You can now use the Fable 5.2 and Mythos 5.2 models in Claude Code with the short names fable-5-2 and mythos-5-2. Fable 5.2 is now listed as the latest model, and fable52 works as an alias too. Plugins can use a new tool.check hook to make tool permissions stricter, but never looser for built-in tools. Plugins can also answer or rewrite outgoing web requests, and they are never lent your sign-in. Setting CLAUDE_CODE_ULTRAREVIEW_PR_AS_MERGED asks /ultrareview to review a pull request as it was merged. This release has 418 entries, and 270 of them are usable today.
Some features are in the build but are not switched on yet. A remote switch can make /privacy-settings open your privacy settings on claude.ai in your browser. Video attachments can carry a preview image, but only in hosted remote environments with a switch on. A skill's compatibility note can tell Claude when the skill needs your own computer or network, behind a switch that is off by default. Code editors may show a recommended extension, also behind a remote switch.
Stalled secure connections now stop with a clear error instead of hanging. The usual limit is 120 seconds, and the error says to check your network or proxy. The bridge command now loads the settings file you pass with --settings. Plugin sync now keeps plugins you already installed when your account's plugin list fails to load. A skills folder created after startup is now picked up and watched. The email address privacy prompt for shell and web actions no longer appears in the list of features.
Written by our agent from the shipped bundle, not by Anthropic.
Claude Code recognises the Fable 5.2 and Mythos 5.2 models, needs an explicit opt-in for fast mode on them, and keeps your model when fast mode supports it
Sessions & agentsclaude remote-control --settings <file> passes a settings file to spawned sessions, which refuse to start if that file or their start folder changed
A fable52 model alias is added, and the model picker gains a collapsible 'More models' row with Fable 5.2 highlighted
Claude Code can now check and merge a list of blocked MCP tools, called mcpDeniedTools, into its settings
ExtensionsPlugins can now hook outgoing web requests to answer or rewrite them, but are never lent your sign-in
ExtensionsWant the reasoning? Read walks the 54 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →18 more of these are in What probably matters to you, on page 1.
Ultrareview now refuses to start a cloud review, with nothing billed, when organization settings would block the hook that returns its findings
The timer that stops a stalled reply now survives sleep and clock changes and waits at least five minutes, and an unwatched-reply hold is added
Unclear What holding the main reply while the session is unwatched means for a user is not shown.
Claude Code can now move a plugin's data folder into a timestamped .set-aside folder rather than deleting it, leaving a marker if anything stays
Unclear When Claude Code sets plugin data aside, and whether it does so by default, is not shown.
Previews of oversized tool results that could not be saved now share a per-turn length budget, so later ones get shorter; off unless switched on remotely
When an artifact is in another organization, Claude Code says so plainly, suggests /login if it is yours, and mentions moved accounts
A note now explains what changed, removed or unread project docs mean when Claude reads from a project
After an .xlsx upload, Claude is told the file is download-only and blocks making the artifact public or shared outside the org while stored
When a hook's answer arrives over the network, Claude Code drops any change it makes to displayed text or to a tool's output
Unclear Which sessions treat hook answers as arriving over the network is not clear.
Over Remote Control, answers to hook callbacks are now refused, as answers to user dialogs already were
The REPL tool result has a new imagesRefused field noting images left out, such as repeated images of unchanged files
Turning on fast mode now runs an extra step, and a new minimum-version notice can show a warning
Unclear What the extra step does when fast mode is turned on, and what triggers the minimum-version warning, are not clear.
Read can now refuse to return an image it has already returned unchanged several times, telling Claude to use what it saw
Unclear Which state of the remote setting allows the refusal, and how many repeats it takes, is not clear.
When the API refuses an MCP tool's input description sent inside a message, Claude Code can now replace it and retry instead of only fixing the tools list
Unclear This repair sits behind a server-controlled setting, and nothing shows whether it is switched on.
Deny or ask rules beginning with ! in CLAUDE_CODE_MCP_SERVE_SETTINGS are dropped with a warning, since they would loosen earlier rules
Unclear It is not clear whether launch-time rules from sources other than CLAUDE_CODE_MCP_SERVE_SETTINGS are covered too.
Claude Code now stops a side request before sending it if the model it would use is not allowed
The Claude API skill now tells Claude to read it first, before answering, running a command or opening a file
A cloud session given an autoMode block through --settings or a repository's .claude/settings.json now stops with an error
Claude Code now checks MCP servers against the organization's Claude in Chrome policy before and after connecting, and skips refused ones
Unclear Whether this check applies to every MCP server or only to the Claude in Chrome one is not clear.
The approval flow for MCP tools that deliver session files now reads connector details and can ask again after an upload expires
Unclear Which MCP servers this check applies to in practice is not clear, since it requires a specific server id.
When a background session takes over a conversation, Claude Code restores its scheduled and looping prompts and tells you which it could not
When Artifacts are turned off in settings or by a deny rule, MCP servers that connect to the Artifacts server are not connected
Auto mode has a new block reason for when the turn has ended, an extra check before allowing a call, and no longer blames a hook
Unclear What makes auto mode use the new turn-ended block, and what its extra check looks at, is not stated.
Video attachments passed through the bridge now get a one-frame preview image, and large uploads stop if they take too long
Unclear Whether ffmpeg must already be installed on your computer for thumbnails to appear is not stated.
PostToolUse hooks can no longer change certain results, such as answers to Claude's questions or plans, and you now see a message when one tries
Unclear Exactly which tools are covered, and which part depends on the remote switch, is not stated.
Certain Stop hooks are now skipped when there is no git repository in the current folder or any folder above it
Unclear Which Stop hooks are affected is not stated; it may be only some built-in ones rather than hooks you write.
Claude Code now takes its startup git status with a time limit and safety checks, and leaves it out of Claude's context when a check fails
When a reply is cut off by a server error, Claude Code can wait before retrying; this is off unless switched on remotely
If a relayed approval changes what a tool will do, Claude Code now asks you instead of using the changed input silently
Claude Code now forces the transcript onto disk before adding to it, and starts a fresh line if the file ends partway through one
Sending files to a claude.ai connector now shows each file's progress, including when it is refused, stopped or done
Write now refuses to overwrite a file when only its start was shown in the session, so the rest is not lost
File uploads to MCP connectors stream from disk with progress and new refusal reasons, and blocked-connector notices say when the check itself failed
Cloud sessions report auto-mode rules as their own reason, and a stalled secure connection now stops with ERR_TLS_HANDSHAKE_STALLED
Auto mode now handles a new cd_restored rewrite cause and says when a call changed after it was reviewed
Claude Code refuses or asks about many more git options, flags and variables that could write into the shared checkout or run outside programs
The max_output_tokens API error now has a cut field, output_limit or context_window, saying why Claude's reply was cut short
Cutting very large CLAUDE.md files can now also apply in sessions with no local disk, behind an extra switch that is off by default
For an unrecognised slash command, Claude is told to use a skill of that name if there is one and never to say the command ran
When a message from an unverified device fails, Claude Code now says to resend it from a verified device or sign in again first
Claude Code now has a message telling Claude that a stopped agent will not be resumed and that its work counts as cancelled
Unclear It is not clear when Claude Code sends this message or whether the remote switch controls it.
Refused writes to the artifact database can now report that the document is read-only, and that nothing in a refused batch was written
claude respawn now stops with a clear message if the job's folder no longer exists or cannot be reached
Claude Code has new text pointing to your claude.ai privacy settings, and artifact comments explain that automatic replies are not carried over
Too many device sign-in attempts now produce a plain message to wait a few minutes, without gateway setting names
Claude Code now explains why a session is refused with a "Your session can't run on this machine" message and a specific cause
After a restart, the note listing stopped agents now says that only the ones it does not name are lost, so resumed agents are kept
The message shown when you can't send your conversation with a rating now lists Pro, Max and Ultra plans
Unclear Whether Ultra plans can actually send the conversation with a rating, or only the wording changed, is not settled.
When a shell command moves to the background, Claude can now be told the window within which it will normally be called back
Claude is now told stopped agents are resuming from saved transcripts, not to restart their tasks, and to message one if it goes quiet
Claude Code now stops an MCP sign-in request that is redirected to another site, or redirected too many times, and tells you why
Unclear The condition that decides when this redirect check runs is not known, so it is unclear whether it is active for everyone by default.
When auto mode checked a shell command without its leading cd and the folder has since changed, Claude is told how to retry
If Claude in Chrome cannot work out a tab's address, it now asks you or refuses with a clear message, depending on why
In remote sessions, Claude Code now notices when a subagent's transcript was dropped and fetches it again
A status message now appears when a Remote Control session fails over and over, saying a restart may take up to 10 minutes
Every web request Claude Code makes now has a default time limit, so a request that hangs is cancelled instead of waiting forever
Removed images and documents are replaced with a note saying they were cut for the request limit and whether Claude already saw them
In some remote sessions, /model, /effort, /mcp, /rename and /reload-plugins explain that they are unavailable and point to an alternative
Claude Code now refuses attachment names and paths with disallowed characters and tells you to rename or copy the file
Unclear Which characters count as disallowed is not shown.
When an MCP tool hook gets a result that is too large, it now gives no verdict and says the tool must send a smaller answer
When disk space runs low, Claude is now told to delete only temporary files it made, ask before deleting others, and tell you if that is not enough
claude mcp logout can now find servers blocked by a connector block#claude mcp logout can now find servers blocked by a connector block, and Claude Code now checks free disk space
A person's interrupt in headless mode with no turn running can now cancel queued waiting copies, and the reply lists what was cancelled
Unclear The remote setting that switches this on is not named, so it is unknown when it applies.
Hook input is now completed the same way the tool sees it, and the hook run stops early if that step fails unexpectedly
Claude Code now decides whether an exact-match Bash allow rule applies using new logic, not a plain text comparison
Unclear Whether this changes which Bash commands prompt for permission is not known.
MCP servers added on the fly through the SDK are checked before and after connecting; a refused one is closed and adds no tools
Unclear What the check compares a server against, such as an organization policy or an allowlist, is not known.
File uploads to an MCP server now need the 2026-07-28 protocol version and an upload entry, or Claude Code declines to upload
The Read tool now tracks image reads and refuses to read an unchanged image again once it passes a limit
Claude Code now rechecks SDK MCP servers against policy before reuse, refreshes tools only for allowed servers, and sorts private addresses by type
Unclear Which servers the new checks would turn away, and what you would see when that happens, is not stated.
If new input closes a waiting permission request, Claude Code now notes it so Claude can ask to use that same tool again
For some shell commands Claude Code now checks permission twice and, when both checks want to ask you, shows one combined prompt
Unclear It is not clear which commands trigger the second check.
When a file contains the closing tag Claude Code uses for its reminder notes, the tag is altered before the model sees it
When you resume a session, a repeating scheduled task now keeps the prompt it runs and the plugin that set it up
A bad --jq filter on a gh command now stops it before the request is sent, and Claude Code warns if a rerun would repeat a change
An MCP tool is left out if combining its schema options would take too much memory because of numeric property names
Over remote connections, Claude Code now sends permission requests one by one, holding later ones until the earlier one is answered
Unclear It is not settled whether this queueing always applies or only under some condition.
/loop wakeup now tells the rest of the session#When a cancelled job is a /loop wakeup, Claude Code now announces that the loop ended and reports it in the result
Remote Control refuses folder-change requests from remote clients, number keys skip marked options, and settings can show auto as the default mode
The upload message about files approved on their own now names .xlsx alongside CSV, Markdown, JSON and plain-text files
Claude Code now checks HTTP hook addresses against blocked ranges and records hits, but refuses the hook only when a server switch is on
Connector downloads now report progress, go smallest first, skip files already downloaded in the conversation and send big images to Read
Claude Code now examines the parts of simple shell commands before approving them, and asks you when it cannot check one fully
Failed MCP servers are no longer retried when their setup cannot be read or a policy blocked them
(*) or () are matched differently#Rules written as a tool name followed by (*) or () are read as covering the whole tool, without the earlier allow-only check
Unclear It is unclear whether deny and ask rules written with (*) or () are now also treated as covering the whole tool.
In auto mode, a subagent is not started if the safety classifier cannot check its prompt, and Claude Code says why
Claude Code now detects NFS transcript folders, tolerates unreadable transcript lines, and limits retries on a full disk
Background agent summaries and auto prompt suggestions are now discarded if the model tries to call a tool instead of writing text
Skill listings gain an addsToEarlier flag that changes the reminder wording and lets skills be re-sent after a reset
Claude Code's list of shell commands that write or remove files, which held rm, rmdir and tee, now also includes cp and mv
Unclear It is not stated what this list controls, so how cp and mv commands are now treated differently is unknown.
When installing a plugin, a name beginning with a dash is now refused, as the repo and owner already were
When Claude Code installs plugins without its interactive screen and no marketplaces are declared, it now runs an extra step instead of only logging
Unclear What the extra step does to plugin setup is not known.
When oversized tool output is cut short, Claude is now told if other large results in the same reply caused part of the shortening
Claude Code now handles a question timing out as a permission decision taken from config, plus a new sign-in-ended case and config-lock tracking
Unclear It is not clear what makes a question time out, so it is unclear when a timeout leads to an accept decision.
Claude Code now marks a shell test command with text after its closing ] as one it cannot check before it runs
Unclear It is not confirmed whether these commands now always ask for permission or how the note is shown to you.
When a plugin stops naming a hooks module, Claude Code reloads it and cancels any notification still pending for that plugin
An MCP server blocked by your organization's connector settings now says so and that an admin can change it on claude.ai
Claude Code now treats the git settings format.outputdirectory and format.suffix as dangerous, like core.worktree and core.bare
A stop request for an unknown shell-task-style ID now fails and asks for the agent's task ID instead of matching an agent by name
In remote sessions, rewinding no longer drops notices about background agents that are still running, when a switch allows it
Unclear The switch that decides whether the notices are kept, and its default, are not known.
Claude Code now tells the model why an artifact write was refused, not to retry it, and to publish under project/ instead
When text meant for the CLAUDE_JOB_DIR folder is over the length limit, Claude Code now skips writing it instead of saving a cut-off copy
Published verbatim by Anthropic for v2.1.321. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 118 bullets, 23 name something an entry on this page also names, 30 name something no entry here does, and 65 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
claude-fable-5-2), now the default Fable model — 1M context, $8/$40 per Mtok with $0.20/Mtok cache reads
Probably fast-mode-now-needs-an-explicit-opt-in-on-fable-52-mythos, fable-52-and-mythos-52-model-recognition-added --settings <file> to claude remote-control, which applies a settings file to every session it starts; if the file changes, no new session starts until you restart claude remote-control
Probably cloud-sessions-refuse-an-automode-block-instead-of-dropping, remote-control-refuses-settings-before-the-verb-with-a-hi, remote-control-settings-forwarded-to-child-sessions-dire, remote-control-child-sessions-refuse-a-settings-file-that-ch, bridge-fast-path-now-honours-settings, remote-control-cli-adds-settings-and-debug-file-rejects, remote-control-gets-a-settings-flag-for-spawned-sessions cp or mv into a directory writes
Nothing to match on claude mcp login printing a SEP-2352 issuer warning each time you sign in again to a server that Claude Code registered with
No entry names this #108158[BUG] MCP OAuth: SEP-2352 "no 'issuer' stamp" warning on every claude mcp login — provider doesn't round-trip issuer Open
NotebookEdit deleting or overwriting a notebook's first cell when the call named no cell, on network paths (UNC shares, WSL folders, /net mounts)
No entry names this old_string, or editing a notebook as text, on network paths (UNC shares, WSL folders, /net mounts)
No entry names this /config showing Manual as the default permission mode when new sessions start in auto mode; pressing Space on "Auto (default)" now saves Don't Ask, not Plan
No entry names this FileChanged hooks stopping for paths set through watchPaths after the first shell command, when the session's working directory had a lowercase drive letter
No entry names this --plugin-dir . and --plugin-dir ./builtin writing generated type files for Claude Code's built-in plugins into a builtin folder
No entry names this /compact showing twice in Remote Control on web and mobile
No entry names this #100427[BUG] Remote Control: one /compact shows twice in the phone app (typed prompt and command-name record both rendered) Open
/plugin marketplace updates downloading a plugin again for each worktree or folder of a repository
No entry names this git stash, including after entering a worktree
No entry names this claude -p sometimes telling Claude that background commands get 30 minutes when they are stopped after 10
Probably headless-p-error-exit-carries-a-reason #103473[BUG] Print mode: Bash schema tells the model background commands get 30 min, but they are killed at 10 min (and the stated default flips between launches, breaking the prompt cache) Open
pkill, pgrep and pidwait in cloud sessions matching the session's own parent processes
Nothing to match on ask reason instead of another hook's when both asked
Nothing to match on ask being lost when another hook's defer finished first and could not be honored
Nothing to match on /desktop on macOS saying Claude Desktop is not installed when it is in ~/Applications
No entry names this #107903/desktop does not detect Claude Desktop installed in ~/Applications (still reproduces on 2.1.319, same as #41899) Open
#98476[Bug] Desktop command fails when claude.app installed in ~/Applications instead of /Applications Open
vcs.*) missing from Claude Desktop sessions that start on a pre-started process
No entry names this #108072[BUG] Desktop app sessions never report vcs.repository.* OTel attributes (spare process starts outside the repo) Open
claude agents ignoring --permission-mode, --dangerously-skip-permissions, --model, --effort or --agent typed before agents when a flag such as --verbose was also on the line
Probably remote-control-refuses-settings-before-the-verb-with-a-hi, remote-control-gets-a-settings-flag-for-spawned-sessions claude -p, SDK and VS Code sessions hanging, when memory ran out while the transcript was being read
Probably headless-p-error-exit-carries-a-reason grep -r foo "$PWD/src" asking for permission when the same command with the path typed out runs without asking
No entry names this desktop setting holds a field newer than the gateway, such as a managed MCP server's oauth.omitResource; it now warns and serves it
No entry names this .zshrc sets KSH_OPTION_PRINT
No entry names this #96333[BUG] Bash tool produces no output when KSH_OPTION_PRINT is set in ~/.zshrc Open
UserPromptSubmit hook blocked a replayed permission answer; these hooks no longer run on that replay
No entry names this claude remote-control accepting a y typed without Enter at its first-run question when the terminal's input ended
Probably remote-control-refuses-settings-before-the-verb-with-a-hi, remote-control-settings-forwarded-to-child-sessions-dire, remote-control-cli-adds-settings-and-debug-file-rejects code: rules
Nothing to match on PreToolUse mcp_tool hooks on stdio and HTTP MCP servers being skipped when their answer was over 16 MiB; the tool call is now refused
Probably remote-mcp-hook-calls-get-clearer-errors-on-oversize-results claude -p on Linux exiting 0 in silence when a full NFS export or a used-up NFS quota lost transcript lines: it now prints an error and, in text and json output, exits 1
Probably headless-p-error-exit-carries-a-reason claude mcp list output, when a stored MCP sign-in record was null
No entry names this /model picker: "More models" is now an unnumbered row below every other, and older models open under it without renumbering the rest
Probably remote-control-slash-commands-unavailable-here-get-specific, model-switch-notice-while-the-cloud-session-is-not-ready, model-picker-gets-a-collapsible-more-models-row-and-fable /device page: they no longer name gateway settings, which the gateway's own log still names
No entry names this claude install and the install scripts: they finish 2 to 4 seconds sooner
No entry names this claude --bg --worktree session that couldn't set up its worktree: it now shows the error from its beginning, not an internal tag or its last 200 characters
Probably worktree-startup-errors-routed-through-a-common-exit-helper /login is offered only if it's one of yours, and Claude now says where a copy may be after an account move
Probably remote-control-other-org-message-reworded, artifact-error-for-other-org-now-suggests-login, artifact-watch-error-messages-reworded, artifact-lookup-messages-cover-organizations-the-user-has-le claude remote-control's messages for an unanswered first-run question: each now says what to do next
Probably remote-control-refuses-settings-before-the-verb-with-a-hi, remote-control-settings-forwarded-to-child-sessions-dire, remote-control-cli-adds-settings-and-debug-file-rejects allowedProviders setting description to name Ultra alongside Pro and Max, and the forceLoginMethod description to cover every paid Claude plan
Probably managed-settings-read-failures-now-re-read-and-report-reason, login-method-setting-description-reworded allowUnsandboxedCommands: false or allowManagedDomainsOnly, and not to load in dontAsk mode
Probably hooksmods-refused-in-dontask-permission-mode $.tool.call, $.mcp.call) to raise no permission prompt, even under your own ask rules or in dontAsk and -p runs; deny rules and organization policy still apply
Probably hooksmods-refused-in-dontask-permission-mode fable: on Pro and Max plans at once, on Team and Enterprise plans once your organization allows it; use /model claude-fable-5-1 to switch back
Probably remote-control-slash-commands-unavailable-here-get-specific, model-switch-notice-while-the-cloud-session-is-not-ready, model-picker-gets-a-collapsible-more-models-row-and-fable /fast, /config and /model to name your current model when it supports fast mode, and removed "(Opus only)" from the VS Code row
Probably remote-control-slash-commands-unavailable-here-get-specific, model-switch-notice-while-the-cloud-session-is-not-ready, model-picker-gets-a-collapsible-more-models-row-and-fable, fast-mode-prompt-text-changed-no-longer-says-it-never-downg, fast-mode-off-status-line-hints-fast .claude/skills folders inside ~/.claude/plugins no longer load when Claude works on files there
No entry names this num_hooks and num_success after Bash and PowerShell calls
No entry names this AskUserQuestion in claude -p and SDK sessions to deny a host's permission answer that sets the undocumented afkTimeoutMs input field
Probably headless-p-error-exit-carries-a-reason, askuserquestion-timeout-can-be-admitted-as-nobody-answered, server-supplied-askuserquestion-prompt-text-removed-tengu-c extraKnownMarketplaces: a declared name can't be added from another source, an entry from elsewhere is hidden, and plugins the declared marketplace lists are reinstalled from it
No entry names this policy_mode: layered in the Claude apps gateway: managed MCP servers now add up over every matching policy, match: {} included, so a gateway already on it serves more after the upgrade
No entry names this ANTHROPIC_*_BASE_URL variables in the gateway's environment. Set base_url on the upstream to use another endpoint
Probably gateway-warning-for-base-url-env-vars-changed-and-now-covers, bedrock-requests-always-get-an-explicit-regional-base-url .claude/skills when their files change; set CLAUDE_CODE_PLUGIN_DIR_WATCH=0 to turn this off
No entry names this cp and mv spelled by a path, such as /bin/cp, to get the same path checks as cp and mv
Probably telemetry-and-config-additions extraKnownMarketplaces take-overs from an undeclared source: saved data is set aside for cleanupPeriodDays, and options and secrets until claude plugin restore-set-aside
Probably new-claude-plugin-restore-set-aside-command-with-disca A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
2 added and 2 removed, of 218 lines, about 38 words, in the prompt 14 of 27 arms receive. 4 other prompts also changed. The appended system-reminder blocks moved: 2 lines added, 2 lines removed.
Claude Code, interactive mode
5 prompt changes in this release could not be quoted from the build, so no entry on this page describes them.
834 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 57 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?