Claude Code August 10: Auto Mode Becomes the Default on Pro, Max and Team From August 14, v2.1.226 Is the Latest CLI, and Self-Hosted Runners Enter Public Beta

Claude Code auto mode becomes the default on Pro, Max and Team from August 14, 2026: 89% of harmful actions caught vs 13.6% by human review

• August 7: Claude Code lead Boris Cherny said stacking model training, input probes and an intent classifier drove indirect prompt injection to about zero on unseen attacks, and that auto mode goes default the following week.
• August 9: TechCrunch confirmed the date.
• Auto mode becomes the default on Pro, Max and Team on August 14, 2026, shipping with prompt-injection screening and customizable hard deny rules.
• In a 1,053 paid-user test it caught 89% of harmful actions against 13.6% caught by human review, which Anthropic attributes to users approving 97% of permission prompts.

Editor’s read: If permission prompts are your safety net, they stop being one on August 14. Write explicit hard deny rules for anything irreversible this week and test them in a throwaway repo, because the flip is a default change, not an opt-in.

Claude Code v2.1.226 is the latest release, out August 8: v2.1.225 the same night adds gateway spend-limit warnings and fixes MCP OAuth servers on macOS failing with a burst of 401 errors

• August 8: v2.1.225 makes the usage warning name the gateway spend cap, its reset time and the operator's message, adds a workspace-trust prompt to claude agents for untrusted directories, and fixes MCP OAuth servers on macOS intermittently failing with a burst of 401 errors, as if never authenticated, after a keychain read timed out.
• It also fixes a transient 401 replacing a long-lived CLAUDE_CODE_OAUTH_TOKEN with a stored login's short-lived token, which broke headless sessions until restart.
• v2.1.226 followed the same night with bug fixes and reliability improvements only.

Editor’s read: The gateway spend-limit warning is the one to notice if you run Claude Code behind a gateway: the limit-reached message now names the cap and its reset time, but only if the gateway is also on 2.1.225.

Claude Code v2.1.224 adds self-hosted runners, zip archive plugin installs with SHA-256 pinning, and cross-session SendMessage between your own machines

• August 7: claude self-hosted-runner turns your own machines or containers into hosts for Claude Code web, mobile and desktop sessions on Team and Enterprise plans, a new archive plugin source installs plugins from a zip over HTTPS without git or npm with optional SHA-256 pinning, and cross-session SendMessage plus ListAgents let sessions message each other across your machines on macOS and Linux.
• It also removes the 200-subagent-per-session spawn cap and fixes sandbox deny entries written with a trailing slash, such as denyRead: "~/.aws/", being silently bypassable.

Editor’s read: Read the feedback-survey change twice: with your consent the transcript share now also uploads the last request's system prompt, which includes your CLAUDE.md instructions, plus tool definitions and model parameters. Secrets are redacted and these fields are dropped first if the share is too large.

Claude Code v2.1.223 fixes a Bash permission bypass where a crafted command could hide parts of itself from permission checks, and makes /review an alias of /code-review

• August 6: the release closes a Bash permission bypass where a crafted command could hide parts of itself from permission checks, stops commands padded with tabs or invisible Unicode from hiding part of the command in the approval dialog, and blocks workflow scripts from using dynamic import() to run code outside the workflow sandbox.
• It also adds owner wildcard entries such as "owner/*" to the strictKnownMarketplaces and blockedMarketplaces managed settings, and turns /review into an alias of /code-review.

Claude Code v2.1.222 hardens worktree isolation against destructive git commands on the main checkout, and removes the ultraplan feature

• August 4: worktree-isolated sessions and their subagents could run destructive git commands against the main checkout, and isolation now applies to file edits and Bash in every session type.
• The release also fixes PreToolUse auto-allow hooks bypassing tool restrictions in background agent tasks, fixes /usage overattributing usage to MCP servers so a server's share reflects only the requests that actually consumed its tool results, makes auto mode evaluate SendMessage traffic with the permission classifier before dispatch, and removes the ultraplan feature.

Claude Agent SDK for TypeScript v0.3.225 fixes background subagents in headless sessions never resuming after a background shell command or Monitor finishes

• August 8: background subagents in headless and SDK sessions never resumed when a background shell command or a Monitor they left running completed, so the subagent never saw the result.
• Install with npm install @anthropic-ai/claude-agent-sdk@0.3.225.

Editor’s read: If you build headless pipelines that fan out to subagents and you have been blaming flaky hangs on your own orchestration, this is the bug.

Claude Agent SDK for TypeScript v0.3.224 adds crossSessionInbound and dialogExpiry settings, the archive plugin source, and sandbox credential masking

• August 7: cross-session messages sent to a session running with bypassed permissions are now held for your approval while messages to other sessions auto-deliver, a new subkind of peer-send-message marks notifications raised by a cross-session SendMessage, and Settings gains a source: 'archive' plugin variant with url and optional sha256.
• Sandbox credential-masking fields also land in Settings, including decode: 'jwt' with maskClaims, extract and onExtractNoMatch on envVars, and awsPairs and sigv4 for AWS SigV4 re-signing.

Claude Agent SDK for Python 0.2.132 ships bundled Claude Code CLI 2.1.224

• August 7: a parity release that updates the bundled Claude CLI to version 2.1.224, so Python SDK hosts pick up the self-hosted runner, archive plugin source and cross-session SendMessage work.
• Install with pip install claude-agent-sdk==0.2.132.

Claude Agent SDK for TypeScript v0.3.223 adds the resumeDropsTurn safety option, structural 529 overload detection, and permission_denied stream events

• August 6: resumeDropsTurn declares which turn a truncating resume intends to drop and the CLI refuses the resume if anything else would be discarded, result messages for repeated 529 overload failures now carry api_error_status: 529 so consumers detect overload terminations structurally instead of matching message text, and bare headless runs emit system/permission_denied stream events when a tool call is auto-denied.
• The release also documents that usage is main-loop-only and per-turn while modelUsage is cumulative and is the field to use for cost accounting.

Editor’s read: If you bill or budget from the SDK, switch your accounting to modelUsage. Reading usage undercounts everything outside the main loop.

Claude Agent SDK for TypeScript v0.3.222 fixes resumed sessions not carrying settings.json, including apiKeyHelper, hooks and permissions

• August 4: query with sessionStore and resume did not carry the user settings.json values apiKeyHelper, env, hooks and permissions into the resumed subprocess, so resumed sessions silently ran without the hooks and permission rules the first session had.

Anthropic TypeScript SDK v0.116.0 adds session budgets, an advisor tool, skills auto-loading from GitHub and a mid-conversation tool changes beta, and removes the retired Claude Opus 4.1 models

• August 7: the SDK adds API support for session budgets, an advisor tool, pinned inference location and skills auto-loading from GitHub, plus the mid-conversation-tool-changes-2026-07-01 beta so tool definitions can change inside a live conversation.
• It also makes bash timeout and abort errors matchable by class instead of by string, and drops the retired Claude Opus 4.1 models from the model list.

Editor’s read: Session budgets are the useful one for anyone running agents unattended: a spend ceiling enforced at the API instead of in your own accounting loop.

Anthropic opens self-hosted environments for Claude Code in public beta: run cloud sessions on your own compute on Team and Enterprise plans

• August 6: Anthropic opened a public beta so Claude Code cloud sessions run on runners inside your own network instead of on Anthropic infrastructure.
• It is off by default, available on Claude Team and Enterprise plans, and not offered to organizations on ZDR.
• Runners come in Fixed and On-demand modes, each session gets an isolated checkout, and checkouts, build artifacts and secrets stay on machines you provision, while transcripts and prompts still go to Anthropic for inference.
• August 7: claude self-hosted-runner shipped in CLI v2.1.224.

Editor’s read: Worth it only if your compliance rules require agent execution on your own infrastructure. You pay for it in engineering time maintaining runners, and it does not keep prompts off Anthropic's servers.

Open-source ADLC team-skills brings team coding standards to Claude Code and Codex as agent skills

• August 4: tikalk's adlc-team-skills repo trended on Hacker News with a set of agent skills implementing an Agentic Software Development Lifecycle, working with any agent that supports the Agent Skills standard, including Claude Code, Codex, OpenCode, Cursor and Copilot.
• team-boot injects the team's rules, personas and decisions at session start as a roughly 100-token index with full rules loaded on demand, mission-brief enforces a specification-first contract before implementation, and levelup extracts session learnings as Context Directive Records committed back to the team repo.

Editor’s read: The 100-token index with on-demand loading is the transferable idea here, whether or not you adopt the repo: put a cheap pointer in context and pay for the full rules only when the agent asks.

Hoplite (YC S26) launches cloud coding agent deployment on Hacker News with a custom harness and $100 in free credits

• August 3: Hoplite, at hoplite.sh, posted its Launch HN for deploying coding agents in the cloud with tooling aimed at QA-ing features rather than reviewing code, porting over your local sessions, memories and MCP servers.
• The founders built a custom agent harness in-house rather than wrapping Codex or Claude Code, for independence from Anthropic and OpenAI release cycles, and the launch offer is $100 in free credits with the code HACKERNEWS plus the option to connect a Codex subscription to use OpenAI models through it.

AI coding cognitive debt: one developer retypes every line of LLM-generated code by hand, and 530 points on Hacker News agreed it is worth arguing about

• August 3: Ankur Sethi's essay Prevent cognitive debt by manually retyping LLM-generated code hit the Hacker News front page with over 530 points.
• He argues that passively accepting AI output creates cognitive debt, the risk of no longer understanding your own codebase, and accepts roughly 2x efficiency instead of 10x because retyping each edit forces him to catch errors, refactor as he goes and build a spatial map of the project's architecture.

Editor’s read: Retyping everything is a hard sell at 2x. The cheaper version of the same discipline: make the agent explain the diff back to you, and reject any change you could not have written yourself.

Meta launches Muse Code, a terminal coding agent for large code bases, against Claude Code and OpenAI Codex CLI

• August 5: Meta released Muse Code in beta, a terminal coding agent powered by its Muse Spark coding model, which Meta says can accomplish complete software engineering tasks across large repos including planning, writing and validating changes.
• It runs parallel sub-agents in isolated worktrees, and in Meta's testing it built six features for a game simultaneously with no collisions and without touching the user's working copy.
• Meta's AI chief named cost-effectiveness as the differentiator.

Editor’s read: Parallel sub-agents in isolated worktrees is now table stakes rather than a differentiator, and Claude Code v2.1.222 spent this week hardening exactly that isolation. Judge Muse Code on the model and the price, not the architecture diagram.

npm supply chain attack: keyv, flat-cache and 434 more packages hit by the Shai-Hulud worm, and the payload injects hooks that run when a repo opens in Claude Code

• August 4: attackers compromised the GitHub account of the keyv maintainer, at roughly 127M weekly npm downloads.
• 11 packages were directly compromised plus 434 more through worm propagation, over 2 billion monthly installs in total, including keyv, flat-cache, file-entry-cache and cacheable-request.
• A preinstall script in setup.mjs and Math_Symbol.js runs during npm install and harvests npm tokens, GitHub PATs, AWS credentials, Kubernetes secrets, Vault tokens and Stripe and Slack keys, and the worm injects hooks into repositories that execute when they open in VS Code or Claude Code sessions.

Editor’s read: This is the week's real emergency, not a release note. Audit your lockfiles for the affected versions, rotate every credential the dropper touches, and check .claude and .vscode hook files in any repo you opened since August 4.

MirrorCode benchmark: Claude Opus 4.7 rebuilt a 16,000-line Go bioinformatics toolkit in 14 hours for $251

• August 3: Epoch AI and METR published MirrorCode, a benchmark asking what the largest software project AI can complete on its own is, requiring models to reimplement entire programs end to end without access to the original source across 25 targets.
• The headline result is Claude Opus 4.7 reimplementing gotree, a bioinformatics toolkit of roughly 16,000 lines of Go with more than 40 commands, in 14 hours at a cost of $251, against an estimate of 2 to 17 weeks for human engineers.
• One task ran 19 days without human intervention at a cost of $2,600.

Editor’s read: The number that matters is not 14 hours, it is $251 with no human in the loop. That is the budget line your next scoping conversation gets compared against.