Claude Code 2.1.281: ctrl+enter changes meaning, auto mode watches more

2.1.281 of Claude Code, released September 23, 2026, is a flood of a release: over a hundred fixes and improvements in one go. Most concern session resume, proxies and the interface, and need nothing from you. Three changes stand out because they touch reflexes or safeguards you rely on without thinking about them: the shortcut that used to throw away a running turn now does something else, auto mode widens what it sends to server-side review, and two real security bugs around rm and permission rules get closed.

Ctrl+enter no longer cancels, it backgrounds

Until now, pressing ctrl+enter (or ctrl+x ctrl+s) while tools were still running would cancel the current turn to send your new message right away. As of 2.1.281, the same shortcut instead moves the running tools to the background rather than cancelling them: the work keeps going on its own, and your message still gets sent.

That is a change of meaning, not a minor tweak. If ctrl+enter was your quick stop button while a tool was mid-run, that reflex no longer does the same thing: the running command doesn't stop anymore, it keeps going in the background while you move on. To actually interrupt a turn, the key stays Escape, documented in the interactive mode guide as the way to stop Claude immediately. If you relied on ctrl+enter to cut off a command heading in the wrong direction, make sure you're reaching for Escape now.

Auto mode now reviews read-only commands too

Auto mode hands off approval to a classifier instead of you. Until now, the docs were explicit about what skipped that check: "Read-only actions and file edits in your working directory are auto-approved, except writes to protected paths." Reads didn't wait for the classifier, and according to the changelog neither did sandboxed commands, which kept auto mode fast on the actions that carried the least risk.

2.1.281 changes that rule, but only where classifier review runs server-side: on Enterprise plans, the direct Claude API, Claude Platform on AWS, Bedrock, Vertex, Foundry, and behind certain gateways. On those accounts, read-only and sandboxed commands now also wait for that review, and get blocked when the classifier flags them. In practice that means a bit more latency on actions that used to fly through unchecked, in exchange for a wider net: a read-only or sandboxed command is no longer approved by default, and the classifier can block it. On Pro, Max and Team, where server-side review doesn't apply the same way, this change is invisible.

Two security bugs closed: rm and permission rules

The first is a precise auto mode bypass on recursive deletes. An rm -rf "$(pwd)", or more generally any deletion whose target comes only from command substitution, could run unprompted in auto mode and --dangerously-skip-permissions. 2.1.281 now forces a confirmation prompt in that case, even when a Bash allow rule covers the command, unless you explicitly turn that safeguard off with CLAUDE_CODE_DISABLE_SUBSTITUTION_RM_PROMPT=1. In those two modes, the dangerous rm prompt also stops waiting forever: after two minutes without an answer, the command is denied with a rewrite hint so unattended sessions keep going (CLAUDE_CODE_DISABLE_DANGEROUS_RM_TIMEOUT=1 turns the timeout off). The dangerous-deletion detection itself is also wider now: it flags a removal targeting a shell variable followed by a top-level directory name, a variable derived from the current working directory, or a target that is backslash-only.

The second bug sat in the permission rule engine itself. A rule containing a NUL byte was expanded into a wildcard match. The permissions guide describes a rule syntax meant to match a specific pattern: this bug made a rule cover far more than intended the moment a NUL byte slipped into it, whether by accident or through deliberately crafted input. Such a rule now matches nothing.

In the same vein, an interface bug: in /permissions, the 1 key answered "yes" to delete and remove-directory confirmations even while the cursor sat on "no," so a held 1 could remove one working directory after another without a real confirmation. The 1 key no longer answers "yes" in that case.

Everything else, briefly

• "attribution": false in settings.json hides all commit and pull request attribution with a single key, described in the settings reference. Older Claude Code versions skip any settings file carrying that key, so keep the object form (attribution.commit, attribution.pr) if you share settings across versions.
• Self-hosted runners now receive their system prompt through a private file instead of a command-line argument, which avoids launch failures on very long prompts. Direct consequence: a wrapper or command hook that appended --system-prompt or --append-system-prompt needs to switch to --system-prompt-file or --append-system-prompt-file.
• Sandbox on macOS: when a local dev server can't bind a port, Claude now points straight at the sandbox.network.allowLocalBinding setting.
• CLAUDE_CODE_AUTO_MODE_SERVER now also applies on a direct connection to the Anthropic API, with 0 to opt out of the server-side classifier and 1 to opt in.
• A long list of session-resume fixes: a broken prompt cache after resuming during a pending permission prompt, very large sessions restoring only their last few messages, and sessions that ended mid tool call, where Claude now sees the call and is told its outcome is unknown. None of it changes a habit, but it's a real reliability gain if you resume long sessions often.

What to take away

The change most likely to catch you off guard is the first one: if ctrl+enter was part of your reflexes for cutting a command short, it no longer does that, and Escape is what you need now. The more watchful auto mode on read-only commands only applies to accounts where review runs server-side, trading a bit of latency for a wider safety net. The two security fixes on rm and permission rules are worth reading even if they change nothing about your daily use: they're exactly the kind of gap you only notice after the fact.