Anthropic Release Notes

• Added CLAUDE_CODE_AUTO_MODE_MODEL to choose the model the client-side auto mode classifier uses; it does not change the model for server-side auto mode
• Added an Idle compaction row to /config for turning idle compaction off or back on; the notices shown after an idle compaction now say how to turn it off
• Added a notice to /design-sync and /design-login that standalone Claude Design (claude.ai/design) closes by December 14, 2026
• Fixed a "Prompt is too long" error when stopping a turn while the conversation was being compacted
• Fixed requests failing with "diagnostics: Extra inputs are not permitted" after switching to Vertex or Bedrock mid-session
• Fixed the Read tool loading an image file of any size, or a pipe or device named like an image, entirely into memory; image sources over 128 MB are now refused
• Fixed /autocompact and /effort saving to the wrong model when a gateway names Opus 4 or 4.1 with a prefix, such as anthropic/claude-opus-4-1
• Fixed a prompt cache miss when a tool added mid-session was loaded again through ToolSearch or after compaction
• Fixed claude plugin and other subcommands sometimes exiting before a queued settings or config write finished, which could lose the change or leave a .tmp file behind
• Fixed plugin marketplaces re-cloning on every refresh, and newly installed git plugins showing version "unknown", when git defaults to the reftable ref format
• Fixed the PowerShell tool not finding commands in a plugin's bin/ folder, and reporting an error when a search that finds nothing (rg, grep, findstr, git grep) is piped into Select-Object or another formatting cmdlet
• Fixed Claude in the desktop app pointing you to claude.ai settings or /mcp to authorize or reconnect an MCP server where that option isn't available
• Fixed artifact publishes sometimes failing when Claude sent an empty list of edits, and Claude retrying an artifact update the wrong way after a newer version of the artifact turned it away
• Fixed classifier_category missing from OpenTelemetry tool_decision events for most auto mode classifier blocks, and new tool_decision attributes pushing out tool_use_id, tool_source and tool_parameters when OTEL_LOGRECORD_ATTRIBUTE_COUNT_LIMIT is low
• Fixed rows in the agents view staying blank after moving down a long list or folding a section
• Fixed claude remote-control --help not printing its usage and exiting when not signed in
• Fixed /design consent and /design revoke suggesting /design-login when they fail in a cloud session, where it isn't available; the message now points to claude.ai/design/settings
• Fixed MCP servers showing no tools, or every tool call failing, when the server negotiates protocol version 2026-07-28 but omits resultType, ttlMs or cacheScope
• Fixed prompt suggestions spending usage credits on models your plan pays for only with credits: they are now skipped after a reply billed to credits
• Fixed URLs written in backticks being clickable only on their first row when they wrap; the whole URL is now one link in terminals that support hyperlinks
• Fixed claude plugin details <name>@builtin suggesting claude plugin list, which never shows built-in plugins, when the plugin isn't found; it now points to /plugin
• Fixed an emoji that a link starts inside wrapping one column too wide, which hid it in question previews and turned tables into lists
• Fixed worktree isolation refusing to create or resume worktrees under git 2.56 or later when a stray .git file points at a directory that doesn't exist
• Fixed a cloud session's cost and usage restarting from zero after the session resumed in a new process
• Self-hosted runner: Fixed git fetches failing with "bad object refs/heads" in sessions that reuse a checkout stored in git's reftable format
• Windows: Fixed every file write being refused or asked about for projects on exFAT or FAT32 drives, including in sessions started with --plugin-dir
• Improved startup time with many plugins enabled: plugin command and agent files now take far fewer file system calls to load, most of all on Windows
• Improved auto mode with the server-side classifier: a conversation too long for the safety check is now compacted, instead of every checked tool call being denied
• Improved the message when a background session reopened from another folder has no LLM gateway: it now says why, instead of "Not logged in"
• Changed claude -p and Agent SDK sessions with no permission mode to start in default mode on third-party providers, with telemetry off or on a fresh install; --permission-mode auto keeps auto
• Changed fork subagents (subagent_type: "fork") to be on by default in claude -p, the Agent SDK, the desktop app and VS Code, as they already are in the terminal; CLAUDE_CODE_FORK_SUBAGENT=0 turns them off, and claude mcp serve never offers them
• Changed the desktop app and VS Code to always run the main conversation's subagents in the background, as the terminal does, rather than let Claude choose; a subagent's own Agent calls in claude -p, the Agent SDK, the desktop app and VS Code now run in the foreground by default
• Changed the ← for agents footer hint to hide 10 seconds after a session opens; the count of agents waiting on you still shows
• Changed where the Claude in Chrome instructions sit in the system prompt so that new conversations can read them from the shared prompt cache
• Changed prompt and agent hooks so that at most 12 of one event run at a time; the rest wait their turn
• Changed the message shown when your organization's policy turns off /feedback: it now points to GitHub issues instead of an organization admin
• [VSCode] Fixed text after an unclosed code block in a list showing as plain text while a reply streams, then turning into code
• [VSCode] Fixed MCP server sign-in from the panel opening a broken authorization page when the server URL contains a query string
• [VSCode] Fixed the @browser banner saying "Browser connected" when no browser with the Claude extension can be reached
• [Cloud sessions] Added a banner on a routine's page that says why its last run didn't start, such as your organization reaching its limit on concurrent cloud sessions
• [Cloud sessions] Fixed "Rewind to here" failing on every message except the newest in cloud sessions; self-hosted runners need Claude Code v2.1.246 or later
• [Cloud sessions] Fixed the pull request status bar in cloud sessions flipping a pull request with merge conflicts back to ready while GitHub rechecked it
• [Cloud sessions] Fixed routine runs showing as Completed after their cloud session stopped unexpectedly, and as Cancelled when archived before they started, instead of failed
• [Cloud sessions] Fixed the diff view in cloud sessions missing changes or failing to load after the session's GitHub repository was renamed or moved
• [Cloud sessions] Fixed a scheduled routine run that failed partway being run again from the start an hour or more later, which could repeat work such as posting the same report twice
• [Cloud sessions] Fixed an open cloud session sometimes not showing messages sent from another device until you reloaded the page or clicked away and back
• [Cloud sessions] Improved the error shown when a cloud session fails to start: it now says "Connection lost" or "Server error" instead of "Something went wrong"
• [Remote Control] Fixed a subagent's pane spinning forever in a Remote Control session after your computer goes offline; it now says Remote Control is disconnected
• [Claude Tag] Fixed "is thinking…" staying up under a mention in a Slack channel or DM after Claude answered it by editing one of its earlier messages
• [Claude Tag] Fixed URLs in code blocks under a numbered or bulleted step of Claude's Slack replies being wrapped in angle brackets, which broke copied commands
• [Claude Tag] Fixed HEIC, SVG, TIFF and BMP images attached in Slack never reaching Claude; they now arrive as files in its working files, like other file types
• [Claude Tag] Fixed new channel managers losing access to Claude in Slack in organizations that restrict Claude Tag by role; the manager role now also grants Claude Tag in Slack
• [Claude Tag] Fixed custom connectors whose MCP servers share one host showing as a single connector in Claude Tag admin settings; each server is now its own connector
• [Claude Tag] Fixed Claude in Slack sometimes answering a direct message with "DMs are temporarily unavailable" and dropping it when a single Slack lookup stalled; it now retries first
• [Claude Tag] Fixed direct messages with Claude on a Slack Enterprise Grid ignoring Slack's workspace dropdown; they now run under the connected workspace you last opened Claude in
• [Claude Tag] Fixed Claude in Slack's notice for a channel's monthly spend limit saying a channel manager can raise it; it now names an organization owner and links the usage page
• [Claude Tag] Fixed links in Claude's Slack replies absorbing the closing bold or italic marks, or full-width punctuation, right after them, which broke the link and the formatting
• [Claude Tag] Improved repository search in Claude Tag admin settings to cover up to 100 connected GitHub accounts and find private repositories past the first 5,000 of a GitHub App install
• [Claude Tag] Improved Add place in Claude Tag admin settings to list a channel you type or paste right away, instead of only after your organization's full channel list has loaded
• [Claude Tag] Improved Add > Domain on a workspace's or channel's page in Claude Tag admin settings to be available once that page loads, not only after every channel has loaded
• [Claude Tag] Changed Claude Tag admin settings to organize Claude's access into four tabs: Bundles, Connectors, Skills and plugins, and Channels
• [Claude Tag] Changed the Roles page in organization settings to group the roles created for Claude Tag channel managers in a collapsed section below your organization's own roles
• [Code Review] Fixed Code Review setup not resuming after you leave to connect GitHub; back in admin settings, it now reopens at the repository picker

• Added CLAUDE_CODE_RETRY_WATCHDOG_MAX_USAGE_LIMIT_WAIT_MS so unattended retry mode (CLAUDE_CODE_RETRY_WATCHDOG) ends a request at a usage limit that resets too far away instead of waiting
• Added OpenTelemetry tracing guidance to the claude-api skill, including setting up trace destinations with the ant CLI
• Added the % motion to vim mode: jump to the matching bracket, alone or with d/c/y
• Added rows to a mod's Input: a text field of several lines in the terminal, where Enter submits and Shift+Enter or a backslash before Enter starts a new line
• Added classifier_verdict and permission_mode to OpenTelemetry tool_decision events, so auto mode classifier decisions can be told apart from permission rules
• Added classifier_category to OpenTelemetry tool_decision events, naming the built-in rule a classifier block matched, when OTEL_LOG_TOOL_DETAILS=1
• Fixed quitting removing a worktree made by a WorktreeCreate hook without asking when it may hold unpushed commits
• Fixed the fable (and best) model alias erroring on the Anthropic API when the newest Fable model is not available to your organization: Claude Code now retries once on the previous Fable model
• Fixed a misleading "Please run /login" error when a full disk keeps the login from being refreshed; the error now names the disk and says to delete files
• Fixed Grep and Glob reporting no matches when the search program failed unexpectedly before returning any results; they now return an error saying the search failed
• Fixed workflow agents sometimes skipping their step, and the run still reporting success, after reading the harness note that their task text carries no user authority
• Fixed artifact updates being refused where a PreToolUse hook covers Edit or Write; Claude now edits the file and then republishes instead of changing it in the publish call
• Fixed skills and commands with very many or very long argument names stalling for seconds when invoked; only the first 64 names, each up to 64 characters, are now filled in
• Fixed skills, commands and hooks using very large amounts of memory when their arguments fill many placeholders
• Fixed stray characters such as >0q covering the folder trust prompt, and >4m before the shell prompt at exit, in terminals built on VTE older than 0.53 such as MATE Terminal on RHEL 8
• Fixed stray GOK text appearing in the prompt at startup in some versions of iTerm2
• Fixed switching to a model whose name contains application-inference-profile running your awsAuthRefresh command and delaying model-switch hooks when the provider is not Bedrock
• Fixed sign-in refresh timeouts and unexpected sign-outs after a short command such as claude auth status or claude plugin list exited in the middle of a token refresh
• Fixed a tool call cut off by a message sent mid-turn during its permission check being reported to the model as rejected by the user
• Fixed a case where switching to a model with a smaller context window could spend usage credits on a summary by the previous model without asking first
• Fixed conversations being compacted over and over, on a model you didn't pick, behind an LLM gateway whose responses name a different model than the one requested
• Fixed vim mode sometimes staying in INSERT after Escape on a slow or busy machine
• Fixed Esc discarding a typed AskUserQuestion answer in vim mode: the free-text field now supports vim NORMAL mode, and Esc cancels only from NORMAL
• Fixed the Read tool reading binary files such as .xlsm, .parquet, .epub and .heic as text
• Fixed a Markdown table with only a header row drawing nothing when too wide for the terminal, including in plans on the plan approval card
• Fixed the /claude-api skill saying CMEK external-key endpoints aren't available on Claude Platform on AWS
• Fixed skills no longer being listed to the model after using /rewind
• Fixed the compaction row in a resumed session offering ctrl+o for history that is not loaded; it now says where the earlier messages are saved, and also shows in fullscreen
• Fixed the "new task? /clear to save tokens" hint coming back right after you interrupt a response
• Fixed the permission prompt for a plugin or skill hook's ask decision not showing which plugin or skill the hook comes from
• Fixed /diff not noticing a conflicted cherry-pick or revert in reftable repositories when one of its git checks timed out or failed
• Fixed workflow scripts asking for permission or being refused when read, edited or re-run after a Bash cd in the same session
• Fixed dim text on the dark ANSI theme and 16-color terminals: faint inside filled boxes, not faint under selection and search highlights, and list descriptions dimmed like other secondary text
• Fixed a mod's $.model.fork returning nothing-to-fork when called before the first response of a new Claude Code process had finished, as in claude -p runs and cloud sessions
• Fullscreen mode: Fixed /compact and auto-compact briefly freezing the UI while the visible transcript is rebuilt
• Self-hosted runner: Fixed sessions started from Slack being unable to find or attach a repository when managed settings restrict MCP servers; use deniedMcpServers to keep those tools off
• Self-hosted runner: Fixed sessions being reported as having a deleted source branch, and not retried, when an unrelated setup or session failure quoted git's missing-ref wording
• Self-hosted runner: Fixed the log promising a retry of a failed or declined session release for a session that is ending; repeated failures now show a count
• Windows: Fixed stopped background PowerShell commands missing the closing [killed] line in their output file
• Improved switching to a model with a smaller context window: a conversation too long for the new model is now summarized by the previous model first
• Improved rendering performance while a long-running subagent works: its progress trail now updates incrementally instead of being reprocessed in full on every render
• Improved artifacts: pages Claude writes now paint the band above a sticky header, so scrolled text no longer shows there in the mobile apps
• Improved mods: in VS Code and the desktop and mobile apps, a tree drawn above the question dialog can now hold Markdown and up to 48 rows; the terminal keeps 12 plain rows
• Changed a mod hook's .catch handler to run only when the hook throws or times out; events raised beneath the hook's own calls now skip that hook without asking its .catch
• Changed a mod's $.env.set to resolve with {} once the variable is set or unset, or with { deny } saying why when the write is not made
• [VSCode] Added LaTeX math rendering in Claude's responses, including $$ and multi-line \[ … \] blocks and inline $…$ and \(…\) math
• [VSCode] Added a "Get more usage" link to the usage-limit banner for Pro and Max plans in the VS Code and JetBrains panels
• [VSCode] Fixed a conversation that crashes or freezes the panel being reopened on every reload
• [VSCode] Fixed the chat panel slowing down during long thinking: it no longer re-parses the whole thinking text on every update
• [VSCode] Fixed diagnostics showing "[object Object]" instead of the rule code (e.g. MD013) for some language servers
• [VSCode] Fixed the native dictation audio module being loaded, to check microphone permission, where dictation is not offered (non-claude.ai sign-ins, remote windows)

Catch more bugs before they reach production.

Code Review is out of research preview and available to Claude Team and Enterprise organizations.

Eligible Claude Enterprise organizations can claim at least $10,000 in Code Review credits by January 15, 2027. Credits expire 30 days after you claim them. Terms apply.

What's new in Code Review

Coding agents keep increasing the pace at which teams write code, and the review bottleneck hasn't eased. For general availability, we made Code Review faster, better at finding the bugs that matter, and easier to tune to each of your repositories.

Since we released the research preview, Code Review has gotten sharper, catching more of the bugs that would otherwise reach production. We also run Code Review on pull requests at Anthropic, which shows us where reviews slow our own engineers down. Teams using Code Review during the preview told us the rest: it was catching real issues before a human reviewer looked at the PR, but they wanted reviews that were quieter, sized to each change, and faster. Here’s what we shipped:

• Speed: Most reviews now finish about 3x faster (~20 minutes down to 6-10 minutes) compared to during preview.
• Quality: Find more of the bugs that matter, with clear, concise findings that state the problem, what triggers it, and the fix in a few sentences.
• Flexibility: Admins choose Quick, Standard (default), or Deep for each repository, so routine codebases get a quick pass and the most critical ones get a deep review. Every level delivers high-quality reviews.

Get started

Code Review is now generally available for Team and Enterprise plans.

• For admins: Enable Code Review in your Claude Code settings, install the GitHub App, and select repositories you’d like to run reviews on.
• For developers: Once enabled, reviews run automatically on new PRs. No configuration needed.

Explore the docs for more information.

• The Compliance API now returns the text each organization member saved as Instructions for Claude in claude.ai and as Global instructions in Cowork, in beta for Claude Enterprise organizations. Call GET /v1/compliance/organizations/{org_uuid}/user_preferences with your existing Compliance Access Key and the read:compliance_user_data scope. See List user preferences.

• Fast mode is out of research preview for Claude Opus 5.5, and you no longer need to request access. Requests to Claude Opus 5.5 no longer require the fast-mode-2026-02-01 beta header, and requests that still send it keep working. Claude Opus 5.5 now has a default fast mode rate limit in the Start, Build, and Scale usage tiers. Fast mode for Claude Opus 5 and Claude Opus 4.8 remains in research preview. Keep sending the beta header with fast mode requests to those models.

• Fast mode for Claude Opus 5.5 is now available on Claude in Microsoft Foundry for deployments hosted on Azure.

• Added virtualText to a mod's prompt decorations: text drawn in the prompt box that never enters the draft or the submitted prompt
• Added cache_creation_5m_tokens and cache_creation_1h_tokens to the OpenTelemetry api_request event, splitting cache writes by lifetime
• Added $.ui.view({ agentId }) for mods: shows an agent's transcript in the main view when you ask, and $.ui.view({}) goes back
• Added a dir prop on a mod's Text for right-to-left text: on Windows and in VS Code's terminal its rows read in that direction and sit flush right
• Added /advisor on Claude Platform on AWS; no advisor runs until you pick one with /advisor, advisorModel or --advisor, and CLAUDE_CODE_DISABLE_ADVISOR_TOOL=1 turns it off
• Added OpenTelemetry GenAI semantic-convention attributes to trace spans, such as gen_ai.provider.name, gen_ai.conversation.id, gen_ai.tool.name and error.type
• Added support for rewriting a workflow agent's prompt and model in the agent.spawn mod hook, which could only refuse workflow agents before
• Added the prompt.change mod hook, raised when the prompt box's text changes without a typed edit: a recalled history entry, a clear, an undo, or a plugin's fill
• Fixed cloud sessions telling Claude that an organization policy blocked a host when the session's own network settings did
• Fixed /autocompact warning about high token usage when you choose a smaller auto-compact window
• Fixed SessionEnd hooks sometimes not running when you exit while a background command is still running
• Fixed claude --help naming a removed tool in its description of --restricted
• Fixed claude agents not refreshing any pull request's status when the data for one of them came back incomplete
• Fixed Claude being told a background agent was lost, not resumable, after a cloud session's container was replaced, when the agent had already been resumed once
• Fixed subagents you had typed messages to disappearing from /tasks shortly after finishing, leaving no way back to the conversation
• Fixed a completed parent agent dropping off the breadcrumb (its child shown re-rooted at top level) while you were viewing the child
• Fixed the agents view taking a typed word such as "up", "down" or "escape" for that key when input arrived in a burst, which could move the peek mid-reply or clear a draft
• Fixed automatic tool search (ENABLE_TOOL_SEARCH=auto) turning off part-way through a conversation, for example while MCP servers reconnect after a resume
• Fixed a login refused by forceLoginOrgUUID leaving the refused organization's token stored, or live after /login
• Fixed the diff view in Claude Desktop and Remote Control sessions not noticing a conflicted cherry-pick or revert in reftable repositories
• Fixed the Artifact tool's verbose and ctrl+o line reading Artifact("(unprintable path)") while a call's input arrives; its row now shows "Waiting…" and "Running…" as Bash's does
• Fixed the first transcript entry written after resuming a session being lost when a crash had cut the transcript's last line short
• Fixed /branch dropping messages, and claude purge skipping subfolder projects, when they contain a Unicode line or paragraph separator (U+2028, U+2029)
• Fixed plugin WorktreeCreate and WorktreeRemove hooks not running when Claude Code starts with --worktree (not yet with --tmux)
• Fixed OpenTelemetry tool_result events missing git_commit_id after git commit -q in repositories using reftable ref storage
• Fixed a prompt that a mod's prompt.submit hook rewrote or dropped still being recorded as typed in the OpenTelemetry user_prompt event and interaction span, and in session title requests
• Fixed a note meant for Claude about mod hot-reloading appearing in the transcript as if you had typed it
• Fixed agent hooks ignoring their model: aliases like haiku now resolve, a subagent's model no longer overrides it, and an unavailable model falls back to the caller's instead of allowing the action
• Fixed --worktree sessions sometimes starting from the wrong commit when a tag or branch was named like a commit ID, and their starting git status naming a branch other than the new worktree's
• Fixed the branch showing as ".invalid" and --worktree failing to reopen a worktree in repositories using git's reftable ref storage
• Fixed Claude naming files in the session scratchpad by a bare filename or relative path instead of their full path
• Fixed claude remote-control servers giving up on renewing their connection after a brief sign-in error, such as a locked keychain; they now retry, and warn when you need to run claude /login
• Fixed --worktree failing in a worktree of a bare repository when origin's default branch can't be fetched; the fallback base is now the current checkout's HEAD, not the main repository's
• Fixed starting Claude Code in a VS Code, Cursor or Devin Desktop integrated terminal launching the editor's command-line tool twice to check for the extension; it now launches it once
• Fixed a mod's prompt.edit hook not being raised for a newline entered with the chat:newline keybinding (Ctrl+J, or a rebound Enter)
• Fixed a conversation failing on every turn with a 400 error when the API rejected an MCP tool's input schema; Claude Code now sends that tool without parameters for the rest of the conversation
• Fixed resuming a headless or Agent SDK session losing the recent messages a compaction had kept, when the compaction followed a reply cut at the output token limit (compactions from this version on)
• Fixed Claude not being told about an MCP server's tools and instructions until its next tool call, when the server finished connecting after a compaction
• Fixed Remote Control sessions being marked stopped while still running, on a computer serving several sessions at once
• Fixed resuming a headless or Agent SDK session losing its compaction summary or bringing back pre-compaction history, when the compaction followed a retried or unfinished reply in the same turn
• Fixed Claude polling a background command's output file or sleeping while it runs
• Fixed feature flags and staged rollouts staying stale behind a TLS-inspecting proxy whose certificate is trusted only through the OS certificate store
• Fixed claude daemon stop --any printing "stopped" while a stuck background service kept running: it now waits, force-kills the service, and says so with exit 1 if it is still there
• Fixed claude daemon stop exiting with no output, and leaving sessions listed as running, when telemetry is turned off
• Fixed Write, Edit and NotebookEdit in Cowork cloud sessions reporting success for a path on your own computer, where the file never arrived
• Fixed Claude searching for deferred tools already loaded earlier in the conversation when a session resumes a history that never listed them
• Fixed secondary (dim) text looking the same as normal text under the dark ANSI theme and on 16-color terminals
• Fixed cloud sessions hanging 5 minutes per turn when the organization's policy can't be read; the turn now ends promptly and says why
• Fixed a cloud session sometimes running an already answered message a second time after the session restarted during a long reply
• Self-hosted runner: Fixed the runner and orchestrator freezing (no polls, /healthz or SIGTERM shutdown) while nobody reads their output; logs keep the latest 256 KiB and count drops (not on Windows)
• Improved WebFetch in Cowork cloud sessions to tell Claude that a page failed moments ago instead of fetching it again
• Improved mod sharing in the built-in plugin-authoring skill: Claude scans a mod's files for keys before opening them, and asks before scanning a folder outside the project
• Improved the note Claude 3 models get about an @-mentioned PDF, so they less often answer without reading it
• Improved artifact updates: Claude now applies a small change and republishes the artifact in one call, and makes larger edits and republishes within a single response
• Changed CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST sessions to ignore CA-bundle, tool-proxy, git TLS and git config variables like SSL_CERT_FILE in settings; under Claude Desktop, only in project settings
• Changed exit to force-kill background commands still running 1.5 seconds after being asked to stop; in fullscreen mode they could previously be left running
• Changed Claude Desktop's Code tab to apply managed settings when forceLoginGatewayUrl names an Anthropic-operated gateway that serves the session's hostname; that gateway must be reachable at start
• Changed claude gateway to stop at start, naming the key, on a desktop: policy key that Claude Desktop cannot use from a gateway, where it earlier started with a warning
• Changed large requests to api.anthropic.com to use gzip compression even when telemetry is disabled; set CLAUDE_CODE_GZIP_REQUEST_BODIES=0 to turn it off
• Changed the claude-api skill to leave Managed Agents sessions in place unless you ask to archive or delete them
• Changed background sessions to resume a carried workflow through the Workflow tool's approval instead of running it from the handoff file
• Changed local session transcripts to also record each API request's system prompt, tools and parameters, so a transcript you choose to share can reproduce a request exactly
• Changed the /sandbox mode options to read "Sandbox commands" instead of "Sandbox BashTool"
• Changed PermissionRequest hooks in Cowork cloud sessions: a setMode update in a hook's allow is now ignored; the rest of the approval still applies
• Changed hooks: updatedInput from PreToolUse and PermissionRequest hooks is now validated like Claude's own input: unknown keys are dropped, and input the tool rejects denies the call
• Removed the --sandbox and --no-sandbox flags from claude remote-control, which had no effect; passing either now exits with an error. Set sandbox.enabled in settings to sandbox sessions
• [VSCode] Added the claudeCode.attachSelection setting to stop text selected in the editor from being added to your messages
• [VSCode] Fixed fast mode staying on after usage credits ran out, which made each request be refused and re-sent; it now turns off until you turn it back on, with an error notice
• [VSCode] Fixed the Thinking toggle switching to Off on models that always think; the toggle is no longer shown for those models
• [VSCode] Fixed "Edit prompt" on a flagged message opening the file or command menu over the restored prompt; Enter now sends it as written
• [VSCode] Fixed Shift+dragging a file onto the prompt on Windows inserting an unreadable /c:/… path instead of a mention relative to the working directory
• [VSCode] Fixed changes to VS Code's chat font size settings needing a window reload or being undone by a theme change; diffs and the plan preview now follow them too
• [VSCode] Fixed "Resume session" and tabs restored after a reload opening an empty new conversation instead of one that had moved into a git worktree
• [VSCode] Fixed ↑ then Enter on a recalled slash command running it without its arguments; the command and file menus no longer open over a recalled prompt until you edit it
• [VSCode] Fixed Shift+dragging a file from the Explorer or an editor tab onto the prompt inserting nothing in WSL, SSH and Dev Container windows
• [VSCode] Fixed Ctrl+Alt+F toggling Focus view instead of opening Find in the Explorer, other tree views, or the Debug Console on Windows and Linux
• [VSCode] Fixed the check for sessions open in other windows or terminals creating extra processes on macOS: it now starts /bin/ps directly instead of searching PATH for ps on every check
• Windows: Fixed a conversation showing "still open somewhere else" after a crash or power loss, when Windows had since restarted and given the old process ID to another program
• [Cloud sessions] Fixed "Allow for this task" missing from Cowork's approval prompts for connector tools where an organization turns off "Always allow" (regression in 2.1.292)
• [Cloud sessions] Fixed most commands in the / menu losing their descriptions in cloud sessions once you sent a second message
• [Remote Control] Fixed the diff view in Remote Control sessions on claude.ai and the desktop app showing deleted and renamed files as modified; requires Claude Code v2.1.296 or later on your machine
• [Claude Tag] Added support for Slack Connect channels: an Owner or Claude Tag admin can let Claude in Slack answer in channels shared with another organization; it's off by default
• [Claude Tag] Added a private Allow once / Deny card in Slack threads for connector actions that need your approval, so Claude asks instead of refusing; others only see that it's waiting on you
• [Claude Tag] Added support for Slack voice clips in Claude in Slack: Claude reads Slack's transcript of a clip when Slack has one
• [Claude Tag] Fixed Claude in Slack not answering another app that tags it in a thread under a message Claude itself posted to the channel
• [Claude Tag] Changed access bundles an admin attached to a Slack channel to keep applying once the channel becomes a Slack Connect channel, with no need to remove and re-attach them
• [Code Review] Fixed Code Review ignoring @claude review comments from people with write access whose GitHub organization membership is private; their comments now start a review
• [Code Review] Fixed Code Review's "paused for this repository" comment sending admins to Code Review settings; it now says who can fix it and links the Git providers page

Added

• Added CLAUDE_CODE_DISABLE_FILE_MENTIONS environment variable: Claude gets the paths of @ file mentions to read with its file tools, not the files' contents
• Added idle compaction in the terminal: a 200K+ token conversation left idle for about 54 minutes is compacted before its one-hour prompt cache expires, so your next message doesn't reprocess it all
• Added CLAUDE_CODE_IDLE_COMPACT_MIN_TOKENS to change idle compaction's 200K-token minimum; "idleCompaction": false in settings.json turns it off. Both need v2.1.290 or later
• Added $.prompt.media so a prompt.submit hook of a mod installed by managed settings can read the bytes of an image or document attached to the prompt
• Added $.session.identity() for mods installed by managed settings: how the session is signed in, and its organization and email when managed forceLoginOrgUUID lists that organization
• Added size, weight, mono and tabular to a mod's Text and named spacing steps (xs to xl) to its Box; bold is deprecated in favor of weight
• Added --shutdown-drain-sec to claude self-hosted-runner orchestrator: on SIGTERM it stops polling and gives the poll in flight and running spawn hooks up to that many seconds to finish
• Added the skill's frontmatter, source, plugin name and file path to what a mod's skill.prompt hook receives
• Added /effort and /fast in agent view to set what new sessions start with; a bare /model, /effort or /fast there now opens a picker
• Added a "safe mode" line to the agents view peek panel for background sessions started with --safe-mode
• Added a one-time note when plan mode won't ask before most edits or commands because bypass permissions is available
• Added --disallow-tools and a disallowed_tools case field to claude plugin eval to keep specific built-in tools, such as Agent, out of eval runs
• Added support for turning off the attribution block in Claude Desktop's Code tab: set CLAUDE_CODE_ATTRIBUTION_HEADER=0 in the env of a Claude apps gateway's code policy
• Added a field to the attribution block in Claude Code sessions behind a Claude apps gateway; remove the block with CLAUDE_CODE_ATTRIBUTION_HEADER=0
• Added a queue door to the session.append mod hook, so a mod can make the transcript's queue records differ from the prompt as sent
• Added a note in /plugin and claude plugin validate naming a mod's hooks that are skipped where an organization manages Claude Code
• Added /usage warnings for max effort, workflows, always-on context and large tool results

Fixed

• Fixed the error for a denied cloud session, which could point to the wrong organization when a key from apiKeyHelper was in use
• Fixed sessions on a gateway-specific model name behind a custom ANTHROPIC_BASE_URL ending with "Prompt is too long · automatic compaction failed" near 200K tokens instead of sending the request
• Fixed a mod that submits a prompt at the end of every turn keeping a headless run going past --max-turns, --max-budget-usd, an interrupt, or the end of the host's conversation
• Fixed cloud sessions sometimes showing the model's follow-up text after a tool group's one-line label
• Fixed the Write and Edit tools creating a mod in a session's mods folder without asking in accept-edits mode when the config directory's path has no .claude in it
• Fixed installed mods that kept running in an open session after being turned off remotely; they now unload between turns
• Fixed Edit and Retry in Cowork and claude.ai cloud sessions failing on a message stopped while its UserPromptSubmit or mod prompt.submit hooks were still running (regression in 2.1.296)
• Fixed an agent teammate started without a description keeping part of a credential from its prompt in the task description shown for it
• Fixed the claude.ai view of a Remote Control or cloud session freezing when a large batch of events could not finish uploading over a slow connection
• Fixed a sandboxed shell command being able to write into a --plugin-dir folder, whose code Claude Code reloads and runs outside the sandbox
• Fixed memory growth under heavy debug logging (--debug, --debug-file), and a hang on exit when the debug log is on a disk or network mount that stops accepting writes
• Fixed memory growing without bound when debug output goes to stderr and the parent process stops reading it
• Fixed rm prompts on shell -c scripts that don't run rm. An rm built at run time in a script Claude Code can't read no longer prompts unless CLAUDE_CODE_STRICT_INLINE_SHELL_RM_PROMPT=1
• Fixed double-clicking a word in an expanded transcript row in fullscreen mode collapsing the row instead of selecting the word
• Fixed claude mcp list, claude doctor and /status reporting an empty .mcp.json as invalid
• Fixed /btw jumping the transcript to the bottom when asked while scrolled up in fullscreen
• Fixed sandboxed commands failing on WSL2 with bwrap: Can't mkdir /mnt/c/Program Files/ClaudeCode when the sandbox can write to the Windows drive
• Fixed scheduled wakeups (ScheduleWakeup) not firing while a background task was running in Agent SDK, IDE and claude remote-control sessions
• Fixed a mod's prompt.submit rewrite being silently dropped, sending the prompt as typed, for some prompts with a pasted image or an image that can't be read
• Fixed a Remote Control prompt being lost when another queued prompt in the same batch failed to deliver
• Fixed a Remote Control prompt that had passed its hooks being dropped from prompt history when Stop interrupted the next queued prompt's hook
• Fixed sign-in, MCP servers and project trust appearing lost on Linux after a sandboxed command left an empty .config.json in the config directory
• Fixed /sandbox reporting success when its setting could not be saved because the project folder is not writable; it now says nothing changed and why
• Fixed SDK and headless sessions staying in auto mode after the host switched to a model that doesn't support auto mode
• Fixed MCP servers named constructor or prototype in an MCP config never being connected
• Fixed tools of an MCP server named constructor or toString asking for permission in auto mode and bypass permissions mode
• Fixed a spurious "synced[0] commands path not found" plugin error at startup when another Claude Code process had just updated a claude.ai-synced plugin
• Fixed the Artifact tool advising a retry when a publish that requests connectors or other access was refused by the server or a proxy (HTTP 403); it now says so and what to tell the user
• Fixed Cowork cloud sessions staying on an old account plugin after a plugin reload that timed out or a restart that reused a recent sync
• Fixed document blocks being dropped from your own message sent while Claude is working
• Fixed Claude in Chrome asking for permission while no browser is connected; it now says the extension is not connected
• Fixed the fullscreen "Update installed" notice being hidden behind the idle "/clear to save tokens" hint; it now shows beside the hint
• Fixed a mod hook, with or without a .catch, being run again without end when it waits on another mod's noun that does its work outside the call
• Fixed the Claude apps gateway serving models that a policy's availableModelsMatch: exact or deniedModels blocks; it now answers 400 and leaves them out of its model lists
• Fixed the server-managed settings request to Anthropic carrying a third-party gateway's API key when a managed settings file sets ANTHROPIC_BASE_URL
• Fixed streams through a custom ANTHROPIC_BASE_URL being aborted after 180 seconds with no data arriving; they now wait 300 seconds, whether or not feature flags are loaded
• Fixed a mod's tool.describe or prompt.section answer that changed after $.ui.invalidate never reaching Claude; the new answer is now sent on the next turn
• Fixed a settings file being ignored when enabledMcpjsonServers or disabledMcpjsonServers held a single server name (letters, digits, - or _) as a plain string
• Fixed claude plugin test pausing a hook's time budget while a served $ method it had called kept making $ calls after answering
• Fixed high memory use after resuming a cloud or Remote Control session that had run many subagents
• Fixed plugin hooks being skipped when they pass a very deeply nested tool input or message on with next()
• Fixed a value a mod's hook passes to next(), returns, or sends to a $ method being refused whole when one of its getters throws a RangeError; now only that key is refused
• Fixed /usage, the approaching-limit warning (terminal and VS Code) and the status line sometimes showing more than 100% used (anthropics/claude-code#92238)
• Fixed wrapped text mixing CJK or emoji with Latin words losing its last line or leaving a blank row at some terminal widths
• Fixed a cloud session sometimes ignoring the answer to a permission prompt or a question when the answer was given while the session's worker was being replaced
• Fixed bold, italic and other nested text styles running over table borders or being lost on wrapped rows
• Fixed Cowork cloud sessions running the old version of an account plugin changed, removed or disabled from another device until the session restarted
• Fixed deny and ask rules for an MCP server (mcp__<server>) not applying when the server's normalized name contains a double underscore
• Fixed long conversations losing newly attached images on every turn after one oversized image was refused by the API
• Fixed the plugin_loaded telemetry event reporting has_hooks as false for plugins whose hooks are a hooks module, built-in plugins included
• Fixed images attached while Claude is working (VS Code, desktop app, SDK) being sent at full size, which led to repeated image errors in long conversations
• Fixed the image coordinate hint being missing or slightly off for large near-square images on newer models
• Fixed feature flag, startup, fast mode, profile and feedback requests to Anthropic carrying the API key configured for a third-party gateway (ANTHROPIC_BASE_URL); Anthropic API keys are still sent
• Fixed a mod's hot reload ignoring a fix saved right after a failed reload; saving a mod file without changing it no longer reloads the mod
• Fixed mods loaded from source files being refused when a hook hands $ to a function declaration imported from another file of the mod
• Fixed a regression in 2.1.296 where cloud and headless sessions could run an approved tool call twice if a new message arrived as the session resumed after a restart
• Fixed scheduled tasks being announced for the wrong minute: the scheduling tools now report each job's actual next run time
• Fixed mods' hooks being handed values with __proto__ keys silently removed, which could skip a tool.check guard on a tool call another mod made
• Fixed claude -p saying nothing when a settings file fails validation: text-output runs now list the file and the invalid entry on stderr
• Fixed long pastes in terminals without bracketed paste losing all text after an invisible control character, such as a mis-decoded curly quote
• Fixed managed settings and organization policy not being fetched when the stored login's plan was changed locally on machines whose MDM or managed-settings file sets forceLoginOrgUUID
• Fixed MCP connections over HTTP hanging for 30 seconds and failing when a server never ends the body of its reply to a notification (anthropics/claude-code#99014)
• Fixed MCP servers added to a running headless or SDK session being connected before some policy checks ran; a blocked server is now reported as failed without being contacted
• Fixed claude mcp list, claude mcp get and subagent MCP servers starting a server that a policy check blocks; it is now reported as blocked without being started
• Fixed /reload-plugins not loading a plugin installed from another terminal a moment earlier
• Fixed blank rows appearing under CJK and emoji text squeezed into a one-cell column, as in a very narrow terminal
• Fixed text cut in the middle beside wide characters leaving a cell unused or being cut twice, and an emoji vanishing where a color changed inside it
• Fixed bare mode notices in background sessions telling you to restart without --bare, which keeps the mode; they now name /stop and claude --resume, as safe mode ones do
• Fixed ← not saying why it stayed put over a queued message while Remote Control is on
• Fixed $.http.fetch in mods refusing a 304, 204 or 205 response that declares a Content-Length over the 4 MiB body limit
• Fixed /config push notification toggles sending your account the previous setting instead of the one you just chose
• Fixed a cloud session leaving a reply unfinished when its worker was replaced just after the reply hit the output token limit
• Fixed Read failing on PDF page ranges in remote sessions on Linux that run without elevated privileges
• Fixed Enter answering a question or permission prompt that had been held back while you typed an unsent message
• Fixed a file attached to a message in a remote session being left out when its download stalled part way; the download is now tried again
• Fixed queued prompts sent as content blocks over --input-format stream-json running together without a line break when merged into one turn
• Fixed self-hosted runner sessions shutting down MCP servers added through an --exec-path wrapper's own --mcp-config when connectors change mid-session
• Fixed claude plugin eval passing runs that the API refused: a run that ends on an API error now scores 0 without grading and makes the suite exit 1
• Fixed permission prompts cutting off or wrapping too early when the reason text contains keycap or joined emoji
• Fixed forceLoginOrgUUID and forceLoginMethod from MDM or the managed-settings file being hidden or replaced by server-managed settings
• Fixed --bare sessions leaving out an MCP server named constructor or prototype that --channels asked for
• Fixed resuming a conversation from before /clear reattaching to the Remote Control session of the conversation after it
• Fixed a prompt starting with /, sent with the Agent SDK's verbatimPrompts option, running as a slash command when CLAUDE_CODE_RESUME_INTERRUPTED_TURN re-ran it after a restart
• Fixed background sessions started with --safe-mode silently leaving safe mode when the session was woken or restarted
• Fixed scheduled tasks and loops firing again after every turn, or firing early, during the repeated hour when daylight saving time ends
• Fixed the diff view listing a new file whose name begins or ends with a space under the wrong name
• Fixed MCP tool calls in headless and SDK sessions sometimes failing or running twice when a background reconnect closed the connection they were running on
• Fixed /btw side questions in non-interactive sessions not being cancelled when the session ends, and running a second time when the same request arrived again mid-run
• Fixed sandboxed commands on macOS being able to read or write a denied path by its real location when the denied path passes through a symlink
• Fixed sandbox denyRead and allowRead globs with braces, parentheses or backslashes in a folder's name being read differently by Claude Code's settings checks than by the sandbox
• Fixed sandbox glob allowRead and allowWrite entries not being re-checked when the directory they start from is replaced by a symlink
• Fixed worktree-isolated sessions accepting some awk programs the isolation guard should refuse
• Fixed claude mcp add <name> -- <command> --background being started as a background session
• Fixed a prompt or reply of --bg or --background to a background session being taken for the flag, which could start new sessions over and over instead of delivering it
• Fixed a custom slash command's embedded shell line running twice when a newer message interrupted the command while its prompt was being checked
• Fixed --worktree sessions leaving a folder behind in .git/worktrees in repositories using git's reftable ref storage
• Fixed claude self-hosted-runner sessions using Anthropic-managed git showing tracked files as staged deletions when starting in a reused clone whose remote is still empty
• Fixed Ultracode not being announced to scheduled tasks and other delivered headless turns when ultracode is on in settings
• Fixed MCP OAuth sign-in, token refresh and sign-out not sending configured headers/headersHelper values, which broke servers behind an authenticating proxy
• Fixed the Artifact tool reporting a spurious one-line difference against the live page, and refusing the publish, when a large page with a line break after <head> is published again unchanged
• Fixed $.ui.open reporting a mod's pane as placed in sessions where no surface draws it, such as Claude Code for VS Code and claude -p
• Fixed the agent.spawn mod hook not running when a finished subagent or a killed teammate is resumed: the hook's event now carries resume, and a mod can refuse it
• Fixed claude plugin validate rejecting a mod's $.state references when plugin.json has no types key and the contract is at ./types/index.d.ts
• Fixed a mod's dimColor text looking the same as plain text under the dark ANSI theme and on 16-color terminals
• Fixed plan mode running a write (an MCP tool's, a file's, a shell command's) that a PreToolUse hook or a mod's tool.check hook allowed
• Fixed background subagents in auto mode sometimes sending their final report twice, once as the result and once as a message
• Fixed SendMessage not finding a subagent by name after the CLI restarted and resumed the session (names given before the last compaction still need the agent ID)
• Fixed replies cut off at the output token limit ending the turn silently, with no retry or error, after a request fell back to non-streaming mode
• Fixed Read garbling UTF-16LE files with a byte-order mark, and Write dropping byte-order marks or silently converting Windows-1252, Shift-JIS, GBK or UTF-16BE files to UTF-8 (now refused)
• Fixed cloud sessions sometimes leaving a message unanswered when the worker was replaced right after a compaction
• Fixed cloud sessions and CLAUDE_CODE_RESUME_INTERRUPTED_TURN sometimes answering a finished turn again after a restart, when a tool ended the turn and a skill loaded in the same step
• Fixed photos sent over Remote Control being dropped when their copy could not be saved on your computer; Claude now still sees the photo
• Fixed files sent over Remote Control sometimes not arriving in long-running sessions
• Fixed files of 30 to 35 MiB sent over Remote Control or to a cloud session not arriving
• Fixed a user-installed mod's $.env.set changing the environment or shell prefix that command hooks from managed settings start with

Windows

• Windows: Fixed the process-liveness check leaving orphaned PowerShell processes behind on busy machines until memory ran out
• Windows: Fixed PreToolUse and PermissionRequest hooks that set no shell failing open when Git for Windows isn't installed; a guard that fails now blocks the call
• Windows: Fixed Bash commands failing with "command not found" for a whole session when Git Bash did not report its PATH at startup

Self-hosted runner

• Self-hosted runner: Improved what setup and doctor say when the runner's machine has no git credentials
• Self-hosted runner: Fixed sessions that wrote output before their first turn being left with no release timer, ignoring --retire-at and delaying shutdown

Improved

• Improved the error shown when a cloud session is refused because your claude.ai login was rejected or has expired: it now tells you to sign in again with claude auth login
• Improved enforcement of managed permission rules, managed hooks and organization MCP tool names against user-installed mods
• Improved memory and disk use when PDFs are @-mentioned: their bytes are no longer kept in the session transcript
• Improved sandboxed Bash on Linux: Esc and Ctrl-C now work while wildcard read rules are being expanded for a command
• Improved the startup warning for an unrecognized model ID: it is now one short line under the welcome banner with a docs link, instead of a long raw message
• Improved the plugin-authoring skill's steps for sharing a mod: Claude asks public or private and checks the files before creating a GitHub repository
• Improved the Skill tool's "Unknown skill" error to suggest a skill's listed name when Claude wrongly adds the anthropic-skills: prefix to it
• Improved /reload-skills to say it re-sends the full skill list to Claude, which is how to get skills back after compaction
• Improved the error shown when a worktree cannot be created because its base commit does not resolve: it now says how the lookup ended and the likely reasons, such as a repository without a commit
• Improved the error for creating a worktree at a bare-repository layout's root: it now explains the layout instead of an unrelated git error
• Improved artifact watching: a local session can now watch up to 25 published artifacts at once, up from 10
• Improved background agent notifications: they now say when an agent is only waiting on its own background work, got a message too late for its result, or was stopped by a usage limit

Changed

• Changed plugin hooks and workflow scripts to refuse values they hand back that nest deeper than 28,000 levels, with an error naming the limit (workflow scripts allowed 100,000)
• Changed actions a plugin hook can block to be refused, not let through, when the hook cannot be handed them or cannot hand back its answer; a tool that already ran has its result withheld
• Changed requests to claude.ai's connector proxy and to Anthropic-hosted MCP servers to no longer follow HTTP redirects; redirects by a connector's own server are unaffected
• Changed MCP requests in cloud and self-hosted runner sessions to no longer follow HTTP redirects from the session's MCP proxy
• Changed skill and command loading: one whose file or folder name has hidden, direction-changing or blank-like characters, < or > is no longer offered until renamed; such a name: is ignored
• Changed ui.render trees in claude plugin test: each mod's Box or Text root now carries part: { plugin } naming the mod, so exact-tree assertions must include it
• Changed WebFetch page reads to pick their effort as web searches do: the caller's level on the caller's own model, otherwise the level settings give the small model
• Changed claude plugin test to fail a call to a mod's served $ method that has not answered within ten seconds, as a session does
• Changed MCP allow rules to reach only the server they name: mcp__a no longer allows a server named a__b or a_; write mcp__<server>__* with the server's whole normalized name
• Changed agent tools: lists to take only the named MCP server's tools; list a server whose name contains __ as mcp__<whole name>__*
• Changed Claude in Chrome in Cowork cloud sessions outside auto mode: an approved-site action the safety classifier flags now asks you instead of being refused, unless managed settings apply
• Changed cloud session and Remote Control MCP connectors to negotiate MCP protocol version 2026-07-28 by default on installs that fetch no flags; MCP_PROTOCOL_NEGOTIATION=legacy opts out
• Changed MCP tool descriptions and server instructions from Anthropic's first-party MCP servers at api.anthropic.com to reach Claude in full instead of being cut at 4,096 characters
• Changed auto mode in Cowork cloud sessions: a PermissionRequest hook can no longer approve shell commands or subagents; those prompts wait or are denied
• Changed the resume command printed at exit: it names the session by its ID and no longer by its name, so that nothing in a session name can run when the line is pasted
• Changed the resume command printed at exit of a worktree session: it uses -w and -r if the long flags do not fit the terminal. If neither fits a kept worktree, rows above it say where to run it
• Changed /btw side questions in non-interactive sessions to return a timeout error when still unanswered after 11 minutes
• Changed UserPromptSubmit hooks to run before a skill or custom slash command expands, so a hook that blocks the prompt now also stops its embedded shell commands
• Changed a skill's own front-matter UserPromptSubmit hook to first run on the prompt after the one that invokes the skill
• Changed the turn.start mod hook to also hear subagents' and teammates' turns, not only the main loop's; tell them apart by e.agentId (absent on the main loop)
• Changed the errors shown when /ultrareview can't upload a repository to stop suggesting git add ., which could stage or commit untracked files such as .env
• Changed the cyber safeguard notice to no longer ask people to apply to the Cyber Verification Program

VSCode

• [VSCode] Fixed an unsent prompt and its attachments being lost when switching to another session and back
• [VSCode] Fixed unused blank chats keeping a background Claude process running after starting a new conversation
• [VSCode] Fixed the mic button showing an internal error message when you are signed out of claude.ai; it now offers to sign you in
• [VSCode] Improved startup time in workspaces without a Python environment by starting Claude while the Python extension loads
• [VSCode] Improved startup: the model picker and slash command menu now fill in right away in a new window on a folder you've opened before

Cloud sessions

• [Cloud sessions] Fixed a memory spike that could crash a session when many of its existing output files were re-sent to it at once
• [Cloud sessions] Fixed saving an edited routine silently moving it to a different environment when its own had been deleted or wasn't in the list; the routine now keeps its environment
• [Cloud sessions] Fixed Sessions search in a self-hosted environment's admin details finding nothing when you paste the session ID from a session's link
• [Cloud sessions] Fixed the Sessions and Runners lists in a self-hosted environment's admin details saying the list is empty when a search just has no matches
• [Cloud sessions] Improved the deploy command shown when you create a self-hosted environment or environment key: it shows in full, wraps between arguments, and has a visible copy button
• [Cloud sessions] Changed deleting a self-hosted environment to turn off its routines right away, with the reason shown on each routine, instead of leaving their runs to fail

Remote Control

• [Remote Control] Fixed Remote Control sessions whose computer can't be reached still appearing to send your messages; your text now stays in the box and Send is off until it reconnects

Claude Tag

• [Claude Tag] Added the ability for Claude in Slack to delete a canvas it created in a channel when someone asks it to
• [Claude Tag] Fixed Claude in Slack staying silent on untagged posts that a channel's own instructions tell it to answer, such as posts that tag someone else, in channels with guests
• [Claude Tag] Fixed Claude in Slack reporting a reply to another channel's thread as posted when it isn't a member there; it now says the reply wasn't delivered and how to fix that
• [Claude Tag] Fixed Claude in Slack sometimes ending a turn without posting its answer when a self-hosted runner's image has no python3
• [Claude Tag] Changed how Claude in Slack corrects a message it got wrong: it edits the message in place and adds a short "Edited" note instead of striking through the old text
• [Claude Tag] Changed Claude in Slack to join channels with more than 100 members quietly, with no intro message

Code Review

• [Code Review] Fixed Code Review's monthly spend-limit comment and check-run card sending admins to Claude Code settings; they now link the Usage page, where that limit is set

• We've launched OpenTelemetry export in beta, so you can trace Messages API requests and Claude Managed Agents sessions in your observability backend. The Claude SDK emits spans in Python, TypeScript, C#, Go, Java, PHP, and Ruby. To get spans from the API, add an OpenTelemetry destination in the Claude Console.

• Claude Managed Agents scheduled deployments are now available on Claude Platform on AWS.

Earlier this year, we shared an update on our election safeguards, which described how we measure and prevent political bias, detect misuse, and direct people to accurate voting information.

Below, we outline how we've built on that work and continued to strengthen our election safeguards ahead of this year’s US midterms.

How people use Claude for elections and politics

Our goal is for Claude to be a useful tool for political conversations, while preventing election-related abuse. That starts with understanding how people actually use Claude in these contexts. To do this, we used Anthropic Insights to develop a new analysis of 250,000 conversations over the course of a recent one-week period.¹

Today, conversations that touch broadly on politics, public policy, or social issues account for about 5.75% of all conversations in the United States on Claude.ai, our consumer app. This includes people turning to Claude to follow the news, conduct academic or professional research on public policy, learn about candidates, and navigate government services. About 0.51% of all conversations are specifically about elections or voting. As we get closer to Election Day, we expect the share of political and election-related queries to increase.

This sample suggests people rarely ask Claude whom or what to vote for. These kinds of requests showed up in about 0.01% of US Claude conversations. More often, we observed people asking Claude questions that could help them reach their own conclusions, like where candidates stand on a particular issue. Requests that violated our election integrity policies were even less common, appearing in about 0.002% of conversations.²

How many US Claude.ai conversations touch on politics, are about elections, or ask Claude whom or what to vote for. Each dot represents 1 in every 10,000 conversations in a random sample of about 250,000 US Claude.ai consumer conversations from September 21 to 27, 2026, which Claude classified using a privacy-preserving method. Because requests for a recommendation on whom or what to vote for are so rare, we show the upper end of a 95% confidence interval for that group. Examples are illustrative only.

Most of the requests we see are informational in nature. People turn to Claude to make sense of geopolitical events, research candidates, draft documents, assist with coursework, and weigh arguments for and against policies.

What people ask Claude for in political conversations. Conversations were clustered in a privacy-preserving, bottom-up manner through Anthropic Insights.

Connecting people to trusted sources

Ahead of Election Day, we've added two ways for people to get reliable information directly in their conversations with Claude. As we shared in April, when people ask Claude.ai about voter registration, polling places, or election dates, we’ll continue to display a banner linking to TurboVote, a nonpartisan resource from Democracy Works.

Later this month, Claude will start drawing official voting information from Democracy Works into its responses on Claude.ai for users in the US. Someone asking where to vote or what ID to bring to their polling place will now get an answer specific to their state, without leaving the conversation. These responses draw on publicly available information that Democracy Works collects from state and local election sources.

Official voting information presented by Democracy Works.

Additionally, Claude will begin showing up-to-date results on election night and in the days that follow, so that when people ask for current vote counts or election results, they'll be shown the latest official numbers directly in their conversation.

Measuring and preventing political bias

When people ask Claude about politics, they should get accurate and evenhanded answers that don't favor any particular political viewpoint. That’s why we test our models extensively for political bias before every model launch. Claude Opus 5.5, Sonnet 5.5, and Haiku 5.5 are our most evenhanded to date, scoring 99% on our political evenhandedness evaluation. Our latest models also engage more readily with political discussions and decline fewer requests, so people can get the information they came for. We're continuing to refine these evaluations, and also looking beyond them for new ways to pressure-test how our models handle political topics.

As part of that effort, we asked three independent groups to review how Claude handles free expression, each from a different angle with different methodologies. The Future of Free Speech, an independent think tank at Vanderbilt University, tested Claude on hundreds of requests on contentious topics, and the Foundation for American Innovation compared how Claude responded to matched prompts from the left and right, ranging from mainstream policy debates to more extreme scenarios. On both of these evaluations, most of the responses were rated as strong, engaging substantively with requests. The Collective Intelligence Project surveyed more than 2,000 people in the US, UK, and India in developing an evaluation. Through a three-stage process, participants proposed principles for handling sensitive topics, ranging from health to politics, identified topics to test, and helped develop criteria for judging model responses. CIP synthesized this input and tested for agreement across demographic and cultural groups to establish shared principles.

These evaluations also identified areas where Claude still falls short. The Future of Free Speech and the Collective Intelligence Project both found that Claude rarely refused requests, but sometimes added unsolicited caveats and counterarguments, such as inserting an opposing view into an advocacy email. And the Foundation for American Innovation found that Claude Sonnet 4.5 didn’t always hedge evenly, and was more likely to soften arguments for right-leaning positions.

We're addressing this in a few ways. We've improved how Claude responds to direct yes-or-no questions and requests for shorter answers, where we found its answers could be less balanced. We're also using these findings to improve when and how Claude adds caveats or counterarguments, so it treats requests from across the political spectrum more consistently. And we're continuing to improve how we test for uneven hedging, building on existing evaluations that use matched prompts from the left and right. More broadly, we're working to expand our political bias evaluations to better reflect real conversations and to cover candidates and voting questions as well as policy issues.

How we define misuse

Our Usage Policy prohibits using Claude to deceive voters or disrupt elections, from spreading false information about candidates or how to vote, to impersonating election officials or trying to suppress turnout. Each year, we update the policy to reflect our models’ evolving capabilities and feedback from our customers. This year’s update, which we announced last week, clarifies what our election rules cover and what they don't, and adds new examples to help people understand where the lines fall.

We know many political campaigns use Claude for legitimate, everyday tasks, so we recently published a guide to help them understand where these policies apply. It covers the many ways campaigns can put Claude to work, such as drafting press statements and fundraising emails, prepping for debates, analyzing turnout data, and building voter outreach materials. It also spells out what’s prohibited, such as using Claude to create fake social media profiles that pose as real people, mass-producing comments to inflate a campaign’s engagement, or writing content for news sites and pages that falsely claim to be independent.

Testing and strengthening our defenses

We deploy automated classifiers that are trained to detect election-related abuse. To see how these safeguards hold up in practice, we partnered with the Institute for Strategic Dialogue (ISD) and the McCain Institute, both independent research organizations, to pressure-test our protections in the US, Israel, and Brazil. Analysts tested whether Claude would assist with deceptive campaigning, misinformation, and other forms of election abuse. They began with direct requests, then broke full campaigns into smaller tasks that could look harmless on their own, such as audience research, building news sites, drafting content, and planning its distribution. They found that Claude reliably refused a single harmful request, but could miss a malicious campaign when it was spread across many individual requests that looked harmless on their own.

Building on these findings and our own, we've added new classifiers to better identify novel and multi-step misuse, including attempts to build fake social media accounts and news sites aimed at political discussions, or to run financially motivated election schemes. We also enhanced our ability to detect election-related misuse by foreign state actors, and strengthened our cyber protections for election infrastructure and campaigns. Finally, we built targeted safeguards for localized risks identified in the US, Israel, and Brazil, which all have major national elections this year.

Our threat intelligence and enforcement teams review flagged activity and take action when they confirm a violation, including banning accounts. We also routinely share examples of unintended model actions or behavior we've observed during our evaluations and internal use of Claude.

What we've found

Our recent threat intelligence report reflects a broader shift in election-related abuse trends. Political, state-aligned, and commercial actors are now incorporating AI into nearly every aspect of their influence operations, from planning and content creation to building platforms used to disseminate a message. Because we see these early stages of an operation happening on Claude, we often have a chance to stop these efforts before they ever reach the public.

Our teams have continued to investigate and prevent coordinated abuse around elections, including the US midterms. In one case, foreign-based operators of a fake news site used Claude to produce US midterm coverage favoring Russian, Iranian, and North Korean narratives. We've also observed threat actors seeking to exploit the election for financial gain, using Claude to produce fabricated news and other content designed to attract American audiences and generate advertising revenue. We banned the accounts involved in these cases and improved our ability to detect this type of abuse.

Looking ahead

More people are turning to Claude for information about this year’s elections than ever before. We have a responsibility to make sure the answers they get are accurate and balanced, and that Claude isn’t used to undermine the democratic process. We’ll continue to invest in making Claude more evenhanded, preventing and addressing misuse, and being transparent in our actions. This work will be critical in the upcoming US midterms and extends to elections around the world as well. In the coming months, we also hope to share a more comprehensive look at how people used Claude throughout the election cycle, with the goal of strengthening our election-related evaluations and safeguards.

Footnotes

1. We took a random sample of 250,000 US Claude.ai consumer conversations from September 21 to 27, 2026 and analyzed them in a privacy-preserving way.

2. This figure was generated from a separate analysis of 250,000 Claude.ai conversations, which were reviewed against our election integrity policy.

Release notes

• Added a code key to the Claude apps gateway's managed.policies[]: the same settings as cli, also applied in Claude Desktop's Code tab; beside desktop, it turns on Claude Desktop's gateway mode
• Added autoCompactWindow to subagent frontmatter and --agents definitions, so a subagent can auto-compact earlier than the main conversation's window
• Added CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL to run every workflow agent on one model while other subagents keep theirs
• Added CLAUDE_CODE_OVERLOADED_RETRY_MAX_DELAY_MS environment variable to set a longer maximum delay for the backoff when retrying an overloaded (529) request
• Added a note in /plugin on a plugin whose hooks are left out because another enabled plugin has the same name
• Added an allow_large option to the Read tool so Claude can read a text file past the usual size limits in one call when it needs the whole file and the context has room
• Fixed managed-settings PreToolUse hooks that deny a tool call with "continue": false, and managed prompt hooks that block one, refusing the call but not ending the turn
• Fixed PostToolUse hooks in managed settings not applying updatedMCPToolOutput in some sessions
• Fixed headless sessions starting a folder's .mcp.json or plugin MCP server that was switched off for that folder, after changing directory or reloading plugins
• Fixed a Claude apps gateway that serves allowedProviders with "gateway" locking out laptops that name that gateway in user settings
• Fixed a saved Claude apps gateway sign-in being ignored on machines whose managed settings set forceLoginMethod to gateway with no forceLoginGatewayUrl (regression in 2.1.295)
• Fixed --teleport opening an empty conversation when the session's history could not be read
• Fixed token counts for Haiku 5.5 and other models that take only adaptive thinking, which failed behind some gateways and were counted with budget thinking elsewhere
• Fixed resumed subagents being told that the user rejected a tool call that a session shutdown had interrupted
• Fixed hook output being altered when it contained text resembling a plugin hint tag
• Fixed secret redaction in shared transcripts and debug logs missing some values that follow a key with no value, including in JSON written inside a shell string
• Fixed a stray 52;c;… escape sequence printed on screen after copying in older VTE-based terminals such as MATE Terminal
• Fixed toasts and notifications waiting unseen for as long as the /diff panel or dialog was open
• Fixed Esc or an interrupt during a UserPromptSubmit hook or a mod's prompt.submit hook ending headless sessions, clearing the typed prompt, or letting the unchecked prompt through
• Fixed SessionStart hooks of a plugin loaded after a headless session starts being skipped when a different plugin with the same name, or another spelling of it, had already run
• Fixed claude self-hosted-runner printing misleading errors when registration is refused: it now names the org admin setting, or says a restarted on-demand runner needs a fresh work order
• Fixed a self-hosted runner session's git fetch, pull and push failing while another session of the same repository starts on a runner with --capacity above 1
• Fixed workflow scripts silently truncating results, agent options and other values nested deeper than about 20,000 levels, and deeply nested results writing huge task output files
• Fixed a plugin's served $ methods running in the main session's working directory instead of the calling agent's, and ignoring the turn their calling hook holds
• Fixed $.agent.register succeeding from a mod's hook that was still running after the mod was reloaded or removed; the call is now refused
• Fixed $.http.fetch in mods refusing a HEAD request when the response declares a Content-Length over the 4 MiB body limit
• Fixed claude plugin marketplace add, marketplace update and plugin install failing with an internal error for a marketplace named like constructor; add now refuses such names clearly
• Fixed a plugin secret named constructor or prototype being deleted by the next save of that plugin's options
• Fixed cloud sessions skipping auto mode's checks on Claude in Chrome actions that a saved permission allows when their feature flags had not loaded
• Fixed CLAUDE_CODE_RESUME_INTERRUPTED_TURN re-running a finished turn after a restart when an MCP tool result had ended that turn
• Fixed Bash permission checks auto-approving some commands that assign the BASH_ARGV0 shell variable and then use it; these now prompt for approval
• Fixed Edit and NotebookEdit replacing every non-ASCII character in files that are not valid UTF-8 (Windows-1252, Shift-JIS, GBK); such edits are now refused
• Fixed a prompt sent just after ← being run twice, once unseen in the foreground, when the background service was slow to answer
• Fixed a prompt sent while SessionStart hooks were still running vanishing when ← moved the session to the background; it is still not sent, but ↑ now brings it back
• Fixed a late-loading plugin's SessionStart hook output reaching the new conversation after /clear in headless sessions
• Fixed PowerShell commands not seeing variables that hooks write to CLAUDE_ENV_FILE (when the file holds only plain assignments)
• Fixed Claude calling cloud sessions non-interactive and suggesting /mcp or claude mcp when an MCP server needs authentication
• Fixed /code-review ending on a raw JSON array in cloud sessions, the Agent SDK and IDE integrations; the findings now print as a numbered list
• Fixed auto mode occasionally refusing one update to your own artifact, saying its sharing had changed when it had not
• Fixed skills synced from claude.ai never finishing their install, and being downloaded again at every sync, when several sessions share a config directory
• Fixed a plugin synced from claude.ai being disabled when the marketplace dependency it declares was also synced from claude.ai
• Fixed a startup hang on macOS when plugin paths copied from a Linux machine pointed under /home
• Fixed the Workflow tool refusing script files with CRLF line endings, such as files checked out on Windows
• Fixed OpenTelemetry tool_result events missing git_commit_id after git commit -q or git -C <dir> commit
• Fixed CLAUDE_CODE_TRANSCRIPT_LOCAL_GC dropping a message from the saved transcript when its text held a Unicode line or paragraph separator (U+2028, U+2029)
• Fixed claude purge leaving a prompt in the history file when its text held a Unicode line or paragraph separator (U+2028, U+2029)
• Windows: Fixed PowerShell commands longer than about 1 KB always asking for permission, so allow rules and read-only detection now apply up to 32 KB
• Windows: Fixed stdio MCP servers being force-killed at shutdown; stdin now closes first and the process tree is killed only if the server is still running after 300 ms
• Windows: Fixed claude plugin install failing for GitHub owner/repo plugin sources on machines with no GitHub SSH key; the clone is now retried over HTTPS
• Windows: Fixed rm -rf /c/Users/<name> in Git Bash not asking in bypass permissions mode
• Improved fullscreen mode: the link under the mouse pointer is now underlined to show it can be opened
• Improved transcript toggle (ctrl+o) responsiveness in code-heavy conversations by caching syntax-highlighted code blocks
• Improved Claude Desktop's Code tab behind a Claude apps gateway: when a session can't start, including on a machine not set up for the gateway's code settings, the reason shows as a reply
• Improved the errors for a refused cloud session: they now say why your organization's policy couldn't be loaded, and name an API key or auth token that overrides your claude.ai login
• Improved --debug output to name unrecognized frontmatter fields in custom agent files, with a hint for likely typos
• Improved auto mode: a tool call that wasn't run because auto mode's check had no usable answer now shows as a dim "Not run" row instead of a red error
• Improved --debug output for hooks: command hooks on tool calls, prompts, SessionStart and Stop now log their command, plugin, outcome and duration when they finish, so a slow hook is identifiable
• Improved CLAUDE_CODE_TRANSCRIPT_LOCAL_GC: a large transcript file is no longer rewritten when that would free under 10% of it
• Updated /cost, the status line, --max-budget-usd and the SDK's cost figures to price Sonnet 5.5 cache reads at $0.10 per million tokens (was $0.20)
• Updated the bundled dataviz skill: lighter violet for the seventh series in light mode, softer primary text in dark mode, and compact y-axis labels like 1K
• Changed the default limit on MCP tool descriptions sent up front and on MCP server instructions from 2,048 to 4,096 characters
• Changed ←: a turn or ! command started while the session moves to the background is now stopped instead of finishing out of sight
• [VSCode] Fixed claudeCode.spinnerVerbs missing from the extension's settings, so settings.json now completes and validates it; a malformed value no longer breaks the chat panel
• [VSCode] Changed Claude in Chrome to ask before browser actions in every session, including one connected with @browser, as the terminal does; allowing a site for the session stops repeat asks
• [VSCode] Fixed chat links written as a full Windows path, such as C:\repo\file.ts or file:///C:/repo/file.ts, not opening the file on Windows
• [VSCode] Fixed the working indicator still animating when reduced motion is turned on in your OS, in VS Code, or with the prefersReducedMotion setting
• [VSCode] Fixed the prompt cache clock reading warm after the panel caught up on messages late, such as after the display was off or a remote window reconnected
• [Cloud sessions] Added a status filter to the Sessions and Runners lists on a self-hosted environment's Activity tab in admin settings; you can pick several statuses at once
• [Cloud sessions] Fixed every cloud session waiting for a self-hosted runner showing the same queue position; each now shows how many sessions are ahead of it
• [Cloud sessions] Fixed a message you send while Claude is still replying in a cloud session jumping above that reply when it finishes; it now stays below it, including after a reload
• [Claude Tag] Changed Claude in Slack to show the footer with the session link, model and cost only on its newest reply in a thread; the reply before it drops the footer
• [Claude Tag] Fixed links to URLs that contain parentheses breaking in some of Claude's Slack replies and task checklists, which showed stray bracket text and opened the wrong page
• [Claude Tag] Fixed Claude's Slack replies drawing color swatches beside codes that only look like hex colors, such as six-digit pull request numbers
• [Claude Tag] Added creating, editing and deleting workspace and channel memory files on the Activity page's Memory tab for members with the Claude Tag Admin permission
• [Claude Tag] Fixed the plugin confirmation card Claude posts in a Slack channel showing a plugin's ID instead of its name
• [Claude Tag] Fixed Claude in Slack posting a card to remove a plugin the channel's own settings don't include; it now explains where the plugin comes from instead
• [Claude Tag] Fixed Claude in Slack sometimes losing its reply when a session in a self-hosted environment moved to a new runner partway through a task
• [Code Review] Fixed the Code Review check sometimes staying "in progress" on a pull request after the review finished; it now shows the review's result
• [Code Review] Improved Code Review admin settings to say why a setting couldn't be saved, such as a policy restriction, instead of a generic failure message

• You can now let a Claude Managed Agents agent use dynamic workflows, in beta with the managed-agents-2026-04-01 beta header. For work with many pieces, such as reviewing hundreds of documents, the agent can write a workflow. A workflow is a program that runs many agents in phases and combines their results. The server runs it in the background as a workflow run. To turn dynamic workflows on, set the agent's multiagent field to {"type": "multiagent_20261001", "workflows": {"type": "enabled"}}. To guide the agent, tell it in its system prompt when to start a run. Follow each run through workflow_run.* events on the session's event stream. See Workflow runs.

Claude Dashboards and Claude Motion are now in beta. Docs, Slides, and Design are out of beta and on every Claude plan, including Free.

Starting today, Claude can turn your data into a dashboard that stays current, and your ideas into an animated explainer for your next presentation. Claude Dashboards connects to a data platform like BigQuery, Databricks or Snowflake, or a CRM tool like Salesforce, and is in beta on paid plans. Claude Motion is in beta on Team and Enterprise. Claude Docs, Slides, and Design are out of beta and available on every plan, including Free.

Asking questions about company data usually means filing a ticket or writing SQL. And ideas that would land better in motion usually end up as another static slide. So people wait, or skip it. Claude could already help with parts of this. Now you can ask for the dashboard or the animation itself, and see how Claude made it. Each chart shows the query behind it, and each animation is built as code you can edit. Claude makes the first version, and you decide what gets shared.

Claude Dashboards: ask quick questions of your company’s data

Connect your company’s data platform, such as Amazon Redshift, BigQuery, ClickHouse, Databricks, or Snowflake, and ask a question in plain language. Claude pulls answers from your data, builds the dashboard, and keeps it current as the data changes. It works with your other connectors too. For example, you can ask for a dashboard of your Salesforce opportunities. Dashboards work well for quick, exploratory questions, like how this week’s signups compare with last month’s. Click any number to see the query behind it, or ask Claude to explain it. Each chart shows when its data was last refreshed.

Dashboards work alongside your BI and analytics tools. When a question needs deeper analysis, send the dashboard from Claude straight to Amplitude, Grafana, Hex, Mixpanel, Omni, Perplexity, PostHog, or Sigma and pick up the analysis from there, with Looker, monday.com, and Tableau coming soon.

Claude Motion: explain your ideas with animation

Ask Claude to turn a quarterly report into a 30-second explainer for an all-hands, add motion to a chart in a board deck, or make a product walkthrough for customer onboarding. Claude builds an animation from your prompt, and it plays like a short video. You can adjust it in the editor or ask Claude to change it, then download it as an MP4 file.

Claude Motion is built for explaining your own work. Claude writes code that animates your text, charts, shapes, and images, so you can change any word, number, or timing. It doesn’t use a video generation model, so there’s no generated footage and no AI-generated people. When you want to take it further, open it in Adobe, Descript, HeyGen, Higgsfield, invideo, Luma AI, or Runway, with Canva and Captions coming soon.

Docs, Slides, and Design are ready for everyday work

Since we introduced Docs, Slides, and Design in every Claude conversation, people have made more than 45 million docs, decks, and designs in Claude. Most of what we’ve shipped since came from your feedback, and it makes them easier to use every day. So we’re taking the beta label off.

• Ready for enterprise. Artifacts now support CMEK, and admins choose which artifact templates their organization uses.
• Edit with your team. Your team and Claude can work on the same doc, deck, design, or dashboard.
• Share beyond your team. Share slides, designs, dashboards, and animations with people outside your organization, or with anyone who has the link, if your admin allows it.
• Exports that keep your formatting. PowerPoint and PDF downloads look like what you made in the editor, and decks go straight to Google Slides as editable files.
• Edit on your phone. Change a doc, deck, or design in the Claude mobile app.

Claude Design has moved into Claude

Claude Design started at its own URL, claude.ai/design. Since September 16, Design also works inside every Claude conversation, where it can use your context, files, and connectors. Running two versions slows down fixes for both, so we’re folding the standalone site into Claude. It stays at claude.ai/design until December 14, so you have time to move over.

• Migrate your design systems today. On the Artifacts page in Claude, click "Migrate team design systems." One migration brings over every design system in your organization, and the originals stay unchanged in the standalone version until it closes.
• Your projects need nothing from you yet. They keep working in the standalone version until it closes.
• Save your chats and comments. Chats with Claude and comments on your projects stay in the standalone version and won't be available after it closes. Public links to standalone projects stop working then too.

Read the migration guide for more information.

Getting started

Open Claude and ask for what you need, like “Build a dashboard of this quarter’s revenue by region,” “Animate how our pricing plans compare for the sales kickoff,” or “Turn these notes into a deck for Monday.” Start with the dashboard you’d wait for, or the report that needs more than a slide.

For Enterprise admins: Dashboards and Motion are off by default, and you can turn them on in Organization settings > Artifacts. Docs, Slides, and Design turn on by default October 15, or you can turn them on today.

Today we’re launching the Anthropic Cyber Mission, a long-term commitment to securing the systems everyone depends on. The Cyber Mission is a new effort to support defenders with tools, research, and resources to secure their software and systems. We’re starting with two areas:

• Critical infrastructure: Starting with securing the operational technology behind power grids, water systems, and transportation networks, and protecting government systems. Today, we’re introducing the Critical Infrastructure Defense Program (CIDP), which brings frontier models, on-site engineers, and threat research to the defenders that protect operational technology.
• Open-source software: Finding vulnerabilities and proposing patches in the free, shared code that most software depends on, and hardening the underlying code. Today, we’re launching OSS Scanner, which offers open-source projects regular security scans from our strongest models, for free.

Frontier models can be misused to exploit vulnerabilities and conduct cyber operations. Despite best efforts, many areas of technology remain dangerously exposed. State-sponsored adversaries have spent years gaining footholds in these systems, across many sectors, so that they can disrupt them. Defenders of critical infrastructure and the OSS community have decades of security experience but have faced severe resource shortages that are exacerbated by this moment. We are recognizing their expertise in these domains and offering our support. We will also expand the Cyber Mission to release tools, research, and resources in new areas to help secure the world.

As part of Project Glasswing, partners uncovered many vulnerabilities, but we haven’t yet achieved a sufficient reduction in cyber risk. It’s easier than ever to find vulnerabilities, but verifying, prioritizing, and fixing these findings remains challenging. Based on lessons from Project Glasswing, we’re starting these new efforts to support defenders. Earlier this week, we merged Project Glasswing into our expanded Cyber Verification Program, which gives many more defenders access to our most capable models. And through the Anthropic Cyber Mission, we’ll deploy Anthropic engineering talent and provide tools and funding for those who secure critical infrastructure and open-source software.

Defending critical infrastructure

Power grids, water utilities, factories, and transportation networks run on controllers, control software, and industrial networks built to last for decades. These systems are known as “operational technology,” and they often cannot be taken offline to patch, so known vulnerabilities can stay unresolved for years. Securing them is specialized work: the equipment is proprietary, changes are risky, and a mistake can take down a plant. Operators of every size rely on a small set of trusted providers to support that work, telling them what’s exposed and which fixes to make on a running system.

Today, we’re introducing the Critical Infrastructure Defense Program, which brings frontier Claude models, on-site engineers, and our threat research to those trusted providers. Its founding partners are Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC, and Rockwell Automation.

These organizations represent the providers that operators rely on to secure these systems: the consulting and advanced technology companies that run security programs, the security companies that guard the business and industrial networks, and the manufacturers that build and patch the equipment itself.

This work is underway. Several partners are currently working with Claude to fix vulnerabilities and help customers do the same. Critical infrastructure is hard to defend in many ways that AI cannot fix, but we believe that frontier models can help find and repair weaknesses before those weaknesses are used to cut off power or make water unsafe. Our first step is to work with a small cohort of providers to learn which strategies are most effective and practical.

If your company builds security products or services for critical infrastructure, you can register your interest here.

[Quotes from partners including Rockwell Automation, PwC, Palo Alto Networks, Nozomi Networks, Insane Cyber, Dragos, CrowdStrike, Hitachi, Deloitte, Booz Allen, Accenture expressing support and perspectives on the program]

In June, we launched a cyber defense program for state, local, tribal, and territorial governments. Since then, we’ve offered frontier Claude models and technical support to more than half of all US states and some of the country’s largest public critical infrastructure operators, speeding up code scanning and patching, incident response, red teaming, and other security workflows.

We are listening to and learning from the people who know this landscape best. Our approach is to work with the companies, coalitions, governments, and nonprofits that know this landscape and that operators trust, and provide support where it’s most needed.

Securing open-source software

Almost all software relies on open-source code, much of it maintained by small teams of volunteers. Under Project Glasswing, we scanned hundreds of widely used open-source projects, had humans triage and review many of the potential vulnerabilities uncovered, and privately reported what we found to their maintainers through our coordinated vulnerability disclosure process.

Some maintainers with the capacity to triage at scale asked us for everything our models had found in their project, reviewed or not. In response, we’re launching OSS Scanner, an opt-in service inspired by Google’s OSS-Fuzz. Enrolled projects receive periodic scans from our most capable models, free of charge. Each report includes a proof of concept of how the bug could be exploited, an explanation, and a suggested fix where one is available. The reports are model-generated and sent without human review. That means maintainers receive them faster, but it also means that some will contain inaccuracies, such as a wrong severity rating. We expect a true-positive rate above 90%, and will work to improve the true positive rate and fix quality over time. The team’s post explains how it works and how to enroll.

The service is meant for projects with the capacity to keep up with surfaced findings. For others, we will continue to share human-verified disclosures under our CVD policy.

OSS Scanner is a first step. From here, our open-source work aims to:

• Get findings to maintainers faster. Bring OSS Scanner to more projects while keeping human-verified disclosure for those that need it.
• Accelerate fixes. Automate triage and patching, which are still mostly manual, for projects that want it.
• Explore new secure architectures and coding practices. Research and share methods for hardening or rewriting code with projects that want to go further than patching.

We’ll do this based on guidance from open-source maintainers and foundations, and share what works so other projects can replicate it. We funded the organizations behind widely used open-source code, including the Python Software Foundation, Alpha-Omega and OpenSSF through the Linux Foundation, and the Apache Software Foundation, as well as supporting Akrites and Gold Eagle, which collect and coordinate vulnerability reports from many sources to avoid overwhelming maintainers. The Defender Advantage Fund (0xDAF), which we launched in August, supports pilot programs in these areas and keeps OSS Scanner free.

Maintainers can also apply to Claude for Open Source for free Claude Max subscriptions, and to the Cyber Verification Program for expanded access to Claude’s cyber capabilities for defensive work.

Why we're doing this

Highly cyber-capable AI models are widely available to attackers now. But defensive tools—including our own—have not yet reached enough of the defenders who need them. OSS Scanner, our Cyber Verification Program, defensive products our partners build on our platform, and Claude Security are some of our efforts here, and we’ll be adding others as soon as possible.

Our forecast is that in two years, AI will favor defense: it will be easier to catch bugs before they ship, write fundamentally secure software from scratch, and actively defend systems with models. But in the near term, that may not be true. The cost of exploiting vulnerabilities has dropped, while verifying, disclosing, and fixing them is slow and still depends on people. In Glasswing, we often saw months pass between a vulnerability being found and being fixed. With operational technology, a fix may have to wait until it can be applied safely to running machinery—in some rare cases, this might take decades.

Success means critical infrastructure such as water, power, transport, and communications keep running in the face of attacks by capable adversaries, with fewer exploitable paths in and faster recovery when something gets through. This will take years and we expect the Anthropic Cyber Mission to change as we, together with the public and private sector, learn what works.

The path ahead

Over the coming months, we’ll bring the Critical Infrastructure Defense Program to more partners and more sectors, and we’ll share what we learn along the way, including what didn’t work. We also expect other AI developers, security companies, and governments to run efforts of their own, and we’d like to collaborate with them wherever that helps defenders.

We will also expand our work to help secure open source and the broader supply chain. This includes researching new ways of writing software and new ways of defending systems. We intend to share frontier research, tools, and resources to help others secure their software and supply chain.

If you’d like to work with us:

• Companies that build security products or services for critical infrastructure, including security vendors, system integrators, and equipment manufacturers, can register their interest in the Critical Infrastructure Defense Program as we expand it.
• Core maintainers of critical open-source projects can enroll in OSS Scanner.
• Security teams of any size, including operators of critical infrastructure and open-source maintainers, can apply to our expanded Cyber Verification Program for access to our models.

• The Compliance API chat endpoints now also return chats from the unified Claude experience, in beta for Claude Enterprise organizations, with your existing Compliance Access Key. See Retrieve and delete chats, files, and projects.

• The Compliance API can now download Claude Docs documents as Word files, in beta. See Retrieve files and artifacts.

Claude Haiku 5.5 launch

We just launched Claude Haiku 5.5, the cheapest, fastest, and most capable small model we’ve released, designed for high-volume, cost-sensitive tasks. For more information, see our blog post: Claude Haiku 5.5.

Monthly API credits for Max and Team plans

Max and Team plans now include monthly API credits for running your own apps and agents on the Claude Platform. They roll out over a few days. Claim them by linking a Claude Console organization in Settings > Billing (Max) or Organization settings > Billing (Team). Learn more about monthly API credits for Max and Team plans.