You can now use the Fable 5.2 and Mythos 5.2 models in Claude Code with the short names fable-5-2 and mythos-5-2. Fable 5.2 is now listed as the latest model, and fable52 works as an alias too. Plugins can use a new tool.check hook to make tool permissions stricter, but never looser for built-in tools. Plugins can also answer or rewrite outgoing web requests, and they are never lent your sign-in. Setting CLAUDE_CODE_ULTRAREVIEW_PR_AS_MERGED asks /ultrareview to review a pull request as it was merged. This release has 418 entries, and 270 of them are usable today.
Some features are in the build but are not switched on yet. A remote switch can make /privacy-settings open your privacy settings on claude.ai in your browser. Video attachments can carry a preview image, but only in hosted remote environments with a switch on. A skill's compatibility note can tell Claude when the skill needs your own computer or network, behind a switch that is off by default. Code editors may show a recommended extension, also behind a remote switch.
Stalled secure connections now stop with a clear error instead of hanging. The usual limit is 120 seconds, and the error says to check your network or proxy. The bridge command now loads the settings file you pass with --settings. Plugin sync now keeps plugins you already installed when your account's plugin list fails to load. A skills folder created after startup is now picked up and watched. The email address privacy prompt for shell and web actions no longer appears in the list of features.
Written by our agent from the shipped bundle, not by Anthropic.
Claude Code recognises the Fable 5.2 and Mythos 5.2 models, needs an explicit opt-in for fast mode on them, and keeps your model when fast mode supports it
Sessions & agentsclaude remote-control --settings <file> passes a settings file to spawned sessions, which refuse to start if that file or their start folder changed
A fable52 model alias is added, and the model picker gains a collapsible 'More models' row with Fable 5.2 highlighted
Claude Code can now check and merge a list of blocked MCP tools, called mcpDeniedTools, into its settings
ExtensionsPlugins can now hook outgoing web requests to answer or rewrite them, but are never lent your sign-in
ExtensionsWant the reasoning? Read walks the 54 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
Claude Code can now check and merge a list of blocked MCP tools, called mcpDeniedTools, into its settings
Unclear It is not clear where the mcpDeniedTools list comes from or whether anything uses it yet.
Setting CLAUDE_CODE_USER_DELEGATED_SESSION_DIRECT_API gives remote sessions a separate failure type when their route is refused
Two user delegated session variables are passed to spawned processes, and --bg and plugin eval refuse to run when the direct API one is set
Unclear It is not clear what values CLAUDE_CODE_USER_DELEGATED_SESSION_ALLOWED_CHECK_MODELS accepts or which models it lets through.
Claude Code now has messages suggesting Defense Access or the Cyber Verification Program to reduce interruptions to security work
Claude Code's Vertex AI model check has a new bearer-token sign-in mode, but nothing in this build can switch it on
The apps gateway now refuses to serve a desktop policy entry with unknown fields that Claude Desktop would drop or misread, instead of only warning
In a user-delegated session, Claude Code now refuses API calls to routes that are not allowed and shows an error
Unclear It is not clear what makes a session user-delegated, so it is unclear who is affected.
Claude Code now has saved settings and event names for an organisation model-choice move, goal re-arming and plugin restore, but none do anything visible yet
claude plugin restore-set-aside <plugin> gives set-aside plugin options and secrets to the current plugin, or deletes them with --discard
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
18 more of these are in What probably matters to you, above.
Plugin MCP servers matching a connector your organization blocked on claude.ai can now be blocked or just counted
Unclear It is not settled which mode applies when nothing sets require_connector_block_on_plugin_servers, so whether blocking is enforced by default is unclear.
Bedrock, Mantle, Foundry and Vertex now look up a credential first and use it as a bearer token or API key before the usual sign-in
Unclear Where the credential lookup gets its values from, and so how you would supply one, is not clear.
The gateway no longer reads the Bedrock, Vertex or Foundry base-URL variables, and Bedrock without base_url uses its regional endpoint
Claude Code can warn you when your version is below an announced minimum, and suggests asking your admin or running claude update
If your organization sets an upcoming minimum version and date, Claude Code can show a notice before that version becomes required
When Claude Code runs without an interactive terminal, a new startup check can refuse a user-delegated session and exit
Unclear What the startup check tests, and so when a start is refused, is not stated.
Claude Code skips connecting to an MCP server when the headers it would send fall under an organization's connector block
Unclear Where the organization's connector block is set, and which users it applies to, is not stated.
A plugin's MCP server sign-in is stopped when Claude Code cannot check it against your organization's connector settings
When Bedrock, Vertex or Foundry refuses your credentials, Claude Code now shows advice from the host program for that model if it has some
When CLAUDE_CODE_CUSTOM_OAUTH_URL is set, Claude Code turns off all default sign-in permission requests and records that variable as the reason
Ultrareview now refuses to start a cloud review, with nothing billed, when organization settings would block the hook that returns its findings
Sessions through a gateway, or with a custom base URL and ANTHROPIC_AUTH_TOKEN, now get the usage check and skip the usage-limit status record
Claude Code now stops a side request before sending it if the model it would use is not allowed
Claude Code now checks MCP servers against the organization's Claude in Chrome policy before and after connecting, and skips refused ones
Unclear Whether this check applies to every MCP server or only to the Claude in Chrome one is not clear.
If managed settings cannot be read, Claude Code tries again during the session and says plainly that the settings were not checked
Unclear It is not settled whether Claude Code holds back restricted actions or carries on when the managed settings still cannot be read.
Refreshing the Claude in Chrome server's tools, or sending it messages, now fails if the organisation's policy turns it off or cannot be read
Claude Code now re-reads settings pushed by device management when the managed value changes, and reports failures on the first check
Claude Code warns when managed settings give a plugin marketplace a non-absolute path, and now compares pins for marketplaces that come from settings
Unclear What Claude Code does with the new list of sensitive file names is not shown.
MCP servers added on the fly through the SDK are checked before and after connecting; a refused one is closed and adds no tools
Unclear What the check compares a server against, such as an organization policy or an allowlist, is not known.
Claude Code now rechecks SDK MCP servers against policy before reuse, refreshes tools only for allowed servers, and sorts private addresses by type
Unclear Which servers the new checks would turn away, and what you would see when that happens, is not stated.
Claude Code now removes Bedrock ARN, region and anthropic. prefixes from a model ID before checking which model it is
Unclear It is not clear whether Bedrock model IDs that were not recognised before are recognised now.
The forceLoginMethod setting's description now says claudeai means any Claude subscription, including Team and Enterprise plans
A marketplace named in managed settings now removes a same-named install from another source, and admins can word the policy error
Unclear Where administrators set the custom lines for the unreadable-policy error is not stated.
Plugins from a marketplace named in managed settings are taken back, unless installed_plugins.json cannot be read, which stops it with an error
Runner help now says the process exits 0 when the runner is not needed and 1 for anything else
3 more of these are in What probably matters to you, above.
Five AWS and Google credential environment variables were added to three lists of cloud provider settings
Unclear What the three lists control, for example limits in managed settings or removal before running other programs, is not clear.
With CLAUDE_CODE_USE_GATEWAY set, sign-in setup now records whether the credential store was unavailable or a saved sign-in was found
Each reason a remote work order is refused now has an exit code, so unneeded runners exit with 0
Claude Code now builds its MCP server policy rules through a single shared merge step
Unclear It is not clear whether the shared merge step makes allow, deny or ask decisions behave differently.
The limit on how long an unused pooled connection stays open can now also be switched on by an organization-level setting
Claude Code now fetches policy limits over HTTPS through a connection that guards against hangs while it is being set up
Marketplaces set by managed settings are now marked, so a later change of source counts as a move and plugins keep what they saved
Published verbatim by Anthropic for v2.1.321. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 118 bullets, 23 name something an entry on this page also names, 30 name something no entry here does, and 65 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
claude-fable-5-2), now the default Fable model — 1M context, $8/$40 per Mtok with $0.20/Mtok cache reads
Probably fast-mode-now-needs-an-explicit-opt-in-on-fable-52-mythos, fable-52-and-mythos-52-model-recognition-added --settings <file> to claude remote-control, which applies a settings file to every session it starts; if the file changes, no new session starts until you restart claude remote-control
Probably cloud-sessions-refuse-an-automode-block-instead-of-dropping, remote-control-refuses-settings-before-the-verb-with-a-hi, remote-control-settings-forwarded-to-child-sessions-dire, remote-control-child-sessions-refuse-a-settings-file-that-ch, bridge-fast-path-now-honours-settings, remote-control-cli-adds-settings-and-debug-file-rejects, remote-control-gets-a-settings-flag-for-spawned-sessions cp or mv into a directory writes
Nothing to match on claude mcp login printing a SEP-2352 issuer warning each time you sign in again to a server that Claude Code registered with
No entry names this #108158[BUG] MCP OAuth: SEP-2352 "no 'issuer' stamp" warning on every claude mcp login — provider doesn't round-trip issuer Open
NotebookEdit deleting or overwriting a notebook's first cell when the call named no cell, on network paths (UNC shares, WSL folders, /net mounts)
No entry names this old_string, or editing a notebook as text, on network paths (UNC shares, WSL folders, /net mounts)
No entry names this /config showing Manual as the default permission mode when new sessions start in auto mode; pressing Space on "Auto (default)" now saves Don't Ask, not Plan
No entry names this FileChanged hooks stopping for paths set through watchPaths after the first shell command, when the session's working directory had a lowercase drive letter
No entry names this --plugin-dir . and --plugin-dir ./builtin writing generated type files for Claude Code's built-in plugins into a builtin folder
No entry names this /compact showing twice in Remote Control on web and mobile
No entry names this #100427[BUG] Remote Control: one /compact shows twice in the phone app (typed prompt and command-name record both rendered) Open
/plugin marketplace updates downloading a plugin again for each worktree or folder of a repository
No entry names this git stash, including after entering a worktree
No entry names this claude -p sometimes telling Claude that background commands get 30 minutes when they are stopped after 10
Probably headless-p-error-exit-carries-a-reason #103473[BUG] Print mode: Bash schema tells the model background commands get 30 min, but they are killed at 10 min (and the stated default flips between launches, breaking the prompt cache) Open
pkill, pgrep and pidwait in cloud sessions matching the session's own parent processes
Nothing to match on ask reason instead of another hook's when both asked
Nothing to match on ask being lost when another hook's defer finished first and could not be honored
Nothing to match on /desktop on macOS saying Claude Desktop is not installed when it is in ~/Applications
No entry names this #107903/desktop does not detect Claude Desktop installed in ~/Applications (still reproduces on 2.1.319, same as #41899) Open
#98476[Bug] Desktop command fails when claude.app installed in ~/Applications instead of /Applications Open
vcs.*) missing from Claude Desktop sessions that start on a pre-started process
No entry names this #108072[BUG] Desktop app sessions never report vcs.repository.* OTel attributes (spare process starts outside the repo) Open
claude agents ignoring --permission-mode, --dangerously-skip-permissions, --model, --effort or --agent typed before agents when a flag such as --verbose was also on the line
Probably remote-control-refuses-settings-before-the-verb-with-a-hi, remote-control-gets-a-settings-flag-for-spawned-sessions claude -p, SDK and VS Code sessions hanging, when memory ran out while the transcript was being read
Probably headless-p-error-exit-carries-a-reason grep -r foo "$PWD/src" asking for permission when the same command with the path typed out runs without asking
No entry names this desktop setting holds a field newer than the gateway, such as a managed MCP server's oauth.omitResource; it now warns and serves it
No entry names this .zshrc sets KSH_OPTION_PRINT
No entry names this #96333[BUG] Bash tool produces no output when KSH_OPTION_PRINT is set in ~/.zshrc Open
UserPromptSubmit hook blocked a replayed permission answer; these hooks no longer run on that replay
No entry names this claude remote-control accepting a y typed without Enter at its first-run question when the terminal's input ended
Probably remote-control-refuses-settings-before-the-verb-with-a-hi, remote-control-settings-forwarded-to-child-sessions-dire, remote-control-cli-adds-settings-and-debug-file-rejects code: rules
Nothing to match on PreToolUse mcp_tool hooks on stdio and HTTP MCP servers being skipped when their answer was over 16 MiB; the tool call is now refused
Probably remote-mcp-hook-calls-get-clearer-errors-on-oversize-results claude -p on Linux exiting 0 in silence when a full NFS export or a used-up NFS quota lost transcript lines: it now prints an error and, in text and json output, exits 1
Probably headless-p-error-exit-carries-a-reason claude mcp list output, when a stored MCP sign-in record was null
No entry names this /model picker: "More models" is now an unnumbered row below every other, and older models open under it without renumbering the rest
Probably remote-control-slash-commands-unavailable-here-get-specific, model-switch-notice-while-the-cloud-session-is-not-ready, model-picker-gets-a-collapsible-more-models-row-and-fable /device page: they no longer name gateway settings, which the gateway's own log still names
No entry names this claude install and the install scripts: they finish 2 to 4 seconds sooner
No entry names this claude --bg --worktree session that couldn't set up its worktree: it now shows the error from its beginning, not an internal tag or its last 200 characters
Probably worktree-startup-errors-routed-through-a-common-exit-helper /login is offered only if it's one of yours, and Claude now says where a copy may be after an account move
Probably remote-control-other-org-message-reworded, artifact-error-for-other-org-now-suggests-login, artifact-watch-error-messages-reworded, artifact-lookup-messages-cover-organizations-the-user-has-le claude remote-control's messages for an unanswered first-run question: each now says what to do next
Probably remote-control-refuses-settings-before-the-verb-with-a-hi, remote-control-settings-forwarded-to-child-sessions-dire, remote-control-cli-adds-settings-and-debug-file-rejects allowedProviders setting description to name Ultra alongside Pro and Max, and the forceLoginMethod description to cover every paid Claude plan
Probably managed-settings-read-failures-now-re-read-and-report-reason, login-method-setting-description-reworded allowUnsandboxedCommands: false or allowManagedDomainsOnly, and not to load in dontAsk mode
Probably hooksmods-refused-in-dontask-permission-mode $.tool.call, $.mcp.call) to raise no permission prompt, even under your own ask rules or in dontAsk and -p runs; deny rules and organization policy still apply
Probably hooksmods-refused-in-dontask-permission-mode fable: on Pro and Max plans at once, on Team and Enterprise plans once your organization allows it; use /model claude-fable-5-1 to switch back
Probably remote-control-slash-commands-unavailable-here-get-specific, model-switch-notice-while-the-cloud-session-is-not-ready, model-picker-gets-a-collapsible-more-models-row-and-fable /fast, /config and /model to name your current model when it supports fast mode, and removed "(Opus only)" from the VS Code row
Probably remote-control-slash-commands-unavailable-here-get-specific, model-switch-notice-while-the-cloud-session-is-not-ready, model-picker-gets-a-collapsible-more-models-row-and-fable, fast-mode-prompt-text-changed-no-longer-says-it-never-downg, fast-mode-off-status-line-hints-fast .claude/skills folders inside ~/.claude/plugins no longer load when Claude works on files there
No entry names this num_hooks and num_success after Bash and PowerShell calls
No entry names this AskUserQuestion in claude -p and SDK sessions to deny a host's permission answer that sets the undocumented afkTimeoutMs input field
Probably headless-p-error-exit-carries-a-reason, askuserquestion-timeout-can-be-admitted-as-nobody-answered, server-supplied-askuserquestion-prompt-text-removed-tengu-c extraKnownMarketplaces: a declared name can't be added from another source, an entry from elsewhere is hidden, and plugins the declared marketplace lists are reinstalled from it
No entry names this policy_mode: layered in the Claude apps gateway: managed MCP servers now add up over every matching policy, match: {} included, so a gateway already on it serves more after the upgrade
No entry names this ANTHROPIC_*_BASE_URL variables in the gateway's environment. Set base_url on the upstream to use another endpoint
Probably gateway-warning-for-base-url-env-vars-changed-and-now-covers, bedrock-requests-always-get-an-explicit-regional-base-url .claude/skills when their files change; set CLAUDE_CODE_PLUGIN_DIR_WATCH=0 to turn this off
No entry names this cp and mv spelled by a path, such as /bin/cp, to get the same path checks as cp and mv
Probably telemetry-and-config-additions extraKnownMarketplaces take-overs from an undeclared source: saved data is set aside for cleanupPeriodDays, and options and secrets until claude plugin restore-set-aside
Probably new-claude-plugin-restore-set-aside-command-with-disca A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
2 added and 2 removed, of 218 lines, about 38 words, in the prompt 14 of 27 arms receive. 4 other prompts also changed. The appended system-reminder blocks moved: 2 lines added, 2 lines removed.
Claude Code, interactive mode
5 prompt changes in this release could not be quoted from the build, so no entry on this page describes them.
834 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 57 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?