps gateway with limits configured. And on the permissions side, there's now a tab for inspecting and editing the classifier rules that decide what runs without asking you first. Bash permission prompts also offer a one-keystroke option to approve and switch into auto mode at the same time. Two smaller changes round out the week.

Remote Control clients now stream a foreground subagent's tool calls and results live instead of just showing a status. And when you change directories mid-session, the new directory's project settings, hooks, skills, agents, and configured servers all take effect immediately rather than waiting for a resume.

Under the hood, this was a security-heavy week. A wide batch of fixes closed symlink swaps that let the read, write, and edit tools escape an approved location, along with plugin path traversal and search tools ignoring deny rules through symlinked paths. Bash was auto-approving arithmetic variable assignments -- that's fixed. And credentials for a third-party gateway were leaking into Anthropic telemetry requests, which is also closed.

The patch is already downloaded, but it activates on restart, so if your session has been open for days, that restart is worth doing. On the performance side, the native binary shrank by about seven and a half megabytes, and processor use during turns dropped thanks to fewer redundant re-renders. The Workflow tool's prompt footprint fell from roughly fifty-seven hundred tokens down to about one thousand. And long sessions no longer take a prompt-cache miss roughly once an hour after an authentication token refresh.

Now to the broader Anthropic news. The Guardian is reporting that a federal judge struck down the Pentagon's supply-chain risk designation for Anthropic, calling the measures baseless. That ruling clears a significant obstacle to Claude deployments in United States government and defense-adjacent organizations. On the infrastructure side, the Financial Times reports Anthropic has committed forty-five billion dollars to compute capacity from the UK provider Nscale.

Commitments of that size shape how quickly rate limits and premium model access can expand. Two more worth your time. Bloomberg reports Anthropic has opened a research preview of the Model Hardware Standard, a specification that lets agents operate physical devices -- if you already build with the Model Context Protocol, this is that same playbook extended to lab instruments and manufacturing equipment. And the Wall Street Journal reports Salesforce deepened its Claude partnership alongside stronger quarterly results.

We'll link all of those in the show notes, along with two Anthropic posts: Claude in Chrome is now generally available on every paid plan, and there's a walkthrough of how Warp builds agents that refine their own instructions over time. That's it for the brief. I'm Shannon, and we'll see you next week.