Claude Code stopped self-launching /deep-research, and handed dangerous-command adjudication to the auto-mode classifier instead of permission dialogs

anthropics/claude-code·medium signal

Claude Code 2.1.218 changed /deep-research to start only when invoked manually — Claude no longer launches it on its own — and moved the dangerous-rm, background-&, and suspicious-Windows-path checks out of permission dialogs so the auto-mode classifier adjudicates them. Plan mode with auto also stopped prompting for Bash commands the static analyzer can't prove read-only, deferring to the classifier. This is a meaningful shift in where your safety boundary lives: fewer interrupts, but a model judgment now sits where a deterministic prompt used to, so if you relied on those dialogs as your last human checkpoint you need to re-establish it with hooks or permission rules.