Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-09-19 · high
Version 2.1.278 runs shell and network classifier checks on Anthropic's servers for enterprise and platform accounts, and stops billing for them.
Why now: Anthropic published the release on September 19, 2026.
Anthropic released claude-code v2.1.278 on September 19, moving auto mode's safety classifier off the local machine and onto its own servers. The classifier is what checks shell commands and network requests before auto mode runs them unattended.
The change applies to Enterprise plans, Claude API accounts, Claude Platform on AWS, Bedrock, Google Cloud Agent Platform and Microsoft Foundry. On those accounts, the classifier check now runs inside the session's existing server request instead of a separate local call, and Anthropic doesn't charge for the tokens it spends. A new row in /status shows whether the server-side path is active, reading Enabled or Disabled.
Pro, Max and Team plans don't get the notice at all. The free server-side check is scoped to enterprise and platform billing, not rolled out to the tool as a whole.
The fallback is worth tracking if you run Claude Code through a gateway. Anthropic's docs name a specific failure mode: an LLM gateway sitting between the CLI and Anthropic can strip either the safeguards request field or the safeguard_results response field. When that happens, auto mode drops back to the old local classifier, and that path does get billed. Anthropic also documents a manual opt-out, setting CLAUDE_CODE_AUTO_MODE_SERVER=0 forces the local classifier even when the server path is available.
The release note doesn't say why Pro, Max and Team were excluded, or whether server-side checking is coming to them later. For teams running Claude Code through a gateway, the move is checking whether that gateway passes both fields through unmodified. A stripped field reverts billing to the local path without changing anything else about how auto mode behaves.
Each link below shares sources, entities, or timing with this story.
Version 2.1.273 stops a repo-chosen memory directory from loading into the prompt when read access outside the working folder is blocked.
The same release adds a plugin eval command and fixes a permission rule that leaked across Claude Code's settings sources.
The release also adds a command that migrates Python projects off the old anthropic 0.x SDK and stops WebFetch from serving stale content all session.
Version 13.24.0's manifest said one thing, its bundled scripts said another, and the mismatch sent the background worker into a kill and respawn loop on every hook event.
Two of the six hid commands from the approval dialog itself, using tab padding, invisible Unicode, and split Bash strings.
The mirror syncs nightly from Anthropic's internal review queue, and every plugin in it already cleared automated security scanning before listing.
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.