Claude Code 2.1.271-272: auto mode tightens its security checks

Claude Code 2.1.271, released September 14, 2026, tightens auto mode on three fronts at once: shell commands launched by a skill or slash command, how a subagent's work reports back to its caller, and network access granted per command. Alongside that, four separate gaps in Bash permission checks get closed in one release, and the Monitor tool loses its no-timeout wait option. 2.1.272, released the next day, ships only reliability fixes with no detail published in the official changelog. Here is what actually changes if you run in auto mode.

A skill's shell commands now follow default-mode rules instead of the classifier

In auto mode, a second model, the classifier, approves or blocks most actions on your behalf, as the permission modes doc puts it: "In Manual mode, Claude Code stops and asks you before most actions... In auto mode, a second model, the classifier, reviews actions instead of you." Until now, inline shell commands run with ! inside a skill or slash command took that same path, like any other command.

2.1.271 changes that: these commands now go through default-mode permission rules instead, the allow, ask and deny rules you set yourself. A command no rule explicitly covers becomes a normally reviewed tool call again, rather than something left to the classifier's per-case judgment. If you maintain skills with embedded shell commands, their behavior in auto mode becomes predictable and rule-driven instead of depending on a case-by-case model call.

Subagent hand-back now goes through a dedicated call the classifier reviews

The permission modes doc lists three checkpoints for a subagent running in auto mode: before it starts, during each of its actions, and at the end, when "the classifier reviews its full action history." That third checkpoint is what 2.1.271 changes: instead of reviewing the subagent's last message after the fact to catch a problem, hand-back now goes through a dedicated call the classifier examines directly.

The difference matters: a post-hoc review of the last message can miss a problematic action if the final summary does not surface it clearly. A dedicated hand-back call gives the classifier an explicit checkpoint, built for exactly that moment, right when a subagent's work returns into your conversation.

Per-command allowed_domains: finer network control under sandboxing

In auto mode with the Bash sandbox, network access already follows a strict rule: "The first time a command needs a new domain, Claude Code prompts for approval, or in auto mode sends the request to the classifier." The gap 2.1.271 closes is that this approval then held for the whole session: a domain opened for one command stayed open for the ones after it.

The new per-command allowed_domains setting for Bash, PowerShell and Monitor changes that granularity: the domains a command needs are reviewed alongside it and opened for that command alone, everything else stays refused. When a one-off task needs to reach an external service, that access no longer lingers for the rest of the session.

Four Bash permission-check gaps closed in one release

The same version fixes four distinct blind spots in how Claude Code reads a Bash command before deciding whether it needs a permission prompt:

• a file read by fmt, column and similar commands could escape the check when it followed an option the checker did not recognize;
• a file reached through a wildcard expansion in a command's pattern or option value, such as grep -v dir/* file, could skip the same check;
• shell variable declaration flags could misrepresent to the checker the command actually being run;
• a Bash command combining two directory changes, a subshell, or a cd+git chain could skip the confirmation prompt expected under permissions.blockReadsOutsideWorkingDirectories, in both bypass and auto mode.

Taken individually, these are edge cases. Together, they are four ways a command could do more than a surface reading suggested, without triggering the check meant to catch it. If you rely on blockReadsOutsideWorkingDirectories or write wildcard-heavy commands, this release closes a real gap.

Monitor capped at 30 minutes, the persistent option is gone

The Monitor tool used to support long-running waits with a no-timeout persistent option. 2.1.271 removes it: "Every watch Claude starts has a deadline: 5 minutes by default, at most 30 minutes, and at most 10 minutes in a non-interactive run given a single prompt with -p." At the deadline, the watch ends and Claude gets a single notice, so it can start the watch again if it is still needed.

If you had a long-running watch set to persistent, say to track a slow deployment or a CI job that drags on, you now need to rely on that notice, and on Claude re-arming the watch, rather than one continuous wait.

Everything else, briefly

• Fast mode (/fast) now works in Claude Code Remote sessions, both cloud and self-hosted runners, following the host's fast-mode setting or what you type in the session.
• /config in fullscreen gains mouse support: the wheel scrolls, a click changes a setting's value.
• omitClaudeMd in a custom or plugin agent's frontmatter lets it run without loading CLAUDE.md files, while still respecting managed policy files.
• --accept-command <sha256> joins claude plugin install and claude plugin update: you accept exactly the command a previous --json run displayed, instead of a blind -y.
• /resume and /teleport no longer keep the previous conversation's file-read tracking, which let Claude edit files the resumed conversation had never opened.
• Markdown artifacts now render as styled document pages, with a title header and syntax-highlighted code.
• The number of artifacts a session can watch for republishes goes from 5 to 10.
• VS Code fixes several bugs in the Hooks and permission-rule dialogs, including saves that looked like they failed when they actually succeeded.
• Claude Tag no longer loses an active channel's working context about once an hour when the conversation mostly happens in threads, and resumes watching a pull request after a restart in the same thread.
• Code Review no longer posts the same finding two or three times, and no longer re-raises a security finding you already resolved when a later push moves the lines it was anchored to.
• Windows: PowerShell commands that failed with "Exit code 1" and no output, when the session's temp output path reached 260 characters, work again.
• The default dynamic workflow size drops on Pro plans, and the medium-size guideline goes from 15 down to 10 agents.

What actually matters here

If you run in auto mode daily, the first three changes in this release all point the same way: fewer gray areas left to the classifier's judgment, more explicit checkpoints, whether that is a skill's shell command, a subagent's hand-back, or a network domain opened for one command instead of the whole session. The four Bash permission fixes matter most if you use blockReadsOutsideWorkingDirectories or write commands built with wildcards and subshells. And if one of your workflows relied on a persistent Monitor watch, you now need to work around a 30-minute cap instead.