Claude Code 2.1.317: a warning before email leaks, Read drops its shortcut

Claude Code 2.1.317, released November 3, 2026, packs ten additions, seven changes, eight improvements, and sixty-two bug fixes into one release, dense even for a daily build. Two items stand out from the pile: a new check before a web or shell tool call sends your account email address over the network, and the disappearance of a Read tool shortcut that used to skip re-sending a file's content when nothing had changed. The rest, mostly reliability fixes across self-hosted runners, VS Code, and cloud sessions, earns a paragraph rather than its own section.

A warning before your email heads out over the network

2.1.317 adds a check that runs before a web tool call such as WebFetch, or a shell command such as curl, sends your account email address over the network: Claude Code now stops and asks for confirmation instead of sending it quietly.

The risk here is real and already documented. Claude Code's security page lists several prompt-injection safeguards, including the fact that most network-requesting tools need approval in Manual mode, and that for most fetches, WebFetch runs a separate model call over the page and hands Claude that call's answer rather than the raw content. A malicious page can still slip in an instruction that pushes the agent to send your address to a third-party server, betting that it will comply without question. Where those safeguards are generic, the new check targets one specific piece of data: your account email.

Read drops its "unchanged file" shortcut

The second change is quieter but can affect any session. Until now, reading a file again that Claude had already read and that hadn't changed since returned a short notice saying nothing had changed, instead of resending the full content. That saved tokens in sessions where Claude re-reads the same files between steps. 2.1.317 removes that shortcut: reading an unchanged file now returns its full content again.

The tools reference covers the Read tool's baseline behavior (pagination, image and PDF handling) but doesn't mention the notice or its removal. The practical upshot: if your workflow has Claude re-read the same large files several times in one session, expect higher token use, which you can track with /usage.

Everything else

On the hooks side, onFailure: "block" already existed for command and http hooks since 2.1.295, according to the hooks documentation; 2.1.317 extends it to Agent SDK callbacks, so a failing callback blocks the action instead of letting it run. On the reliability side, the batch is substantial: sessions on self-hosted runners now open a new connection instead of reusing one that just failed after a server error, Ctrl+C to clear typed text at the prompt no longer stops every background agent by accident, and in cloud sessions, auto mode no longer stops to ask for approval when the Artifact tool uploads, writes to a database, or saves a file through the outputs folder. One fix is more than cosmetic: Grep and Glob were treating a search result cut short by a time limit as complete, which could silently miss a match. In VS Code, a forked conversation no longer drops messages: only one of the tool calls Claude ran in parallel used to be kept. And /schedule now warns you when a new cloud scheduled task gets connectors you didn't ask for, and tells you how to remove them. Two behavior changes are worth knowing too: subagents and teammates running on a different model from the main conversation now use that model's saved effort level, or its default, instead of the session's, and a SendMessage to a running background agent arrives sooner, with its running command moved to the background rather than stopped. The rest of the release, the Claude apps gateway for enterprises, OpenTelemetry, Windows, Remote Control, is mostly administrative or narrower in scope.