Claude Code 2.1.283: auto mode default everywhere, cmd no longer bypasses Remove-Item

Claude Code 2.1.283, released September 25, 2026, changes something most users never had to configure themselves: the permission mode a session starts in. Previously the built-in default only on Pro, Max, and Team plans, auto mode is now the starting point everywhere, including Enterprise, direct API accounts, and third-party providers. Alongside that, a real Windows security hole gets closed: PowerShell let cmd delete a drive root in cases where Remove-Item already refused to. Everything else, more than eighty entries that are mostly reliability and interface fixes, is summarized in a list further down.

Auto mode becomes the starting point everywhere

The permission modes doc is direct about what 2.1.283 changes: "With Claude Code v2.1.283 or later, auto mode is the built-in starting permission mode for interactive terminal and VS Code sessions on every plan and provider. On earlier versions, it's the built-in starting permission mode only on Pro, Max, and Team plans." In practice, if you start a terminal or VS Code session without setting permissions.defaultMode in any settings file, it now starts in auto mode, whether it runs on the Anthropic API, Claude Platform on AWS, Amazon Bedrock, Google Cloud's Agent Platform, or Microsoft Foundry. Before this release, that automatic starting point only applied to sessions fetching feature flags on Pro, Max, and Team; everything else defaulted to Manual mode.

This only changes the starting point, not settings you've already configured: the changelog is explicit that permissions.defaultMode still wins wherever it's set, and the settings reference covers the precedence between user, project, and managed settings. If your organization already pins a default mode, nothing changes for you. The switch only affects sessions that never set anything, which mainly means Enterprise accounts, API accounts, and third-party providers that were used to Manual mode by default. claude -p runs and the Agent SDK aren't affected: they still start in Manual mode.

Auto mode still requires a supported model: Opus 4.6 or later, Sonnet 4.6 or later, or a Fable model on the Anthropic API and Claude Platform on AWS, and only Sonnet 5, Opus 4.7 or later, and Fable models on Bedrock, Google Cloud's Agent Platform, Microsoft Foundry, and signed-in Claude apps gateway sessions. A session on an older model still starts in Manual automatically, no action needed. The first time one of your sessions starts in auto mode through this mechanism, Claude Code shows a one-time notice linking to the docs, once per interface. If you want Manual mode as your default, especially on shared accounts, the fix is straightforward: set permissions.defaultMode explicitly in ~/.claude/settings.json or in your organization's managed settings instead of relying on the old implicit behavior.

PowerShell: cmd no longer bypasses Remove-Item's protections

On Windows, Claude Code's PowerShell tool already runs separate checks on Remove-Item: it refuses, without even asking, deletions targeting the filesystem root, drive roots and their top-level folders, and your home directory. The gap was that those checks only applied to Remove-Item. Nothing stopped Claude from reaching the same result through cmd's built-in commands instead: rd, rmdir, del, or erase, run via cmd /c.

2.1.283 extends the same rule to those commands. The critical paths doc spells it out: "The system-paths case also applies to rd, rmdir, del, and erase when Claude runs them through cmd, as in cmd /c rd /s /q C:\Users. By default, Claude Code denies such a command in every mode, without asking you. This cmd check requires Claude Code v2.1.283 or later." The denial holds across every mode, including bypassPermissions, which the docs confirm elsewhere for the equivalent Remove-Item denials. Detection also covers less obvious cases: a PowerShell variable placed after literal text is treated as empty, so cmd /c rd /s /q "C:\$name" reads as a deletion of C:\ and gets denied; a trailing wildcard counts as the folder it would empty, so cmd /c del /q C:\* is blocked while cmd /c del /q dist\* inside your project isn't.

An environment variable, CLAUDE_CODE_DISABLE_POWERSHELL_CMD_RM_DENY=1, turns off specifically this cmd check if you need to, but the Remove-Item denial itself stays in force regardless. If you run Claude Code on Windows with the PowerShell tool enabled, this fix closes a real bypass: until now, a model that should have been stopped on a dangerous deletion could get the same result through a side door.

Everything else, in short

• Model access controls: two new managed settings, availableModelsMatch: "exact", which locks availableModels to one specific model version instead of its whole family, and deniedModels, which blocks specific models even when availableModels would otherwise allow them.
• /doctor prompt-audit (also /checkup prompt-audit) audits your CLAUDE.md files, skills, agents, and commands for prompting patterns written for older models.
• Plugin uninstall: when two installed plugins have ids that differ only by case, claude plugin uninstall no longer removes the other plugin, along with its options and secrets, instead of the one you named.
• /context now counts MCP server instructions in the displayed total, on their own row.
• MCP tool outputs: an image an MCP tool returns is now also saved to a file, so Bash, Read, and other tools can open it afterward.
• Dynamic workflows: a workflow started during a model fallback no longer runs every agent on the fallback model instead of retrying the configured one.
• The claude-ai name is usable again for a skill, command, workflow, or an MCP server's skills and prompts: the reservation introduced in 2.1.282 is reverted, and Skill(claude-ai:*) is back to being an ordinary prefix rule.
• Managed sandbox: a managed sandbox block is no longer ignored entirely when one nested value is invalid; the bad value now fails closed and the rest of the block still applies.
• Code Review: an @claude review request that used to go silent when GitHub failed to return the pull request is now retried once automatically, with an explanatory comment if it still fails.

What to take away

The biggest change is the first one: if you run Claude Code sessions on an Enterprise plan, a direct API account, or behind Bedrock, Vertex, or Foundry, and never touched permissions.defaultMode, your next terminal or VS Code sessions will start in auto mode instead of Manual. That's not a security regression, auto mode keeps its own safeguards, but it is a habit change if you counted on Manual mode by default to review every action yourself. Check your setting if you want to keep control. The PowerShell fix is worth reading even if it doesn't change your daily routine: it's exactly the kind of bypass you only find out about after the fact, and it's closed without any action needed on your end.