Claude Code 2.1.257 blocks credential theft in auto mode by default
The new Containment Escape rule stops hijacked agents from stealing cloud keys or exfiltrating data; out-of-dir reads now prompt, and Fable 5.1 is default.
Copy markdown
Auto mode won't auto-approve credential grabs
A new Containment Escape rule means auto mode no longer silently approves cloud metadata-credential fetches, egress-evasion tricks, or cross-tenant reach — unless your environment explicitly marks them expected. If you run Claude Code unattended, a prompt-injected “summarize this page” can’t quietly walk off with your cloud keys anymore.
Reads outside your working dir now stop and ask
Auto mode adds a one-time prompt before the first file read outside your working directories, plus a permissions.blockReadsOutsideWorkingDirectories setting to block them entirely. It caps how far a hijacked or over-eager agent can wander into the rest of your disk.
Fable 5.1 is now the default Fable model
The update makes claude-fable-5-1 the default Fable model: 1M-token context at $10/$50 per Mtok, with cache reads at $0.25/Mtok. If you invoke --model fable in scripts, you’re on the new one automatically.
Handy new knobs: session effort, forced subagent model, clock format
/effort s now changes effort for just the current session; CLAUDE_CODE_SUBAGENT_MODEL_FORCE pins every subagent to your chosen model, ignoring per-agent overrides; and new timeFormat / timeZone settings finally let you set 12/24-hour or UTC timestamps.