Claude Code 2.1.257 Adds a Containment Escape Rule to Auto Mode
Claude Code 2.1.257 makes Claude Fable 5.1 the default Fable model and adds a Containment Escape rule so auto mode no longer auto-approves cloud metadata-credential fetches, egress evasion, or cross-tenant reach.
What it is
The 2.1.257 release of Claude Code, Anthropic's terminal-based coding agent, shipped the same day as the Claude Fable 5.1 launch.
What it does
It sets Claude Fable 5.1 (`claude-fable-5-1`) as the default Fable model at 1M context and $10/$50 per Mtok, adds configurable time-format and time-zone settings for timestamps, adds `CLAUDE_CODE_SUBAGENT_MODEL_FORCE` to force a subagent model choice, and adds a Containment Escape rule so auto mode no longer silently auto-approves actions like fetching cloud metadata credentials, evading egress controls, or reaching across tenant boundaries unless the environment explicitly marks them expected.
Why it matters
Auto mode became the default for new sessions in August, and this rule quietly admits it was auto-approving exactly the kind of sandbox-escape behavior that Johann Rehberger already found a bypass for. Worth checking whether your environment's auto mode config now flags containment-escape actions as unexpected by default.
How to use it
Update Claude Code to 2.1.257 or later; the Containment Escape rule applies automatically to auto mode unless your environment configuration marks those actions as expected.
Claude Code Patches a Bash Permission Bypass in 2.1.223
Claude Code 2.1.223 fixes a Bash permission bypass where a crafted command could hide part of itself from the permission check, and adds owner wildcard entries for marketplace allow and block lists.
Claude Code v2.1.211: forwarded subagent text and hardened permission-preview rendering
Claude Code v2.1.211 adds a flag to forward subagent text and thinking into stream-json output and strips hidden characters attackers could use to spoof permission-approval prompts.
gateway.yaml Pricing Now Flows Straight Into Claude Code's /cost
Claude Code 2.1.268 lets administrators set custom rates in gateway.yaml so /cost and telemetry match the organization's actual spend meter, plus a startup warning when a gateway's allowed CIDR list is empty.