Claude Code 2.1.296: Claude in Chrome stops skipping permissions after @browser

Claude Code 2.1.296, released on October 9, 2026, adds nine improvements and fifty-six bug fixes on top of its features and changes, many of them aimed at hooks, plugins and mods, Windows, cloud sessions, or Claude Tag in Slack. Only one item touches a security habit directly, and only if you code with the browser connected inside VS Code: the guardrail that made Claude in Chrome ask before acting dropped as soon as you typed @browser. Beyond that, what matters most to you is a price cut on Sonnet 5.5 cache reads and an MCP cap that quietly doubled.

Claude in Chrome asks again, even after @browser

The Claude in Chrome docs spell it out: in a VS Code session connected to the browser from the start because "Enabled by default" is on, Claude asks for confirmation before acting on a site you haven't allowed, in Manual, Edit automatically, Auto, and Bypass permissions modes. Except in Auto and Bypass, that rule stopped applying the moment you typed @browser in the session. Once you'd typed it, Claude could keep clicking and filling forms on any site without asking again, even though that guardrail exists precisely for those two modes, where other confirmations are reduced or skipped.

2.1.296 closes that gap: in VS Code, Claude in Chrome now asks for confirmation before acting on a site you haven't allowed in every session, whether you've typed @browser or not, as the terminal does. Allowing a site for the session then stops the repeat asks. If you code in VS Code with the browser connected by default, update: before this version, typing @browser alone was enough to lift that guardrail.

Everything else, briefly

• Sonnet 5.5 cache reads get cheaper: the official pricing page drops a cache read from $0.20 to $0.10 per million tokens, visible in /cost, the status line, and --max-budget-usd. Sonnet 5.5 has run by default behind the sonnet alias on the Anthropic API since 2.1.284, so it's not a gated model, and the cut applies without changing how you work.
• MCP tool descriptions: the MCP docs confirmed the old limit: "Claude Code truncates each tool description and each server's instructions at 2,048 characters by default." 2.1.296 doubles that cap to 4,096 characters, giving a server that documents its tools in depth a bit more room.
• Per-subagent compaction: a new autoCompactWindow field in a subagent's frontmatter, or in an --agents definition, sets its own auto-compact window instead of inheriting the main session's. Useful when you delegate to a model with a smaller context window.
• A CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL variable forces every agent in a workflow onto the same model, and the Read tool gains an allow_large option to read a big text file in one call instead of paging through it.
• Two permission gaps closed: some Bash commands that assign the BASH_ARGV0 shell variable and then use it were auto-approved, and on Windows, rm -rf /c/Users/<name> in Git Bash didn't ask in Bypass permissions mode. Both now prompt for approval.
• The rest of the bug fixes mostly touch hooks, plugins and mods, Windows, the Claude apps gateway, cloud sessions, and Claude Tag in Slack.

The takeaway

If you code with Claude in Chrome connected by default in VS Code, this version closes a real gap: typing @browser used to drop permission confirmations in Auto or Bypass mode, and now it doesn't. Beyond that, the one worth remembering is the Sonnet 5.5 cache price cut, the kind of change that needs nothing from you and just lowers the bill.