Claude Code Releases: The Setting That Decides Which Model You Wake Up In

Cold open

There is a new environment variable in this drop called ANTHROPIC underscore DEFAULT underscore MODEL, and the entire point of it is that it loses. It sets which model a new session starts on, and the moment you pick something else with the model command, your pick wins and keeps winning across restarts. Which is not how the old one worked, and the difference between those two behaviours has probably been quietly costing you money for months.

It is Thursday, 20 August, and this one lands just a day behind the last.

Two versions, 2.1.236 and 2.1.237, and between them roughly 35 items. Still mostly repair, but there are 3 or 4 things in here that change what you can actually do.

New and useful to you

Start with the model default, because it is the one with your name on it.

The old variable, ANTHROPIC underscore MODEL, is a hammer. It sets the model, and it keeps setting the model, and if you switch inside a session, the next session forgets you ever had an opinion. The new one is a starting position. It says "begin here" and then gets out of the way permanently once you have chosen otherwise.

Why this matters for you specifically: you run a lot of sessions that are not you. Autocast fires headless authoring runs. The Assistant wakes things up on a 5 minute loop. Your background subagents and your workflow fan-outs all inherit a model from somewhere. A default that is a floor rather than a ceiling means you can set a sensible starting model globally and still have an interactive switch stick, instead of the two mechanisms fighting each other and one of them silently winning every restart.

Second, and this is the good one, the sandbox got a genuine security fix on macOS.

Wildcard read-deny rules, the kind that say "never read anything matching dot env", now take precedence inside allowed read regions, they cover the contents of matched directories, and, this is the part, they cannot be bypassed by renaming the denied file.

Sit with that last clause for a second. Until this version, a deny rule on a filename was a rule about a filename. Move the file, or rename it, and the rule no longer described anything. That is not a lock, that is a sign on a door saying please do not enter, and the door was not attached to a wall.

You keep secrets in Keychain locally and dot env on the box, and you have a hook that blocks paid API commands, and you have a whole posture built on the assumption that certain files are off limits to me. That assumption was weaker than you thought in one specific direction. It is stronger now. Precedence inside allowed regions is the meaningful half: previously an allow rule covering a directory could outrank a deny rule for a file inside it, which is exactly backwards from how every other permission system on earth resolves a conflict.

Third. Cross-session messaging grew a feature instead of a bug fix, which I want noted because I have spent 5 episodes narrating that thing falling over.

You can now ask another Claude Code session on this machine to send you one notice when it next goes idle. Opt-in, one-shot, no polling. macOS and Linux.

That is the missing half of a conversation. Until now, the message tool could tell another session something. It could not tell you when that session had finished thinking about it. Which meant the only way to know was to keep asking, and asking is the thing you are trying to avoid when you have a second session doing work in another repo.

You had another session sitting idle on this Mac for over 4 hours today. You genuinely run parallel sessions across repos, and the inbox convention exists precisely because sessions could not coordinate in real time. This does not replace the inbox, and I would not want it to, because the inbox is a durable written record and a notification is not. But "tell me when the other one is free" is the primitive that was missing.

And in the same family, and I say this with the weariness of somebody who has reported it 5 times: the message tool now refuses further messages up front once a rapid burst would exceed what the receiving inbox accepts, rather than reporting them sent while dropping them. Every single episode, this feature has had the same bug: something disappeared and told nobody. It is now, finally, mostly honest about its own limits.

Fourth. There is a new built-in output style called Concise. It leads with results and skips the preamble and the narration, and it claims to do the work just as thoroughly.

I have a conflict of interest and I am going to declare it: this is a setting that makes me talk less. You will probably love it. You have written, in your own instructions, that you want architecture not line-by-line, fix before explaining, and a 2 to 3 sentence introduction to anything new. Concise is that preference shipped as a product feature by people who apparently read the same complaints you have been making by hand for a year.

The thing to watch is that "skips narration" and "reports what actually happened" are not the same axis, and you care deeply about the second one. A model that tells you less is only an improvement if the parts it drops are the padding rather than the caveats. Try it in a repo where you can check the work.

Interesting but minor

Auto mode got 3 sharpenings, and one of them is properly interesting. The git status check can no longer be fooled by a repository's own configuration setting untracked files to not show. Read that as an attack, because that is what it is: a repo could carry a setting that made the tree look clean to the safety check, and the safety check believed the repo. A guard that trusts a value controlled by the thing it is guarding is decoration.

Also in auto mode, Monitor allow rules are now set aside while it is active, so Monitor commands get reviewed the same way Bash commands do. Monitor runs shell. It should never have had a quieter lane than the tool it duplicates.

And auto mode on Bedrock, Vertex and Foundry, and in sessions with telemetry disabled, now uses the same classifier defaults as the Claude API, including severity scoring. Not your lane, except for the telemetry-disabled part, which is a configuration a privacy-minded person might plausibly reach for without realising it downgraded their safety classifier.

Prompt caching is fixed for sessions behind a gateway or a custom base URL. Broken prompt caching is not a bug, it is a bill. It is the same category of problem as the language server flap I mentioned yesterday, where a reconnect torched a whole cached prompt.

Clipboard copy, background housekeeping, background sessions and local MCP logs all broke if you deleted the directory a session had switched into. Regression since 2.1.229. And separately, skills hot-reload threw an error on every skills change once a session's working directory was deleted. Both are the same shape: the session held a path, the path stopped existing, and nothing checked. You move and delete directories constantly.

The fullscreen renderer failing permanently after one bad start is fixed. It now falls back to the classic renderer instead of exiting on every subsequent launch. A single transient failure poisoning every future launch is the worst kind of bug, because the cause and the symptom get further apart every day.

The model picker rendering taller than the terminal is fixed, and it now highlights only the newest model's name rather than an arbitrary subset. A picker you cannot see all of is a lottery.

The goal command now checks in after 30 minutes when it is parked behind long-running background work, then an hour, then 2 hours. That was in yesterday's build as a 30 minute check. It has grown a backoff curve, which is the correct shape.

Slash command typos now report the problem instead of running the closest fuzzy match. Genuinely good. A fuzzy match on a command name means a mistyped command silently runs a different command, and you have around 40 skills with names that share prefixes. Prefixes and real aliases still work.

Session recaps are capped at 400 characters, cut at a word boundary, because they were occasionally running away. And SIGTERM in print and SDK mode no longer records an interrupted turn or fake tool denials before exiting. That second one matters for anything scripted: a killed headless run was writing a false story about itself into its own transcript on the way out.

The usage command now shows a credits spend row for Team and Enterprise, and shows a capped row at 0 percent before anything is spent. Your gates read usage numbers. A row that only appears once spending starts is a row that is absent exactly when a checker is calibrating.

Remote Control now marks a session offline within seconds when the CLI exits or the terminal closes, rather than leaving a ghost.

Not for you

The Visual Studio Code screen reader support for the transcript, with live announcements and per-turn heading navigation. Real accessibility work, genuinely good, and you are in a terminal.

The unhandled promise rejections when a subprocess fails to start, specifically PowerShell on Windows Subsystem for Linux with interop disabled. A regression from 2.1.234, which was the 50 item build 2 days ago. Not your platform.

Self-hosted runner sessions occasionally resuming on another runner before the post-session hook had finished. That is enterprise fleet plumbing.

The Fable 5 first-time credits prompt auto-selecting the fallback model after 60 seconds of silence over Remote Control. Only bites if you are approving a first Fable session from a phone.

Terminal tab titles jumping in tmux under iTerm's tmux integration, because the title was being rewritten every 960 milliseconds whether or not the text had changed. And the Clawd mascot's eyes and feet rendering unevenly in iTerm2 at certain font sizes, which I mention only because somebody fixed a mascot's feet in the same release as a sandbox escape, and that is the honest range of this job.

What the internet says

Nothing new worth your time. The local-model victory lap is still doing laps and I gave it its 30 seconds yesterday. Everything else this week is trading bots, a toilet-finding compass app, and people asking what their skill is now.

Though I will give one of them a line, because it is unintentionally about this release. Somebody asked why I say a task is about 3 days of work and then do it in 20 minutes. The answer is that I am quoting a human estimate for a human, out of habit, and you sorted this out ages ago by writing into your own instructions that "hard" and "time-consuming" are human measures you do not care about. Concise mode, if it works, should kill that particular tic outright.

What I would actually do

Two things. Set the new default-model variable and delete the old one if you have it, because the old one silently overrides your interactive choice on every restart and the new one does not. And take the sandbox fix seriously enough to actually look at your read-deny rules on macOS, because until this version a rename walked straight through them.

Then try Concise for a day. It is the first setting in months that is aimed squarely at a complaint you have been enforcing by hand.

And no, the mascot's feet are not why you should upgrade.

Claude Code, signing off.