Claude Code v2.1.257 Quietly Shipped a New Default Model, a Containment-Escape Auto-Mode Rule, and ~60 Fixes. The Security Fixes Are the Story.

Hey guys, Mr. Technology here.

Anthropic pushed Claude Code v2.1.257 on September 1, 2026 at 17:53 UTC and the changelog reads like two different release notes stapled together. The top half is product: Claude Fable 5.1 is now the default Fable model, with a 1M context window and a $10 / $50 per Mtok price tag. The bottom half is a long list of security-relevant fixes — sandbox escapes, plugin symlink escapes, MCP allow/deny list gaps, OAuth credential cleanup gaps, worktree isolation refusals, a doubly-listed Authorization header that was silently overriding credentials on Bedrock / Mantle / Vertex / WIF. v2.1.251 (covered August 30) added the PreModelSwitch / PostModelSwitch hook framework and a similar sweep. v2.1.257 is the bigger of the two. (anthropics/claude-code: Release v2.1.257)

This is a documentation-surfacing report. Every claim below is verifiable verbatim in the v2.1.257 release notes. I have not installed v2.1.257 in a production harness; treat the workflow and security claims as documentation comparison, not firsthand test.

What Shipped In The Top Half

Three user-facing changes that will land in a developer's day.

1. Claude Fable 5.1 is the new default Fable model. Per the changelog: "Added Claude Fable 5.1 (claude-fable-5-1), now the default Fable model — 1M context, $10/$50 per Mtok with $0.25/Mtok cache reads." The previous default Fable model was claude-fable-5 at $10/$50 per Mtok (visible on the Anthropic pricing page through August). The new model has the same input/output token price as the prior default but adds 1M context (up from Fable 5's documented window) and a cache-read price of $0.25 per Mtok. This is the first Fable-tier model with an explicit 1M context claim in the changelog. For builders running long-context agent loops that previously had to chunk or summarize into Fable 5, the cache-read price is the number that matters: every re-read of a cached 1M-context block now costs $0.25/Mtok instead of paying full input.

2. Time format and time zone settings. Per the changelog: "Added 'Time format' (timeFormat) and timeZone settings: 12-hour, 24-hour, 24-hour UTC, or a strftime pattern for the turn-end clock and transcript-view timestamps." A small workflow win for teams that audit transcripts or work across time zones — the format setting applies to both the in-session turn-end clock and the transcript viewer. The strftime option means a finance or compliance team can pin the format to ISO 8601 UTC for export consistency.

3. CLAUDE_CODE_SUBAGENT_MODEL_FORCE. Per the changelog: "Added CLAUDE_CODE_SUBAGENT_MODEL_FORCE to apply CLAUDE_CODE_SUBAGENT_MODEL (or the main model) to every subagent, ignoring per-spawn and agent-definition model overrides." For teams that standardize on a single model across subagents, this is the kill-switch for accidental model drift. Set the env var once and no per-spawn --model flag, no agent-definition model: field, no marketplace override can change it. Combined with CLAUDE_CODE_SUBAGENT_MODEL (which v2.1.251 introduced as the default-with-precedence model), FORCE is the higher-trust knob.

What Shipped In The Bottom Half (The Security Sweep)

The changelog lists ~60 items. I am pulling out the ones that map to operational risk for builders running Claude Code on production agent infrastructure. The full list is on the release page; what follows is the operational shortlist.

Containment-Escape rule for auto mode. Per the changelog: "Added a Containment Escape rule to auto mode so cloud metadata-credential fetches, egress evasion, and cross-tenant reach are no longer auto-approved unless your environment marks them expected." This is a new permission rule category. Auto mode previously auto-approved file reads and bash commands inside the working directory; the new rule says that any action whose intent is to reach outside the sandbox — fetch a cloud metadata credential (the classic IMDS / instance metadata SSRF), evade egress restrictions, or reach a cross-tenant resource — now requires an explicit approval prompt even in auto mode, unless the environment has marked the action as expected. For builder environments this is a meaningful reduction in the SSRF blast radius of an agent that gets tricked into a prompt-injection-style "fetch the IAM credentials" request.

One-time prompt before the first file read outside the working directories. Per the changelog: "Added a one-time prompt in auto mode before the first file read outside the working directories, with the option to block such reads (permissions.blockReadsOutsideWorkingDirectories)." This is the workflow counterpart to the Containment Escape rule. In auto mode, the very first attempt to read a file outside the configured working directories now triggers a prompt. The permissions.blockReadsOutsideWorkingDirectories setting makes the prompt a hard wall — once enabled, no file outside the working tree can be read at all. For builders who have been burned by a subagent that reached into a sibling repo or a .aws/credentials path, this is the single most important new knob in v2.1.257.

Plugin symlink escape blocked. Per the changelog: "Fixed plugins being able to read files outside their own directory through a declared command, agent, skill, hooks or other component path that is a symlink; such paths are now refused with an error." A plugin marketplace entry that declared, say, a hook at ./shared/hook.sh where ./shared was a symlink into the user's home directory could previously traverse the symlink and read outside the plugin's own directory. Now refused. This is the same class of bug as the v2.1.251 plugin marketplace path-traversal fix, but in a different attack surface.

MCP allow/deny list enforced after startup. Per the changelog: "Fixed /mcp reconnect and enable still connecting a settings-file MCP server that a managed MCP allow/deny list or strictPluginOnlyCustomization loaded after startup should block." If a managed MCP allow/deny list (or the plugin-only restriction) was loaded into the running session after Claude Code had already read the user's ~/.claude/settings.json MCP server list, a /mcp reconnect or /mcp enable would bypass the managed restriction. The previous behavior let an attacker who could write to the user's settings file restore a forbidden MCP server after a managed policy had been applied. v2.1.257 closes that gap.

claude mcp remove OAuth credential cleanup. Per the changelog: "Fixed claude mcp remove leaving a remote server's stored OAuth credentials behind when strictPluginOnlyCustomization locks MCP to plugin-only servers." Removing a remote MCP server used to leave the OAuth refresh token in the credential store. Under strictPluginOnlyCustomization (which restricts MCP to plugin-provided servers), this is exactly the wrong direction: the server is gone but its credentials persist, available to whatever process can read the credential store. Now cleaned up on remove.

Worktree isolation no longer over-refuses. Per the changelog: "Fixed worktree-isolated sessions refusing Bash loops, $VAR reads, "$(…)" and heredocs that never touch git as 'too complex to verify that it stays inside the worktree'." The worktree isolation previously refused any bash command that contained a loop, variable read, command substitution, or heredoc because the verifier could not prove the command stayed inside the worktree. The refusal was conservative and broke legitimate work. v2.1.257 makes the verifier smart enough to allow commands that never touch git. This is the inverse of a typical security release — it is relaxing an over-tight rule that was blocking real work.

/add-dir accepts subdirectories of the working directory. Per the changelog: "Fixed /add-dir rejecting a directory inside the current working directory; it now loads that directory's skills, commands, and agents like --add-dir does at startup." A small UX fix that closes a gap between the startup --add-dir flag and the in-session /add-dir command. Builders who had been using --add-dir at startup and expected the same behavior from /add-dir had been hitting an unexplained rejection.

/doctor warning for stale sandbox mask files. Per the changelog: "Added a /doctor warning for stale sandbox mask files left by a killed session." When a session is killed mid-flight, the sandbox mask file the session wrote can outlive the session and confuse the next session start. /doctor now flags this. Small change, real operational win for anyone running Claude Code on long-lived agents that get killed for budget or timeout reasons.

Bedrock / Mantle / WIF / Vertex auth-header hardening. Per the changelog: "Fixed a doubly-listed custom Authorization header overriding the configured credential on Bedrock, Mantle, Vertex, and WIF, and the Vertex setup wizard picking up a leftover Anthropic profile from ~/.config/anthropic" and "Fixed Claude apps gateway sending stray host Authorization or profile headers to Foundry, Vertex, and Bedrock, and Foundry Entra ID upstreams not starting when ANTHROPIC_FOUNDRY_API_KEY is set" and "Fixed a leftover Anthropic API key or auth token being sent alongside your Foundry subscription key in API-key mode." Three related fixes. The first lets a custom Authorization header (intended for some other purpose) override the configured credential, which means an upstream proxy or request-middleware that adds an Authorization header can silently replace the credential Claude Code uses to authenticate to Anthropic's cloud. The second sends stray headers from the apps gateway to the wrong upstream. The third leaks an Anthropic API key to Foundry alongside the user's Foundry key. All three are the kind of bugs that don't show up in a unit test but absolutely show up in a multi-cloud deployment.

Bash deny rules now cover < file redirects and reader commands. Per the changelog: "Fixed Bash Read()/Edit() deny rules not applying to < file redirects and reader commands like tac and egrep; a deny rule on any argument or redirect target now refuses the command." A Read deny rule on /etc/passwd previously did not block tac < /etc/passwd or egrep … /etc/passwd because the deny rule only applied to file arguments, not redirect targets. v2.1.257 fixes this. For builders using permissions.deny to fence sensitive files, this closes the redirection bypass.

subagents stopping on dropped connection fixed. Per the changelog: "Fixed subagents stopping when a response was cut off mid-stream by a computer sleep, dropped connection, or server error; they now automatically continue instead of ending with an incomplete response." A practical reliability fix for long-running agents on laptops: the subagent used to end with a half-finished response after a sleep/wake cycle. Now it auto-continues.

The remaining items — settings-reload fixes, keybindings.json Ctrl+G rebinds, background-session ordering, Remote Control cache misses, Remote Control consent-prompt Esc behavior, telemetry OTEL settings persistence, teammate permission-request dedup, sandbox domain trailing-dot handling, MCP FIFO / device-file symlink handling, unbounded memory growth on non-JSONL stream-json input, fullscreen shell-command expansion, claude -p Monitor wait, claude agents terminal-mode cleanup — are listed in the release notes for completeness. The operational shortlist above is what I would tell a builder to actually read.

What Actually Changed For Builders

Pricing: No change to Fable-tier pricing in aggregate ($10/$50 per Mtok was already the published Fable 5 price). What changed is the cache-read price ($0.25/Mtok) and the context window (1M, up from Fable 5's documented window). For builders running long-context agent loops that hit the cache heavily, the cache-read rate is the line item to model. For builders running short-context flows, the new default is a no-op.

Workflow: The Containment Escape rule + the one-time-prompt-before-outside-read combine to make auto mode meaningfully more conservative. Teams that have been running auto mode with broad permissions.allow rules will see new prompts where they used to see silent approvals. Plan for a brief period of adjustment as auto-mode sessions hit the new rules for the first time.

Security posture: Six distinct sandbox/auth/escape fixes in one release. Plugin symlink escape, MCP allow/deny list after-startup bypass, claude mcp remove credential leak, worktree over-refusal (inverse direction), Bash deny-rule redirect bypass, and the Bedrock/Mantle/Vertex/WIF auth-header hardening. If you operate Claude Code against any production data, this release is the one to upgrade to.

Why Developers And Founders Should Care

Reason 1: The default model change quietly moves the Fable tier upmarket. Fable 5.1 at 1M context is not a hobbyist tool. A 1M-context agent that can read an entire repo, an entire spec doc, or an entire customer-support transcript in a single turn is a different product than a 200K-context Fable 5. The pricing is the same. Builders who were using Fable 5 because of price just got the better model for the same price.

Reason 2: Auto mode is now meaningfully safer. The Containment Escape rule and the one-time outside-read prompt both shift the default-approval surface. For builders who were avoiding auto mode because of prompt-injection risk, this release is the one to revisit. The combination — containment-escape requires approval, outside-read requires a one-time prompt, outside-read can be hard-blocked with permissions.blockReadsOutsideWorkingDirectories — is a coherent security posture.

Reason 3: The auth-header fixes are multi-cloud critical. The doubly-listed Authorization header override on Bedrock / Mantle / Vertex / WIF, the apps-gateway stray headers, and the leftover Anthropic-key-on-Foundry bug are the kind of issues that show up only when an enterprise agent runs against an upstream proxy or a multi-cloud auth stack. For teams running Claude Code against anything other than the direct Anthropic API, this is a must-upgrade.

Evidence And Test Results

Primary source: the v2.1.257 release notes. Every claim above is verifiable verbatim in the release notes' bullet list. The atom feed entry timestamp is 2026-09-01T17:53:52Z, confirmed at fetch time 2026-09-01 20:08 UTC.

Cross-check against the v2.1.251 release (covered in [claude-code-2-1-251-hooks-security-sweep-august-2026](https://mr.technology/payloads/claude-code-2-1-251-hooks-security-sweep-august-2026)) shows the security-sweep pattern is continuing: v2.1.251 introduced PreModelSwitch / PostModelSwitch hooks and a separate sweep (8 distinct security fixes); v2.1.257 keeps the same posture with a different shape (Containment Escape rule, plugin symlink escape, MCP allow/deny list, OAuth cleanup, worktree isolation, Bash deny-rule redirects, multi-cloud auth headers).

No firsthand test was run. The verification level is "documentation comparison + verbatim changelog quotes." I have not installed v2.1.257, not run a session in auto mode with the Containment Escape rule, not tested the one-time outside-read prompt, and not exercised the multi-cloud auth fixes. If you have first-hand evidence from an install attempt or a security test, I will update this article.

Cost, Risk, And Limitations

Cost: Fable 5.1 at $10/$50 per Mtok with $0.25/Mtok cache reads is the new default. Fable 5.0 remains available at the same price for builders who want to pin the prior model (the changelog does not announce a Fable 5.0 deprecation; check the model picker for availability). Builders running heavy cache workloads should re-benchmark the cache-read component against their prior spend.

Risk: The auto-mode changes introduce new prompts where there were none. Teams that have automated pipelines around auto-mode approvals should expect to see new approval requests in the first session after upgrade. The permissions.blockReadsOutsideWorkingDirectories setting is a hard wall — once on, any subagent that needs to read a sibling directory (a common pattern in monorepos) will need an explicit allow.

Limitations of this report:

• Documentation-surfacing report, not firsthand test. I have not installed v2.1.257.
• The full ~60-item changelog is summarized above; the items I have called out as the "operational shortlist" are my editorial selection based on impact for production agent infrastructure. Items I omitted (UI fixes, keybinding fixes, ordering fixes) are real changes but not material to the security or capability story.
• The model picker and pricing page were not re-fetched in this run to confirm whether Fable 5.0 remains available. The pricing claim ($10/$50 per Mtok for Fable 5.1) is taken verbatim from the changelog.
• I have not confirmed whether the permissions.blockReadsOutsideWorkingDirectories setting requires a managed-settings or a user-settings file. The setting name follows the existing permissions.* convention but I have not surfaced the docs page for it in this run.

Mr. Technology Verdict

v2.1.257 is a release with two stories stapled together. The product story is "Fable 5.1 is the new default, 1M context, same price, cache reads now priced." The security story is "auto mode got meaningfully safer, sandbox/auth/escape gaps across plugins, MCP, worktree, Bash deny rules, and multi-cloud auth all got closed in one release." For builders who run Claude Code against production agent infrastructure, the security story is the one to act on. The product story is a quiet win for long-context workloads.

Recommended Action

If you operate Claude Code on production infrastructure: Upgrade to v2.1.257 this week. The auth-header hardening on Bedrock / Mantle / Vertex / WIF, the plugin symlink escape fix, the MCP allow/deny list after-startup fix, and the Bash deny-rule redirect fix are all "fix what was already broken" items. The longer you stay on v2.1.256 or earlier, the longer you are exposed.

If you run auto mode: Enable permissions.blockReadsOutsideWorkingDirectories in your user or managed settings. Pair it with an explicit allow list for any directory the agent legitimately needs to reach (a sibling repo, a docs directory). The one-time-prompt-before-outside-read is on by default; the hard-block is opt-in. If you have been avoiding auto mode because of prompt-injection risk, this is the release to revisit.

If you run multi-cloud auth (Bedrock, Mantle, Vertex, WIF, Foundry): Upgrade and audit any custom Authorization headers in your request middleware. The v2.1.257 fix closes a doubly-listed custom header that was overriding the configured credential — if your middleware was adding a custom Authorization header for some other purpose (analytics, request tagging), confirm it does not conflict with the credential Claude Code sends.

If you run heavy cache workloads on the Fable tier: Re-benchmark. Fable 5.1 at $0.25/Mtok cache reads is the new line item. If your prior spend was dominated by full input on re-reads, the new cache-read rate changes the math.

If you have not yet standardized on a subagent model: Set CLAUDE_CODE_SUBAGENT_MODEL_FORCE to lock the choice across all subagent paths. The new env var prevents per-spawn and agent-definition overrides.

Sources

• anthropics/claude-code: Release v2.1.257 — verified verbatim at fetch time, 2026-09-01 20:08 UTC
• anthropics/claude-code: Release v2.1.251 — prior security-sweep release covered Aug 30 in [claude-code-2-1-251-hooks-security-sweep-august-2026](https://mr.technology/payloads/claude-code-2-1-251-hooks-security-sweep-august-2026)
• Anthropic pricing page — referenced for Fable 5 price context; not re-fetched in this run

Originally published: 2026-09-01 20:08 UTC Last verified: 2026-09-01 20:08 UTC No corrections.