Claude Code 2.1.284: Sonnet 5.5 becomes default, auto mode closes the last gap

Claude Code 2.1.284, released September 28, 2026, is a dense release on its own: no backlog of skipped versions this time, just more than eighty entries in one drop. Three things are worth a close read: a new Sonnet model becomes the default on the Anthropic API, auto mode finishes its rollout to every session with no permission mode configured, and three separate fixes close permission and memory gaps. Everything else, mostly reliability and interface work, is summarized below.

Sonnet 5.5 becomes the default Sonnet

Sonnet 5.5 is not a model gated behind a specific plan: it replaces Sonnet 5 as what the sonnet alias resolves to by default on the Anthropic API, so anyone using Claude Code on that API gets it with no configuration change. The model configuration docs confirm the alias switch and spell out the detail that matters most day to day: "On the Anthropic API, Sonnet 5.5 and Sonnet 5 always run with the 1M context window. There is no 200K variant, no [1m] suffix to select, and no usage credits required on any plan." In other words, on the Anthropic API the million-token context window isn't something you opt into with a suffix or pay for in credits: as with Sonnet 5, it's how the model runs natively.

On pricing, the changelog lists $2 and $10 per million tokens for input and output, with cache reads at $0.20 per million. If you bill agent time to a client or track an API budget, check that your cost tracking points at the right model identifier: a default alias switch can move a billing line without you touching a single line of your own code.

Auto mode closes the last gap

Auto mode hands the review of each action to a second model, the classifier, instead of asking you. This digest has tracked the rollout of auto mode as the default starting mode across several recent versions: 2.1.283 extended it to sessions on third-party providers and to sessions with telemetry turned off. 2.1.284 finishes the job with a broader rule, no longer conditioned on plan, provider, or telemetry setting: any terminal or VS Code session that never sets permissions.defaultMode anywhere now starts in auto mode.

The permission modes docs sum up the end state, already dating it to 2.1.283: "With Claude Code v2.1.283 or later, auto mode is the built-in starting permission mode for interactive terminal and VS Code sessions on every plan and provider." This starting point still depends on the session's model: Opus 4.6 or later, Sonnet 4.6 or later, or a Fable model on the Anthropic API, and only Sonnet 5 or later, Opus 4.7 or later, and Fable models elsewhere (Bedrock, Google Cloud's Agent Platform, Microsoft Foundry). A session on an older model still starts in Manual mode with nothing for you to do. claude -p runs and the Agent SDK are still unaffected, they always start in Manual mode. If you want to keep control everywhere, the fix hasn't changed: set permissions.defaultMode explicitly in your user, project, or managed settings instead of relying on the old implicit default.

Three permission and memory gaps closed

Three separate fixes share the same shape: a security rule that existed on paper but didn't apply as intended in practice.

The first is about plugins. A plugin installed from a marketplace, claude.ai, or npm could pre-approve its own tools through the allowed-tools field, even under the managed allowManagedPermissionRulesOnly lock that exists precisely to stop that kind of self-approval. Now, only plugins from an official Anthropic source, or a source an organization's managed settings explicitly vouch for, keep that pre-approval right; everything else goes through normal review. The plugin trust docs restate the underlying reason this mattered: "Whatever the tier, a plugin you install can run code with your user privileges." A third-party plugin that could approve itself was effectively deciding on its own how far it was allowed to go.

The second touches .claude/rules/. Rules linked in through a symlink pointing outside the project were skipped without the external-imports approval prompt ever showing up. The memory docs describe the mechanism at play: a symlink whose target sits outside the working directory is treated as an external import, and the linked rules only load once external imports are approved for the project. With no prompt to approve them, those rules silently stayed inactive. 2.1.284 now shows that prompt, and also asks for it when the whole .claude directory is a symlink from outside the project.

The third is about auto memory. Claude Code now neutralizes invisible characters and tags that imitate its own internal markup inside MEMORY.md and in recalled memory notes, before they reach the model. It's a defense against prompt injection through a channel people rarely think about: a file Claude wrote itself, that nobody reads line by line before it comes back into context the next session.

Everything else, briefly

• Model that used to drift: the Explore subagent no longer switches to Opus when the session runs on a model ID Claude Code doesn't recognize, for example behind a custom proxy; it now inherits the session's own model.
• Compaction that now cascades: a "Prompt is too long" error that persisted after one compaction now triggers a second pass that keeps less recent conversation, instead of failing again.
• /loop in self-paced mode: status updates, previously often written only into Claude's reasoning and invisible, now show up as visible text, along with the reason the loop stopped.
• /mcp reconnect all retries every MCP server that failed to connect or needs authentication, in one command.
• Faster startup: Claude Code now builds only the parts of the settings schema your files actually use, cutting startup time and memory use.
• Ultracode toggle: Ultracode moves out of the /effort slider into its own switch (/effort ultracode [on|off]); it no longer forces xhigh effort and stays on at any effort level.
• Gateway spend: /usage and the status line now show dollar amounts for the Claude apps gateway spend limit, when the gateway runs this version or later.

What to take away

Two structural changes, and nothing you need to do to get either: Sonnet 5.5 becomes the Anthropic API default with its native million-token context, and auto mode becomes the starting point for any terminal or VS Code session that never set a permission mode, on every plan and provider. Check permissions.defaultMode if you want to keep Manual mode by default. The three security fixes are quieter but follow the same thread as recent versions in this digest: closing, one by one, the places where a permission rule existed on paper without actually applying. If you run third-party plugins with allowed-tools, share rules through symlinks, or rely on auto memory in a multi-contributor project, these three lines are worth reading twice.