Security changedsecurity
Nearest release: v2.1.302, published 3 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 16 Oct 2026 20:11 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 22 Oct 2026 18:07 UTC.
Upstream edited
Recorded here
Lines+30added
Lines−30removed
From line
10
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits13to this page, all time
The whole hunk
from line 10, old and new numbered
/
from line 10
1010
1111### Permission-based architecture
1212
13A session's permission mode sets which actions Claude can take without asking you first. Auto mode is the built-in starting permission mode for interactive terminal and VS Code sessions. [Which mode a session starts in](/docs/en/permission-modes#which-mode-a-session-starts-in) covers earlier versions, other surfaces, and the settings that change the starting permission mode.
13A session's permission mode sets which actions Claude can take without asking you first. Auto mode is the built-in starting permission mode for interactive terminal and VS Code sessions. [Which mode a session starts in](/docs/en/permission-modes.md#which-mode-a-session-starts-in) covers earlier versions, other surfaces, and the settings that change the starting permission mode.
1414
15* **Auto mode**: A separate classifier model reviews actions instead of you and blocks the ones it judges unsafe. [How the classifier evaluates actions](/docs/en/permission-modes#how-the-classifier-evaluates-actions) lists which actions Claude Code approves outright, which it sends to the classifier, and which Claude Code still asks you about. Your explicit ask and deny rules still apply, and your organization can [turn auto mode off](/docs/en/permission-modes#eliminate-prompts-with-auto-mode)
16* **Manual mode**: Claude Code starts with read-only permissions. When it needs to edit files, run tests, or execute commands, it asks you first, and you choose whether to approve the action once or allow it from then on. It runs a built-in set of [read-only commands](/docs/en/permissions#read-only-commands) such as `ls`, `cat`, and `git status` without asking
15* **Auto mode**: A separate classifier model reviews actions instead of you and blocks the ones it judges unsafe. [How the classifier evaluates actions](/docs/en/permission-modes.md#how-the-classifier-evaluates-actions) lists which actions Claude Code approves outright, which it sends to the classifier, and which Claude Code still asks you about. Your explicit ask and deny rules still apply, and your organization can [turn auto mode off](/docs/en/permission-modes.md#eliminate-prompts-with-auto-mode)
16* **Manual mode**: Claude Code starts with read-only permissions. When it needs to edit files, run tests, or execute commands, it asks you first, and you choose whether to approve the action once or allow it from then on. It runs a built-in set of [read-only commands](/docs/en/permissions.md#read-only-commands) such as `ls`, `cat`, and `git status` without asking
1717
18You and your organization configure these permissions directly. For detailed permission configuration, see [Permissions](/docs/en/permissions).
18You and your organization configure these permissions directly. For detailed permission configuration, see [Permissions](/docs/en/permissions.md).
1919
2020### Built-in protections
2121
2222To mitigate risks in agentic systems:
2323
24* **Sandboxed bash tool**: [Sandbox](/docs/en/sandboxing) bash commands with filesystem and network isolation, reducing permission prompts while maintaining security. Configure with `/sandbox` to define boundaries where Claude Code can work autonomously
24* **Sandboxed bash tool**: [Sandbox](/docs/en/sandboxing.md) bash commands with filesystem and network isolation, reducing permission prompts while maintaining security. Configure with `/sandbox` to define boundaries where Claude Code can work autonomously
2525* **Working directory boundary**: In Manual mode, Claude Code asks you before its file tools read or write outside the folder where it was started and its subfolders. The boundary is a permission prompt, so a Bash command you approve can still write anywhere your user account can
26 * To read a folder without the prompt, add it as an [additional directory](/docs/en/permissions#working-directories)
27 * To restrict Bash commands at the operating system level, turn on [sandboxing](/docs/en/sandboxing#filesystem-isolation)
26 * To read a folder without the prompt, add it as an [additional directory](/docs/en/permissions.md#working-directories)
27 * To restrict Bash commands at the operating system level, turn on [sandboxing](/docs/en/sandboxing.md#filesystem-isolation)
2828* **Prompt fatigue mitigation**: Support for allowlisting frequently used safe commands per-user, per-codebase, or per-organization
2929* **Accept Edits mode**: Auto-approves file edits and a fixed set of filesystem Bash commands like `mkdir`, `touch`, `rm`, `mv`, `cp`, and `sed` for paths in the working directory. Other Bash commands and out-of-scope paths still prompt
3030
from line 39
3939### Core protections
4040
4141* **Permission system**: In Manual mode, sensitive operations require explicit approval
42* **Network command approval**: Commands that fetch content from the web such as `curl` and `wget` are not auto-approved by default. In Manual mode they prompt like any other non-read-only Bash command, so you can still approve once or add an explicit allow rule like `Bash(curl *)`. To stop Claude from running them, add them to [`permissions.deny`](/docs/en/permissions#tool-specific-permission-rules). A deny rule matches the command [as written](/docs/en/permissions#bash-rule-limits); for network enforcement that doesn't depend on the command text, see [sandbox network isolation](/docs/en/sandboxing#network-isolation)
42* **Network command approval**: Commands that fetch content from the web such as `curl` and `wget` are not auto-approved by default. In Manual mode they prompt like any other non-read-only Bash command, so you can still approve once or add an explicit allow rule like `Bash(curl *)`. To stop Claude from running them, add them to [`permissions.deny`](/docs/en/permissions#tool-specific-permission-rules). A deny rule matches the command [as written](/docs/en/permissions.md#bash-rule-limits); for network enforcement that doesn't depend on the command text, see [sandbox network isolation](/docs/en/sandboxing.md#network-isolation)
4343
4444### Privacy safeguards
4545
from line 54
5454### Additional safeguards
5555
5656* **Network request approval**: In Manual mode, most tools that make network requests require user approval by default
57* **Web page summaries**: For most fetches, WebFetch runs a separate model call over the page, and Claude receives that call's answer instead of the raw page. See [WebFetch tool behavior](/docs/en/tools-reference#webfetch-tool-behavior)
58* **Trust verification**: In an interactive session, Claude Code shows the workspace trust dialog when you start it in a folder you haven't trusted. Servers in a project's `.mcp.json` have their own approval prompt, and [Project scope](/docs/en/mcp#project-scope) lists the sessions that skip it
59 * Note: A `-p` session shows neither prompt. [What runs before you trust a folder](/docs/en/permissions#what-runs-before-you-trust-a-folder) lists what a repository's files can run there
57* **Web page summaries**: For most fetches, WebFetch runs a separate model call over the page, and Claude receives that call's answer instead of the raw page. See [WebFetch tool behavior](/docs/en/tools-reference.md#webfetch-tool-behavior)
58* **Trust verification**: In an interactive session, Claude Code shows the workspace trust dialog when you start it in a folder you haven't trusted. Servers in a project's `.mcp.json` have their own approval prompt, and [Project scope](/docs/en/mcp.md#project-scope) lists the sessions that skip it
59 * Note: A `-p` session shows neither prompt. [What runs before you trust a folder](/docs/en/permissions.md#what-runs-before-you-trust-a-folder) lists what a repository's files can run there
6060 * Note: When you start Claude Code directly in your home directory, trust acceptance is held for the current session only and is not written to disk, so the prompt reappears on each launch. There is no setting to persist it. Start Claude Code from a project subdirectory instead, where trust acceptance is saved per directory
61* **Command injection detection**: In Manual mode, Claude Code asks before running a Bash command it can't fully analyze. An allow rule for part of a command, such as `Bash(git *)`, doesn't skip that prompt. [Sandboxed commands](/docs/en/permissions#how-permissions-interact-with-sandboxing) can run without it
61* **Command injection detection**: In Manual mode, Claude Code asks before running a Bash command it can't fully analyze. An allow rule for part of a command, such as `Bash(git *)`, doesn't skip that prompt. [Sandboxed commands](/docs/en/permissions.md#how-permissions-interact-with-sandboxing) can run without it
6262* **Fail-closed matching**: In Manual mode, unmatched commands require approval by default
63* **Secure credential storage**: API keys and tokens are stored in the macOS Keychain when available. On Linux they're stored in a file with mode `0600`, and on Windows in a file that inherits the access controls of your user profile directory. See [Credential Management](/docs/en/authentication#credential-management)
63* **Secure credential storage**: API keys and tokens are stored in the macOS Keychain when available. On Linux they're stored in a file with mode `0600`, and on Windows in a file that inherits the access controls of your user profile directory. See [Credential Management](/docs/en/authentication.md#credential-management)
6464
6565> [!WARNING]
6666>
from line 82
8282
8383## MCP security
8484
85You can connect Claude Code to Model Context Protocol (MCP) servers. Project-scoped servers are defined in `.mcp.json`, which you can check into source control. Servers at [other scopes](/docs/en/mcp#mcp-installation-scopes) and [claude.ai connectors](/docs/en/mcp#how-connectors-reach-claude-code) are configured outside the repository, and plugins can add servers too, so reviewing `.mcp.json` doesn't show every server a session can load. To restrict which servers run in your organization, see [Managed MCP configuration](/docs/en/managed-mcp).
85You can connect Claude Code to Model Context Protocol (MCP) servers. Project-scoped servers are defined in `.mcp.json`, which you can check into source control. Servers at [other scopes](/docs/en/mcp.md#mcp-installation-scopes) and [claude.ai connectors](/docs/en/mcp.md#how-connectors-reach-claude-code) are configured outside the repository, and plugins can add servers too, so reviewing `.mcp.json` doesn't show every server a session can load. To restrict which servers run in your organization, see [Managed MCP configuration](/docs/en/managed-mcp.md).
8686
8787We encourage either writing your own MCP servers or using MCP servers from providers that you trust. You are able to configure Claude Code permissions for MCP servers. Anthropic reviews connectors against its [listing criteria](https://claude.com/docs/connectors/building/review-criteria) before adding them to the [Anthropic Directory](https://claude.ai/directory), but does not security-audit or manage any MCP server.
8888
8989## IDE security
9090
91See [The built-in IDE MCP server](/docs/en/vs-code#the-built-in-ide-mcp-server) for more information on running Claude Code in an IDE.
91See [The built-in IDE MCP server](/docs/en/vs-code.md#the-built-in-ide-mcp-server) for more information on running Claude Code in an IDE.
9292
9393## Cloud execution security
9494
95When you use [cloud sessions](/docs/en/claude-code-on-the-web), additional security controls are in place. Sessions your organization routes to a [self-hosted environment](/docs/en/self-hosted-environments) run on your own infrastructure, where isolation, network egress, and git credentials are your deployment's responsibility. In Anthropic-hosted environments:
95When you use [cloud sessions](/docs/en/claude-code-on-the-web.md), additional security controls are in place. Sessions your organization routes to a [self-hosted environment](/docs/en/self-hosted-environments) run on your own infrastructure, where isolation, network egress, and git credentials are your deployment's responsibility. In Anthropic-hosted environments:
9696
9797* **Isolated virtual machines**: Each cloud session runs in an isolated, Anthropic-managed VM
9898* **Network access controls**: Network access is limited by default and can be configured to be disabled or allow only specific domains
99* **Credential protection**: GitHub credentials are stored encrypted on Anthropic's servers and never enter the session VM. The VM holds a short-lived credential scoped to that session, and GitHub traffic goes through an [Anthropic proxy](/docs/en/cloud-environments#github-proxy) that attaches the GitHub credential on the server side. See [GitHub authentication options](/docs/en/claude-code-on-the-web#github-authentication-options) for how you grant access
100* **Push restrictions**: The [GitHub proxy](/docs/en/cloud-environments#github-proxy) rejects branch deletions and pushes of anything other than a branch, such as a tag. GitHub decides which branches a session can update by applying your repository's branch protection rules and rulesets to the GitHub access you connected. A rule that access can bypass doesn't block a session's push
99* **Credential protection**: GitHub credentials are stored encrypted on Anthropic's servers and never enter the session VM. The VM holds a short-lived credential scoped to that session, and GitHub traffic goes through an [Anthropic proxy](/docs/en/cloud-environments.md#github-proxy) that attaches the GitHub credential on the server side. See [GitHub authentication options](/docs/en/claude-code-on-the-web.md#github-authentication-options) for how you grant access
100* **Push restrictions**: The [GitHub proxy](/docs/en/cloud-environments.md#github-proxy) rejects branch deletions and pushes of anything other than a branch, such as a tag. GitHub decides which branches a session can update by applying your repository's branch protection rules and rulesets to the GitHub access you connected. A rule that access can bypass doesn't block a session's push
101101* **Audit logging**: All operations in cloud sessions are logged for compliance and audit purposes
102102* **Automatic cleanup**: Session VMs are reclaimed after a period of inactivity
103* **Deletion**: You can [delete a session](/docs/en/claude-code-on-the-web#delete-sessions) at any time. See [Cloud execution data flow](/docs/en/data-usage#cloud-execution-data-flow-and-dependencies) for what Anthropic stores for a cloud session
103* **Deletion**: You can [delete a session](/docs/en/claude-code-on-the-web.md#delete-sessions) at any time. See [Cloud execution data flow](/docs/en/data-usage.md#cloud-execution-data-flow-and-dependencies) for what Anthropic stores for a cloud session
104104
105For more details on cloud execution, see [Use Claude Code in the cloud](/docs/en/claude-code-on-the-web); to configure network access for cloud sessions, see [Configure cloud environments](/docs/en/cloud-environments#network-access).
105For more details on cloud execution, see [Use Claude Code in the cloud](/docs/en/claude-code-on-the-web.md); to configure network access for cloud sessions, see [Configure cloud environments](/docs/en/cloud-environments.md#network-access).
106106
107[Remote Control](/docs/en/remote-control) sessions work differently: the web interface connects to a Claude Code process running on your local machine. All code execution and file access stays local, and session traffic travels through the Anthropic API over TLS; while connected, the session transcript is stored on Anthropic servers to sync the conversation across devices, as described in [Connection and security](/docs/en/remote-control#connection-and-security). No cloud VMs or sandboxing are involved. The connection uses multiple short-lived, narrowly scoped credentials, each limited to a specific purpose and expiring independently, to limit the blast radius of any single compromised credential.
107[Remote Control](/docs/en/remote-control.md) sessions work differently: the web interface connects to a Claude Code process running on your local machine. All code execution and file access stays local, and session traffic travels through the Anthropic API over TLS; while connected, the session transcript is stored on Anthropic servers to sync the conversation across devices, as described in [Connection and security](/docs/en/remote-control.md#connection-and-security). No cloud VMs or sandboxing are involved. The connection uses multiple short-lived, narrowly scoped credentials, each limited to a specific purpose and expiring independently, to limit the blast radius of any single compromised credential.
108108
109109## Security best practices
110110
from line 112
112112
113113* Review all suggested changes before approval
114114* Use project-specific permission settings for sensitive repositories
115* For additional isolation, run the whole Claude Code (local mode) process inside the [sandbox runtime](/docs/en/sandbox-environments#sandbox-runtime) or a [dev container](/docs/en/devcontainer)
115* For additional isolation, run the whole Claude Code (local mode) process inside the [sandbox runtime](/docs/en/sandbox-environments.md#sandbox-runtime) or a [dev container](/docs/en/devcontainer.md)
116116* Regularly audit your permission settings with `/permissions`
117117
118118### Team security
119119
120* Use [managed settings](/docs/en/settings#where-settings-live) to enforce organizational standards
120* Use [managed settings](/docs/en/settings.md#where-settings-live) to enforce organizational standards
121121* Share approved permission configurations through version control
122122* Train team members on security best practices
123* Monitor Claude Code usage through [OpenTelemetry metrics](/docs/en/monitoring-usage)
123* Monitor Claude Code usage through [OpenTelemetry metrics](/docs/en/monitoring-usage.md)
124124* Audit or block settings changes during sessions with [`ConfigChange` hooks](/docs/en/hooks#configchange)
125125
126126### Reporting security issues
from line 134
134134
135135## Related resources
136136
137* [Security guidance plugin](/docs/en/security-guidance): have Claude review and fix vulnerabilities in its own code changes during the session
137* [Security guidance plugin](/docs/en/security-guidance.md): have Claude review and fix vulnerabilities in its own code changes during the session
138138* [`/security-review`](/docs/en/commands#all-commands): run an on-demand security pass over the changes on your current branch
139* [Sandbox environments](/docs/en/sandbox-environments): compare isolation approaches and choose one for your threat model
140* [Sandboxing](/docs/en/sandboxing): filesystem and network isolation for Bash commands
141* [Permissions](/docs/en/permissions): configure permissions and access controls
142* [Monitoring usage](/docs/en/monitoring-usage): track and audit Claude Code activity
143* [Development containers](/docs/en/devcontainer): secure, isolated environments
139* [Sandbox environments](/docs/en/sandbox-environments.md): compare isolation approaches and choose one for your threat model
140* [Sandboxing](/docs/en/sandboxing.md): filesystem and network isolation for Bash commands
141* [Permissions](/docs/en/permissions.md): configure permissions and access controls
142* [Monitoring usage](/docs/en/monitoring-usage.md): track and audit Claude Code activity
143* [Development containers](/docs/en/devcontainer.md): secure, isolated environments
144144* [Anthropic Trust Center](https://trust.anthropic.com): security certifications and compliance
145145* [CISO's guide to agentic AI](https://claude.com/blog/ciso-guide-to-agentic-ai): a security leader's framework for assessing agentic AI deployments
146146
No line in this hunk matches that.