Claude Code v2.1.257 adds a containment escape rule that makes auto mode ask before fetching cloud metadata credentials

anthropics/claude-code GitHub releases·medium signalXBlueskyLinkedInCopy link

The September 1 release makes Claude Fable 5.1 the default Fable model at 1M context, $10/$50 per million tokens with $0.25/Mtok cache reads, and adds a containment escape rule requiring approval in auto mode for cloud metadata-credential fetches, egress evasion and cross-tenant reach. It also adds a one-time prompt before the first file read outside working directories plus a `permissions.blockReadsOutsideWorkingDirectories` setting, and `CLAUDE_CODE_SUBAGENT_MODEL_FORCE` to pin a model across every subagent. That last one is the practical win for anyone running fleets: subagent model choice becomes one env var instead of per-agent config.