You can now use the Fable 5.2 and Mythos 5.2 models in Claude Code with the short names fable-5-2 and mythos-5-2. Fable 5.2 is now listed as the latest model, and fable52 works as an alias too. Plugins can use a new tool.check hook to make tool permissions stricter, but never looser for built-in tools. Plugins can also answer or rewrite outgoing web requests, and they are never lent your sign-in. Setting CLAUDE_CODE_ULTRAREVIEW_PR_AS_MERGED asks /ultrareview to review a pull request as it was merged. This release has 418 entries, and 270 of them are usable today.
Some features are in the build but are not switched on yet. A remote switch can make /privacy-settings open your privacy settings on claude.ai in your browser. Video attachments can carry a preview image, but only in hosted remote environments with a switch on. A skill's compatibility note can tell Claude when the skill needs your own computer or network, behind a switch that is off by default. Code editors may show a recommended extension, also behind a remote switch.
Stalled secure connections now stop with a clear error instead of hanging. The usual limit is 120 seconds, and the error says to check your network or proxy. The bridge command now loads the settings file you pass with --settings. Plugin sync now keeps plugins you already installed when your account's plugin list fails to load. A skills folder created after startup is now picked up and watched. The email address privacy prompt for shell and web actions no longer appears in the list of features.
Written by our agent from the shipped bundle, not by Anthropic.
Claude Code recognises the Fable 5.2 and Mythos 5.2 models, needs an explicit opt-in for fast mode on them, and keeps your model when fast mode supports it
Sessions & agentsclaude remote-control --settings <file> passes a settings file to spawned sessions, which refuse to start if that file or their start folder changed
A fable52 model alias is added, and the model picker gains a collapsible 'More models' row with Fable 5.2 highlighted
Claude Code can now check and merge a list of blocked MCP tools, called mcpDeniedTools, into its settings
ExtensionsPlugins can now hook outgoing web requests to answer or rewrite them, but are never lent your sign-in
ExtensionsWant the reasoning? Read walks the 54 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →3 more of these are in What probably matters to you, on page 1.
The status screen still shows two stacked API providers as "A + B"; only how that line is built changed
Claude Code's secret-hiding rules can now skip text that lacks the piece each rule needs, so redaction does less work
Claude Code now skips its full secret-hiding check on text with nothing secret-looking, and reuses one buffer when reading files
When a queued prompt held for the next turn is brought back, Claude Code clears the markers that held it
In remote sessions, Claude Code can record the addresses of connector-provided servers and build a size-limited list of them, behind a switch
Unclear It is not known where the list of connector names and addresses is sent.
Behind a switch, a turn carried on by a new worker gets its original prompt id back, or carries on without one if that fails
Claude Code now sends its record of which tools a session used to the remote session service, once per session file
A late answer to a permission prompt after a restart can wait for SDK tool servers to load first, behind a switch that is off by default
A disconnected remote worker now ends a startup only when a new worker was being created
On remote hosts, a tool-call approval now keeps who decided it, and a reused earlier answer keeps its original decider
Failed transcript saves that look like a full disk are now counted for each file and reset after a save works
Branching a session and filtering its history now open the saved conversation file in a different way
mcp serve covers end-of-session hooks and a log of recent runs#Code that runs end-of-session hooks and keeps a list of recent runs for mcp serve has changed, but nothing visibly uses it yet
Unclear It is not shown whether anything in Claude Code calls these functions, so it is unclear whether they have any effect yet.
Listing, browsing and reading MCP resources can now trigger a follow-up action once the result is saved, when there is anything to return
When an MCP server has no oauth.clientId set, Claude Code now saves the sign-in server's issuer along with the client
Closing or clearing an MCP connection now always checks for a connection still in progress, where before it only did under one internal condition
MCP connection cleanup and reuse now always run, and a server that closes during discovery is marked failed with a clear reason
Claude Code gathers the addresses of official MCP servers into one shared list as it loads them
Claude Code now keeps reused network connections separate for each client and can close idle ones after a set time
Claude Code now tells its main reply stream from other streams, can stop holding back parts of a stream, and follows redirects on retries
One of Claude Code's request builders now forwards a compression option and no longer forces the request body into text
Unclear It is not clear which requests use this builder, so it is unknown what a user would notice.
Requests with a byte body or a compress option now fail unless they go through one internal request path
The IPv6 address check now says why an address is special (unspecified, unique local or link local) and matches prefixes more strictly
Unclear It is not clear which features use this check, so the effect on what Claude Code allows or blocks is unknown.
A list of shell-like tools in Claude Code no longer includes Tmux, leaving Bash, Monitor and PowerShell
Unclear It is not clear what this list controls, so it is unknown what treating Tmux differently changes for a user.
The step that withholds tools not named in --tools can now apply an extra check that excludes individual tools
Unclear Which tools the extra per-tool check excludes is not stated.
Claude Code stops adding server-supplied text to the AskUserQuestion tool's instructions, so they are now fixed in the build
Claude Code's check on reminders about later-loading tools now also compares how many tools are still defined
When tools added partway through a conversation are rejected, Claude Code can now record a retry report; the fallback you see is unchanged
One file-reading step now refuses text over a size limit and reports whether the file is inside the working folder
Unclear It is not clear which feature reads files this way, so a reader cannot tell when the size limit applies to them.
Claude Code now works out its loaded tools only when needed and skips a check when nothing has changed
Claude Code adds two remotely controlled switches, one on and one off by default, plus a new remote setting, with no known purpose yet
Unclear It is not known what either switch or the new setting controls.
A stored value that used to hold the privacy settings link text now holds the name of a remote switch, tengu_snoopy_thimble
Unclear It is not clear whether this is a real new switch, or whether the privacy settings message is still shown.
The behaviour behind one remote setting now applies in more environments, because one of its two conditions now has an alternative
Unclear Which environments and sign-in methods the widened condition now covers, and what the behaviour itself is, are not known.
One feature check moved from one remote switch to a new one; both are off unless turned on remotely
The value Claude Code uses for one remote setting when the server sends nothing changed from "history.jsonl" to 8
Unclear What this remote setting controls is not known.
A check that read one remote switch directly now goes through new helper functions that also look at other switches and local settings
Unclear It is not known what the feature does or whether the new check changes when it is on.
When Remote Control is turned on, an account signed in with a bearer token can now be recorded as the owner of the session transcript
Unclear It is not clear when Claude Code uses a bearer-token account instead of your login.
With Remote Control, Claude Code re-registers the machine whenever its directory-browsing offer changes, and handles host requests
The server-sent settings for how the bridge checks for work now accept a forced-stops-per-hour number from 0 to 60
Unclear What a forced stop does to a running session is not stated.
Claude Code's feature-settings client can refresh faster at startup until the first fresh values arrive, and Remote Control's tool host uses this
When Remote Control registers this machine, its setup can now include the device's unique ID
A request to change the working directory now carries whether it came from a remote control client
Unclear It is not known what Claude Code does differently with requests from a remote control client.
When a background task is stopped, its notice can now carry a message and go to a chosen agent, which is told right away
Unclear It is not clear what, if anything, you see differently when a background task is stopped.
Behind a switch, an agent you move to the background can now be marked and counted as a background agent
When a certain condition is met, Claude Code adds one more bullet point to the notes in a subagent's instructions
Unclear What the extra bullet says and what condition causes it to be added are not known.
Agent summaries now carry forward markers from earlier messages in the transcript as well as from the task itself
When you stop an agent, its record still notes you stopped it but no longer sets the separate field saying it was killed by the user
The report of plugin hooks that were passed over can now include http.fetch{origin=engine} when a check on the plugin passes
Unclear What check adds this entry, and what being passed over means for the hook, is not shown.
Plugin entries now keep the version their author gave and where the plugin came from
Reloading hooks modules now cancels notifications from plugins being removed, and the plugin test harness records skipped items
When syncing and checking plugins, Claude Code now filters the plugin list before locating each plugin's folder, and builds that list from a manifest
Unclear Which plugins the new filter removes is not stated.
The shortcut used when only security hooks remain is now also tied to a remote switch; CLAUDE_CODE_DISABLE_LONE_SEC_DEFAULT_SHORTCUT still turns it off
Unclear What the shortcut does when the server sends no value for its switch is not known.
When you set up a hook, Claude Code now records that in its saved state, not only in memory
When a hook that declares it breaks the prompt cache is registered, the log line now says 'uses breakPromptCache'
When CLAUDE_CODE_REMOTE is set, permission prompts left over from an earlier request no longer trigger prompt-submission hooks
Claude Code now recognises a cloud session from two environment variables, and a Bash permission prompt now carries a note when its safety check was incomplete
Unclear It is not shown what Claude Code does differently once it detects a cloud session.
On hosts already winding down, Claude Code tracks the x-ccr-tool-container-stops-soon header to know which tool containers will stop soon
Failures in cloud sessions can now be reported with the cause login_ended, and cloud gateway messages build their link differently
Tool-use display information gains an optional artifact_publish marker for calls that publish an artifact through Anthropic's Artifacts server
Claude Code now tags a set of tools as ones that publish an artifact, and checks a different set when keeping their results for subagents
Before reusing a sign-in that is already in progress, Claude Code now also checks whether it is a hybrid-only sign-in
Unclear What a hybrid-only sign-in is, and whether a reader can use it yet, is not stated.
Claude Code's sign-in and account requests now all use one shared timeout handler, with the same time limits as before
The Wrap up tool now passes nothing to the auto mode check, so its question and action labels no longer affect permission decisions
Claude Code checks whether auto mode is your effective default, and the config panel marks the default permission mode with "(default)"
Once a background job's folder exists, or after a relaunch following a stall, Claude Code now expects the folder to exist instead of creating it again
Claude Code's stop handling can now be told directly to leave background tasks running
Command results gain a field about when a background command reports back, and saved permission rule matches are rechecked when stale
Unclear It is not known whether the field is ever filled in.
Claude Code's tracking of CPU used by the processes it starts now splits the count by program instead of keeping one total
The ultrareview test report now records one merge commit instead of base and head commits, and fetches code using the pull request link
Unclear It is not clear whether users can run this test path at all.
When Claude Code starts ultrareview as a separate process, it now passes --no-post along with its other options
Unclear It is not confirmed what --no-post makes ultrareview do, or when this launch path runs.
After a compaction, Claude Code reports no token count unless the compaction recorded the new size, and compaction requests pass a new option
Claude Code now lists claude-security alongside Salesforce, Sentry and Snowflake in one of its connector name lists
Unclear What this list controls, and so what including claude-security changes for a user, is not known.
For files with no stated size, a remote switch that is off by default now decides whether one download path runs
Unclear It is not clear what this download path does for a user.
Finding a cell by its id in a Jupyter notebook now goes through a shared lookup step instead of inline code
Unclear Whether notebook edits now behave differently, for example when no cell id is given, is not clear.
The preview of a notebook edit now finds the cell through a shared lookup, and says so when it cannot find it
When Claude Code checks a rule that asks before a tool runs, it now records any parts of the request it set aside
Unclear How this changes what you are asked, or when, is not settled.
When reading project documents, Claude Code now works out what changed since its last read, including documents not read or removed
Unclear It is not known which sessions this applies to.
Claude Code's doc-reading request can now ask to include content written by the assistant
With sandboxing on, Claude Code now runs its Bash permission checks inside an extra layer instead of directly
Unclear It is not clear what the extra layer does or whether it changes which commands are allowed.
When sandboxing is on, Claude Code skips its usual way of showing the file changes a shell command made
Pieces of streamed output now go straight into the waiting batch when a send timer is already running, and tool input is counted per tool call
While a reply streams in, pieces of text, tool input or thinking that aren't plain text are now dropped instead of used
--worktree startup errors now go through Claude Code's shared exit routine#When --worktree fails outside a git repository, or cannot find the repository root, Claude Code now exits through its shared exit routine
If creating a worktree fails and the session cannot go back to its directory, Claude Code now logs that, and handles such errors in one place
The default-on prompt that asked before shell or web actions using your account email address no longer appears in the list of features
Unclear It is not known whether this prompt was removed or only moved, so it is unclear whether Claude Code still asks before such actions.
Published verbatim by Anthropic for v2.1.321. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 118 bullets, 23 name something an entry on this page also names, 30 name something no entry here does, and 65 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
claude-fable-5-2), now the default Fable model — 1M context, $8/$40 per Mtok with $0.20/Mtok cache reads
Probably fast-mode-now-needs-an-explicit-opt-in-on-fable-52-mythos, fable-52-and-mythos-52-model-recognition-added --settings <file> to claude remote-control, which applies a settings file to every session it starts; if the file changes, no new session starts until you restart claude remote-control
Probably cloud-sessions-refuse-an-automode-block-instead-of-dropping, remote-control-refuses-settings-before-the-verb-with-a-hi, remote-control-settings-forwarded-to-child-sessions-dire, remote-control-child-sessions-refuse-a-settings-file-that-ch, bridge-fast-path-now-honours-settings, remote-control-cli-adds-settings-and-debug-file-rejects, remote-control-gets-a-settings-flag-for-spawned-sessions cp or mv into a directory writes
Nothing to match on claude mcp login printing a SEP-2352 issuer warning each time you sign in again to a server that Claude Code registered with
No entry names this #108158[BUG] MCP OAuth: SEP-2352 "no 'issuer' stamp" warning on every claude mcp login — provider doesn't round-trip issuer Open
NotebookEdit deleting or overwriting a notebook's first cell when the call named no cell, on network paths (UNC shares, WSL folders, /net mounts)
No entry names this old_string, or editing a notebook as text, on network paths (UNC shares, WSL folders, /net mounts)
No entry names this /config showing Manual as the default permission mode when new sessions start in auto mode; pressing Space on "Auto (default)" now saves Don't Ask, not Plan
No entry names this FileChanged hooks stopping for paths set through watchPaths after the first shell command, when the session's working directory had a lowercase drive letter
No entry names this --plugin-dir . and --plugin-dir ./builtin writing generated type files for Claude Code's built-in plugins into a builtin folder
No entry names this /compact showing twice in Remote Control on web and mobile
No entry names this #100427[BUG] Remote Control: one /compact shows twice in the phone app (typed prompt and command-name record both rendered) Open
/plugin marketplace updates downloading a plugin again for each worktree or folder of a repository
No entry names this git stash, including after entering a worktree
No entry names this claude -p sometimes telling Claude that background commands get 30 minutes when they are stopped after 10
Probably headless-p-error-exit-carries-a-reason #103473[BUG] Print mode: Bash schema tells the model background commands get 30 min, but they are killed at 10 min (and the stated default flips between launches, breaking the prompt cache) Open
pkill, pgrep and pidwait in cloud sessions matching the session's own parent processes
Nothing to match on ask reason instead of another hook's when both asked
Nothing to match on ask being lost when another hook's defer finished first and could not be honored
Nothing to match on /desktop on macOS saying Claude Desktop is not installed when it is in ~/Applications
No entry names this #107903/desktop does not detect Claude Desktop installed in ~/Applications (still reproduces on 2.1.319, same as #41899) Open
#98476[Bug] Desktop command fails when claude.app installed in ~/Applications instead of /Applications Open
vcs.*) missing from Claude Desktop sessions that start on a pre-started process
No entry names this #108072[BUG] Desktop app sessions never report vcs.repository.* OTel attributes (spare process starts outside the repo) Open
claude agents ignoring --permission-mode, --dangerously-skip-permissions, --model, --effort or --agent typed before agents when a flag such as --verbose was also on the line
Probably remote-control-refuses-settings-before-the-verb-with-a-hi, remote-control-gets-a-settings-flag-for-spawned-sessions claude -p, SDK and VS Code sessions hanging, when memory ran out while the transcript was being read
Probably headless-p-error-exit-carries-a-reason grep -r foo "$PWD/src" asking for permission when the same command with the path typed out runs without asking
No entry names this desktop setting holds a field newer than the gateway, such as a managed MCP server's oauth.omitResource; it now warns and serves it
No entry names this .zshrc sets KSH_OPTION_PRINT
No entry names this #96333[BUG] Bash tool produces no output when KSH_OPTION_PRINT is set in ~/.zshrc Open
UserPromptSubmit hook blocked a replayed permission answer; these hooks no longer run on that replay
No entry names this claude remote-control accepting a y typed without Enter at its first-run question when the terminal's input ended
Probably remote-control-refuses-settings-before-the-verb-with-a-hi, remote-control-settings-forwarded-to-child-sessions-dire, remote-control-cli-adds-settings-and-debug-file-rejects code: rules
Nothing to match on PreToolUse mcp_tool hooks on stdio and HTTP MCP servers being skipped when their answer was over 16 MiB; the tool call is now refused
Probably remote-mcp-hook-calls-get-clearer-errors-on-oversize-results claude -p on Linux exiting 0 in silence when a full NFS export or a used-up NFS quota lost transcript lines: it now prints an error and, in text and json output, exits 1
Probably headless-p-error-exit-carries-a-reason claude mcp list output, when a stored MCP sign-in record was null
No entry names this /model picker: "More models" is now an unnumbered row below every other, and older models open under it without renumbering the rest
Probably remote-control-slash-commands-unavailable-here-get-specific, model-switch-notice-while-the-cloud-session-is-not-ready, model-picker-gets-a-collapsible-more-models-row-and-fable /device page: they no longer name gateway settings, which the gateway's own log still names
No entry names this claude install and the install scripts: they finish 2 to 4 seconds sooner
No entry names this claude --bg --worktree session that couldn't set up its worktree: it now shows the error from its beginning, not an internal tag or its last 200 characters
Probably worktree-startup-errors-routed-through-a-common-exit-helper /login is offered only if it's one of yours, and Claude now says where a copy may be after an account move
Probably remote-control-other-org-message-reworded, artifact-error-for-other-org-now-suggests-login, artifact-watch-error-messages-reworded, artifact-lookup-messages-cover-organizations-the-user-has-le claude remote-control's messages for an unanswered first-run question: each now says what to do next
Probably remote-control-refuses-settings-before-the-verb-with-a-hi, remote-control-settings-forwarded-to-child-sessions-dire, remote-control-cli-adds-settings-and-debug-file-rejects allowedProviders setting description to name Ultra alongside Pro and Max, and the forceLoginMethod description to cover every paid Claude plan
Probably managed-settings-read-failures-now-re-read-and-report-reason, login-method-setting-description-reworded allowUnsandboxedCommands: false or allowManagedDomainsOnly, and not to load in dontAsk mode
Probably hooksmods-refused-in-dontask-permission-mode $.tool.call, $.mcp.call) to raise no permission prompt, even under your own ask rules or in dontAsk and -p runs; deny rules and organization policy still apply
Probably hooksmods-refused-in-dontask-permission-mode fable: on Pro and Max plans at once, on Team and Enterprise plans once your organization allows it; use /model claude-fable-5-1 to switch back
Probably remote-control-slash-commands-unavailable-here-get-specific, model-switch-notice-while-the-cloud-session-is-not-ready, model-picker-gets-a-collapsible-more-models-row-and-fable /fast, /config and /model to name your current model when it supports fast mode, and removed "(Opus only)" from the VS Code row
Probably remote-control-slash-commands-unavailable-here-get-specific, model-switch-notice-while-the-cloud-session-is-not-ready, model-picker-gets-a-collapsible-more-models-row-and-fable, fast-mode-prompt-text-changed-no-longer-says-it-never-downg, fast-mode-off-status-line-hints-fast .claude/skills folders inside ~/.claude/plugins no longer load when Claude works on files there
No entry names this num_hooks and num_success after Bash and PowerShell calls
No entry names this AskUserQuestion in claude -p and SDK sessions to deny a host's permission answer that sets the undocumented afkTimeoutMs input field
Probably headless-p-error-exit-carries-a-reason, askuserquestion-timeout-can-be-admitted-as-nobody-answered, server-supplied-askuserquestion-prompt-text-removed-tengu-c extraKnownMarketplaces: a declared name can't be added from another source, an entry from elsewhere is hidden, and plugins the declared marketplace lists are reinstalled from it
No entry names this policy_mode: layered in the Claude apps gateway: managed MCP servers now add up over every matching policy, match: {} included, so a gateway already on it serves more after the upgrade
No entry names this ANTHROPIC_*_BASE_URL variables in the gateway's environment. Set base_url on the upstream to use another endpoint
Probably gateway-warning-for-base-url-env-vars-changed-and-now-covers, bedrock-requests-always-get-an-explicit-regional-base-url .claude/skills when their files change; set CLAUDE_CODE_PLUGIN_DIR_WATCH=0 to turn this off
No entry names this cp and mv spelled by a path, such as /bin/cp, to get the same path checks as cp and mv
Probably telemetry-and-config-additions extraKnownMarketplaces take-overs from an undeclared source: saved data is set aside for cleanupPeriodDays, and options and secrets until claude plugin restore-set-aside
Probably new-claude-plugin-restore-set-aside-command-with-disca A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
2 added and 2 removed, of 218 lines, about 38 words, in the prompt 14 of 27 arms receive. 4 other prompts also changed. The appended system-reminder blocks moved: 2 lines added, 2 lines removed.
Claude Code, interactive mode
5 prompt changes in this release could not be quoted from the build, so no entry on this page describes them.
834 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 57 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?