🧭 Claude Code Auto Mode Becomes the Default on August 14

Anthropic has announced that Claude Code's auto mode will become the default for all Pro, Max, and Team accounts starting August 14. Launched in March as an opt-in feature, auto mode eliminates the per-step human approval prompts that have been Claude Code's safety net since launch, replacing them with a two-stage AI classifier that decides in real time which actions are safe to execute autonomously.

How the two-stage classifier works

Every action Claude Code considers taking passes through one of three tiers:

• Tier 1 — auto-pass: Read-only operations (file searches, code navigation, grep) proceed instantly with no classifier review. The risk surface is near-zero.
• Tier 2 — auto-pass: In-project edits are allowed automatically because they're already tracked by version control and trivially reversible.
• Tier 3 — classified: Higher-risk operations (shell commands, web fetches, filesystem writes outside the project, external integrations) go to the classifier. A fast single-token filter runs first; if that's insufficient, chain-of-thought reasoning kicks in for edge cases.

A key design decision: the classifier sees only user messages and tool calls — Claude's own reasoning traces and tool results are stripped from the input. This prevents the model from constructing self-justifying arguments that could "talk the classifier into" approving risky moves.

What the classifier blocks

Dangerous patterns that trigger a block regardless of context:

• Credential exploration (reading ~/.ssh, .env files, credential stores)
• Scope escalation from vague instructions ("clean up branches" → mass branch deletion)
• Agent-inferred parameters not present in the user's request
• Data exfiltration patterns (reading secrets then making outbound network calls)
• Attempts to bypass safety checks in Claude Code's own configuration

🧭 Claude Code v2.1.228: MCP Visibility, OpenTelemetry Isolation, and Crash-Loop Fix

The August 10 release of Claude Code — v2.1.228 — ships a cluster of developer-experience improvements and one notable security fix, landing the same week that auto mode becomes the default.

What's new

• MCP tool counts in the UI: Claude Code now shows how many tools each MCP server exposes and flags any server reporting zero tools — previously you had to infer connection health from indirect signals.
• OpenTelemetry subprocess isolation: A security fix prevents credential leakage from subprocesses into telemetry streams. If you were using OTel tracing, credentials embedded in subprocess environments could silently appear in spans; this release isolates subprocess environments before they're passed to the OTel collector.
• EnterWorktree branches from local HEAD: Previously EnterWorktree could branch from the remote default rather than your local HEAD, silently discarding unpushed commits. Now it always branches from local HEAD, preserving in-progress work.
• Session colors via /color: Running bare /color assigns a random colour to the current session — useful for visually distinguishing simultaneous Claude Code windows.
• Crash-loop fix for >10 MB stdin: Large paste operations or piped inputs over 10 MB were triggering a crash loop; fixed.
• Subagent progress summary caching: Progress summaries between sub-agent turns now hit the prompt cache, reducing token costs on long agentic runs.

# Update Claude Code to pick up v2.1.228
npm install -g @anthropic-ai/claude-code@latest

# Verify the installed version
claude --version