You can now use the Fable 5.2 and Mythos 5.2 models in Claude Code with the short names fable-5-2 and mythos-5-2. Fable 5.2 is now listed as the latest model, and fable52 works as an alias too. Plugins can use a new tool.check hook to make tool permissions stricter, but never looser for built-in tools. Plugins can also answer or rewrite outgoing web requests, and they are never lent your sign-in. Setting CLAUDE_CODE_ULTRAREVIEW_PR_AS_MERGED asks /ultrareview to review a pull request as it was merged. This release has 418 entries, and 270 of them are usable today.
Some features are in the build but are not switched on yet. A remote switch can make /privacy-settings open your privacy settings on claude.ai in your browser. Video attachments can carry a preview image, but only in hosted remote environments with a switch on. A skill's compatibility note can tell Claude when the skill needs your own computer or network, behind a switch that is off by default. Code editors may show a recommended extension, also behind a remote switch.
Stalled secure connections now stop with a clear error instead of hanging. The usual limit is 120 seconds, and the error says to check your network or proxy. The bridge command now loads the settings file you pass with --settings. Plugin sync now keeps plugins you already installed when your account's plugin list fails to load. A skills folder created after startup is now picked up and watched. The email address privacy prompt for shell and web actions no longer appears in the list of features.
Written by our agent from the shipped bundle, not by Anthropic.
Claude Code recognises the Fable 5.2 and Mythos 5.2 models, needs an explicit opt-in for fast mode on them, and keeps your model when fast mode supports it
Sessions & agentsclaude remote-control --settings <file> passes a settings file to spawned sessions, which refuse to start if that file or their start folder changed
A fable52 model alias is added, and the model picker gains a collapsible 'More models' row with Fable 5.2 highlighted
Claude Code can now check and merge a list of blocked MCP tools, called mcpDeniedTools, into its settings
ExtensionsPlugins can now hook outgoing web requests to answer or rewrite them, but are never lent your sign-in
ExtensionsWant the reasoning? Read walks the 54 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
Claude Code recognises the Fable 5.2 and Mythos 5.2 models, needs an explicit opt-in for fast mode on them, and keeps your model when fast mode supports it
Unclear Whether these models are available to use is not stated.
claude remote-control --settings <file> passes a settings file to spawned sessions, which refuse to start if that file or their start folder changed
Plugin ui.notify gains delay, time, until-back and key options, a new ui.cancelNotify removes notices, and headless sessions pass them to the host
Unclear Whether Claude Code acts on a ui.cancelNotify message in this release is not shown.
A stop, cancel or Esc can now end the current turn without stopping running background agents and workflows
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
18 more of these are in What probably matters to you, above.
Tool calls a plugin makes now skip auto mode's classifier when plugin policy allows them, and are refused when they would need a person's approval
Unclear Whether plugin tool calls now end up allowed or asked more often than before is not shown.
Plugin MCP servers matching a connector your organization blocked on claude.ai can now be blocked or just counted
Unclear It is not settled which mode applies when nothing sets require_connector_block_on_plugin_servers, so whether blocking is enforced by default is unclear.
Bedrock, Mantle, Foundry and Vertex now look up a credential first and use it as a bearer token or API key before the usual sign-in
Unclear Where the credential lookup gets its values from, and so how you would supply one, is not clear.
Claude can get a new privacy section and stricter wording about keeping your email private, and the built-in email check now blocks instead of asking
Unclear What decides which version of the email wording a given session gets is not known.
fable alias at startup#If your saved model is Fable 5.1, Claude Code switches it to the fable alias, with a delayed move for team and enterprise organisations
A built-in privacy hook, on by default, refuses shell commands that contain your account email and also set a User-Agent
Unclear What decides whether this module is available on a given setup is not stated.
In remote sessions, certain slash commands now reply "This command isn't available in a chat." instead of running
Unclear Which commands are affected and what makes a session count as a chat are not known.
Some plugins with no saved on or off choice can now count as enabled when a further condition is met
Unclear It is not clear which plugins this affects or what the two extra checks test.
When neither the environment variable nor the model's own setting gives a seconds value, the silent-turn reminder now takes a default from a remote check
Unclear The default number of seconds the remote check supplies is not known, so it is unclear whether the reminder now fires for people who set nothing.
A request from a Remote Control client to change a session's working directory can be refused with the reason remote_origin
MCP tools now record where their server came from, and alwaysLoad only counts for directory or custom servers when further checks pass
Unclear It is not stated where Claude Code applies this rule, so its effect on servers that set alwaysLoad today is unclear.
Claude Code's built-in email check now refuses a tool call carrying your email address rather than asking, and also spots the encoded form %40
When a session runs in dontAsk permission mode, Claude Code refuses to load plugin mods and hooks
A plugin's MCP server sign-in is stopped when Claude Code cannot check it against your organization's connector settings
Claude Code now skips synced plugin MCP servers that offer no way to register for sign-in, without needing a remote switch first
When a proposed skill shares a name with a skill Anthropic provides, the review card refuses it and asks for a name of its own
When the signed-in account changes, Claude Code disconnects a Remote Control link attached through the SDK, and reconnects are marked as recovered
The notice about automatic replies to Artifact comments now says they stop when the session moves to the background
Unclear Only the notice text is known to have changed, not whether replies actually stop when the session is backgrounded.
CLAUDE.local.md is now a protected path like CLAUDE.md: it cannot be deleted by a plan, and changes to it still ask every time
When CLAUDE_CODE_CUSTOM_OAUTH_URL is set, Claude Code turns off all default sign-in permission requests and records that variable as the reason
When a hook's answer arrives over the network, Claude Code drops any change it makes to displayed text or to a tool's output
Unclear Which sessions treat hook answers as arriving over the network is not clear.
Over Remote Control, answers to hook callbacks are now refused, as answers to user dialogs already were
Read can now refuse to return an image it has already returned unchanged several times, telling Claude to use what it saw
Unclear Which state of the remote setting allows the refusal, and how many repeats it takes, is not clear.
Deny or ask rules beginning with ! in CLAUDE_CODE_MCP_SERVE_SETTINGS are dropped with a warning, since they would loosen earlier rules
Unclear It is not clear whether launch-time rules from sources other than CLAUDE_CODE_MCP_SERVE_SETTINGS are covered too.
Claude Code now stops a side request before sending it if the model it would use is not allowed
A cloud session given an autoMode block through --settings or a repository's .claude/settings.json now stops with an error
Claude Code now checks MCP servers against the organization's Claude in Chrome policy before and after connecting, and skips refused ones
Unclear Whether this check applies to every MCP server or only to the Claude in Chrome one is not clear.
When Artifacts are turned off in settings or by a deny rule, MCP servers that connect to the Artifacts server are not connected
PostToolUse hooks can no longer change certain results, such as answers to Claude's questions or plans, and you now see a message when one tries
Unclear Exactly which tools are covered, and which part depends on the remote switch, is not stated.
Write now refuses to overwrite a file when only its start was shown in the session, so the rest is not lost
Claude Code refuses or asks about many more git options, flags and variables that could write into the shared checkout or run outside programs
Claude Code now stops an MCP sign-in request that is redirected to another site, or redirected too many times, and tells you why
Unclear The condition that decides when this redirect check runs is not known, so it is unclear whether it is active for everyone by default.
If Claude in Chrome cannot work out a tab's address, it now asks you or refuses with a clear message, depending on why
Every web request Claude Code makes now has a default time limit, so a request that hangs is cancelled instead of waiting forever
Claude Code now refuses attachment names and paths with disallowed characters and tells you to rename or copy the file
Unclear Which characters count as disallowed is not shown.
Hook input is now completed the same way the tool sees it, and the hook run stops early if that step fails unexpectedly
Claude Code now decides whether an exact-match Bash allow rule applies using new logic, not a plain text comparison
Unclear Whether this changes which Bash commands prompt for permission is not known.
MCP servers added on the fly through the SDK are checked before and after connecting; a refused one is closed and adds no tools
Unclear What the check compares a server against, such as an organization policy or an allowlist, is not known.
File uploads to an MCP server now need the 2026-07-28 protocol version and an upload entry, or Claude Code declines to upload
The Read tool now tracks image reads and refuses to read an unchanged image again once it passes a limit
Claude Code now rechecks SDK MCP servers against policy before reuse, refreshes tools only for allowed servers, and sorts private addresses by type
Unclear Which servers the new checks would turn away, and what you would see when that happens, is not stated.
A bad --jq filter on a gh command now stops it before the request is sent, and Claude Code warns if a rerun would repeat a change
An MCP tool is left out if combining its schema options would take too much memory because of numeric property names
Over remote connections, Claude Code now sends permission requests one by one, holding later ones until the earlier one is answered
Unclear It is not settled whether this queueing always applies or only under some condition.
Remote Control refuses folder-change requests from remote clients, number keys skip marked options, and settings can show auto as the default mode
Claude Code now checks HTTP hook addresses against blocked ranges and records hits, but refuses the hook only when a server switch is on
Claude Code now examines the parts of simple shell commands before approving them, and asks you when it cannot check one fully
(*) or () are matched differently#Rules written as a tool name followed by (*) or () are read as covering the whole tool, without the earlier allow-only check
Unclear It is unclear whether deny and ask rules written with (*) or () are now also treated as covering the whole tool.
In auto mode, a subagent is not started if the safety classifier cannot check its prompt, and Claude Code says why
A marketplace named in managed settings now removes a same-named install from another source, and admins can word the policy error
Unclear Where administrators set the custom lines for the unreadable-policy error is not stated.
Remote Control's settings check now counts every non-warning settings issue, including those that were only shown as status notes
Unclear It is not stated what Remote Control does when this check finds a problem, such as refusing to start.
The default-on prompt that asked before shell or web actions using your account email address no longer appears in the list of features
Unclear It is not known whether this prompt was removed or only moved, so it is unclear whether Claude Code still asks before such actions.
Published verbatim by Anthropic for v2.1.321. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 118 bullets, 23 name something an entry on this page also names, 30 name something no entry here does, and 65 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
claude-fable-5-2), now the default Fable model — 1M context, $8/$40 per Mtok with $0.20/Mtok cache reads
Probably fast-mode-now-needs-an-explicit-opt-in-on-fable-52-mythos, fable-52-and-mythos-52-model-recognition-added --settings <file> to claude remote-control, which applies a settings file to every session it starts; if the file changes, no new session starts until you restart claude remote-control
Probably cloud-sessions-refuse-an-automode-block-instead-of-dropping, remote-control-refuses-settings-before-the-verb-with-a-hi, remote-control-settings-forwarded-to-child-sessions-dire, remote-control-child-sessions-refuse-a-settings-file-that-ch, bridge-fast-path-now-honours-settings, remote-control-cli-adds-settings-and-debug-file-rejects, remote-control-gets-a-settings-flag-for-spawned-sessions cp or mv into a directory writes
Nothing to match on claude mcp login printing a SEP-2352 issuer warning each time you sign in again to a server that Claude Code registered with
No entry names this #108158[BUG] MCP OAuth: SEP-2352 "no 'issuer' stamp" warning on every claude mcp login — provider doesn't round-trip issuer Open
NotebookEdit deleting or overwriting a notebook's first cell when the call named no cell, on network paths (UNC shares, WSL folders, /net mounts)
No entry names this old_string, or editing a notebook as text, on network paths (UNC shares, WSL folders, /net mounts)
No entry names this /config showing Manual as the default permission mode when new sessions start in auto mode; pressing Space on "Auto (default)" now saves Don't Ask, not Plan
No entry names this FileChanged hooks stopping for paths set through watchPaths after the first shell command, when the session's working directory had a lowercase drive letter
No entry names this --plugin-dir . and --plugin-dir ./builtin writing generated type files for Claude Code's built-in plugins into a builtin folder
No entry names this /compact showing twice in Remote Control on web and mobile
No entry names this #100427[BUG] Remote Control: one /compact shows twice in the phone app (typed prompt and command-name record both rendered) Open
/plugin marketplace updates downloading a plugin again for each worktree or folder of a repository
No entry names this git stash, including after entering a worktree
No entry names this claude -p sometimes telling Claude that background commands get 30 minutes when they are stopped after 10
Probably headless-p-error-exit-carries-a-reason #103473[BUG] Print mode: Bash schema tells the model background commands get 30 min, but they are killed at 10 min (and the stated default flips between launches, breaking the prompt cache) Open
pkill, pgrep and pidwait in cloud sessions matching the session's own parent processes
Nothing to match on ask reason instead of another hook's when both asked
Nothing to match on ask being lost when another hook's defer finished first and could not be honored
Nothing to match on /desktop on macOS saying Claude Desktop is not installed when it is in ~/Applications
No entry names this #107903/desktop does not detect Claude Desktop installed in ~/Applications (still reproduces on 2.1.319, same as #41899) Open
#98476[Bug] Desktop command fails when claude.app installed in ~/Applications instead of /Applications Open
vcs.*) missing from Claude Desktop sessions that start on a pre-started process
No entry names this #108072[BUG] Desktop app sessions never report vcs.repository.* OTel attributes (spare process starts outside the repo) Open
claude agents ignoring --permission-mode, --dangerously-skip-permissions, --model, --effort or --agent typed before agents when a flag such as --verbose was also on the line
Probably remote-control-refuses-settings-before-the-verb-with-a-hi, remote-control-gets-a-settings-flag-for-spawned-sessions claude -p, SDK and VS Code sessions hanging, when memory ran out while the transcript was being read
Probably headless-p-error-exit-carries-a-reason grep -r foo "$PWD/src" asking for permission when the same command with the path typed out runs without asking
No entry names this desktop setting holds a field newer than the gateway, such as a managed MCP server's oauth.omitResource; it now warns and serves it
No entry names this .zshrc sets KSH_OPTION_PRINT
No entry names this #96333[BUG] Bash tool produces no output when KSH_OPTION_PRINT is set in ~/.zshrc Open
UserPromptSubmit hook blocked a replayed permission answer; these hooks no longer run on that replay
No entry names this claude remote-control accepting a y typed without Enter at its first-run question when the terminal's input ended
Probably remote-control-refuses-settings-before-the-verb-with-a-hi, remote-control-settings-forwarded-to-child-sessions-dire, remote-control-cli-adds-settings-and-debug-file-rejects code: rules
Nothing to match on PreToolUse mcp_tool hooks on stdio and HTTP MCP servers being skipped when their answer was over 16 MiB; the tool call is now refused
Probably remote-mcp-hook-calls-get-clearer-errors-on-oversize-results claude -p on Linux exiting 0 in silence when a full NFS export or a used-up NFS quota lost transcript lines: it now prints an error and, in text and json output, exits 1
Probably headless-p-error-exit-carries-a-reason claude mcp list output, when a stored MCP sign-in record was null
No entry names this /model picker: "More models" is now an unnumbered row below every other, and older models open under it without renumbering the rest
Probably remote-control-slash-commands-unavailable-here-get-specific, model-switch-notice-while-the-cloud-session-is-not-ready, model-picker-gets-a-collapsible-more-models-row-and-fable /device page: they no longer name gateway settings, which the gateway's own log still names
No entry names this claude install and the install scripts: they finish 2 to 4 seconds sooner
No entry names this claude --bg --worktree session that couldn't set up its worktree: it now shows the error from its beginning, not an internal tag or its last 200 characters
Probably worktree-startup-errors-routed-through-a-common-exit-helper /login is offered only if it's one of yours, and Claude now says where a copy may be after an account move
Probably remote-control-other-org-message-reworded, artifact-error-for-other-org-now-suggests-login, artifact-watch-error-messages-reworded, artifact-lookup-messages-cover-organizations-the-user-has-le claude remote-control's messages for an unanswered first-run question: each now says what to do next
Probably remote-control-refuses-settings-before-the-verb-with-a-hi, remote-control-settings-forwarded-to-child-sessions-dire, remote-control-cli-adds-settings-and-debug-file-rejects allowedProviders setting description to name Ultra alongside Pro and Max, and the forceLoginMethod description to cover every paid Claude plan
Probably managed-settings-read-failures-now-re-read-and-report-reason, login-method-setting-description-reworded allowUnsandboxedCommands: false or allowManagedDomainsOnly, and not to load in dontAsk mode
Probably hooksmods-refused-in-dontask-permission-mode $.tool.call, $.mcp.call) to raise no permission prompt, even under your own ask rules or in dontAsk and -p runs; deny rules and organization policy still apply
Probably hooksmods-refused-in-dontask-permission-mode fable: on Pro and Max plans at once, on Team and Enterprise plans once your organization allows it; use /model claude-fable-5-1 to switch back
Probably remote-control-slash-commands-unavailable-here-get-specific, model-switch-notice-while-the-cloud-session-is-not-ready, model-picker-gets-a-collapsible-more-models-row-and-fable /fast, /config and /model to name your current model when it supports fast mode, and removed "(Opus only)" from the VS Code row
Probably remote-control-slash-commands-unavailable-here-get-specific, model-switch-notice-while-the-cloud-session-is-not-ready, model-picker-gets-a-collapsible-more-models-row-and-fable, fast-mode-prompt-text-changed-no-longer-says-it-never-downg, fast-mode-off-status-line-hints-fast .claude/skills folders inside ~/.claude/plugins no longer load when Claude works on files there
No entry names this num_hooks and num_success after Bash and PowerShell calls
No entry names this AskUserQuestion in claude -p and SDK sessions to deny a host's permission answer that sets the undocumented afkTimeoutMs input field
Probably headless-p-error-exit-carries-a-reason, askuserquestion-timeout-can-be-admitted-as-nobody-answered, server-supplied-askuserquestion-prompt-text-removed-tengu-c extraKnownMarketplaces: a declared name can't be added from another source, an entry from elsewhere is hidden, and plugins the declared marketplace lists are reinstalled from it
No entry names this policy_mode: layered in the Claude apps gateway: managed MCP servers now add up over every matching policy, match: {} included, so a gateway already on it serves more after the upgrade
No entry names this ANTHROPIC_*_BASE_URL variables in the gateway's environment. Set base_url on the upstream to use another endpoint
Probably gateway-warning-for-base-url-env-vars-changed-and-now-covers, bedrock-requests-always-get-an-explicit-regional-base-url .claude/skills when their files change; set CLAUDE_CODE_PLUGIN_DIR_WATCH=0 to turn this off
No entry names this cp and mv spelled by a path, such as /bin/cp, to get the same path checks as cp and mv
Probably telemetry-and-config-additions extraKnownMarketplaces take-overs from an undeclared source: saved data is set aside for cleanupPeriodDays, and options and secrets until claude plugin restore-set-aside
Probably new-claude-plugin-restore-set-aside-command-with-disca A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
2 added and 2 removed, of 218 lines, about 38 words, in the prompt 14 of 27 arms receive. 4 other prompts also changed. The appended system-reminder blocks moved: 2 lines added, 2 lines removed.
Claude Code, interactive mode
5 prompt changes in this release could not be quoted from the build, so no entry on this page describes them.
834 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 57 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?