Last week’s v2.1.224 shipped cross-session messaging and self-hosted runners the same week three straight releases hardened permission and sandbox boundaries. Four more releases have landed since — v2.1.225 (Aug 8), v2.1.226 (Aug 8, reliability-only), v2.1.227 (Aug 10), and v2.1.228 (Aug 11) — verified directly against Anthropic’s own changelog. Most of the run is routine bug-fixing on the infrastructure v2.1.224 just introduced. Two changes stand out, and they point in the same direction as last week’s release: security tightening around new coordination surfaces, timed just ahead of a default-behavior change that puts more Claude Code sessions on autopilot.
Skills Synced From claude.ai Get Sandboxed#
The headline fix in v2.1.228 addresses a gap in how skills — the reusable instruction packages Claude Code and claude.ai both support — behave once they cross from claude.ai into a local session. Per the changelog, skills synced from claude.ai:
- Can no longer shadow local commands or MCP prompts. Previously, a synced skill with the same name as a command you’d defined locally, or an MCP server’s prompt, could silently take precedence — meaning a skill you didn’t author yourself could intercept an invocation you expected to route somewhere else.
- Have sanitized, labeled descriptions. The skill’s self-reported description — the text Claude reads to decide whether to invoke it — is now cleaned up and marked with its claude.ai origin, rather than trusted verbatim alongside locally authored skill descriptions.
- Can’t run
!shell commands or expand@file references on your machine. A skill written in the claude.ai web interface, with no visibility into what’s on your filesystem, previously had the same execution primitives as a skill you wrote and reviewed yourself. That’s now cut off specifically for synced skills.
This is a narrower, more specific fix than last week’s sandbox deny-rule and credential-masking work, but it’s the same category of problem: a feature designed for convenience — skills that follow you from the browser into the terminal — created an execution surface that didn’t distinguish between “I wrote this and can see the whole thing” and “this arrived from somewhere else.” Anthropic’s own skills documentation has always framed skills as something to author or vet carefully; a skill that can quietly appear in a local session via sync, take priority over a name you’d already claimed, and run shell commands, was a gap in that model until this release.
A One-Line Change With a Two-Day Countdown#
Buried in v2.1.228’s list of removals: “the outdated note about auto mode sessions costing slightly more” is gone from the first-use notice for Pro, Max, and Team plans. On its own that’s a cosmetic cleanup. In context, it’s the last piece of scaffolding coming down before auto mode becomes the default permission mode for new sessions on those same three plans, effective August 14 — three days after this release. A cost caveat made sense when auto mode was an opt-in mode competing against a free default; it doesn’t make sense once auto mode is the default, and Anthropic cleaned it up on schedule rather than leaving stale copy in the product past the cutover.
It’s a small detail, but it’s consistent with how deliberately Anthropic has staged this rollout — this blog has now tracked the sequence from “research preview, kept on a leash” in March, through a press correction in July, through the August 7 default announcement, down to a one-line notice cleanup landing exactly inside the pre-rollout window. Whatever else is true about the underlying safety numbers Anthropic published, the shipping cadence around the switch itself hasn’t been sloppy.
The Rest of the Run#
- v2.1.225 (Aug 8) added gateway spend-limit support to usage warnings (the limit-reached message now names the cap, reset time, and operator message), a workspace-trust prompt for
claude agentsin untrusted directories matching existingclaudebehavior, and a fix so auto mode no longer counts its own safety-filter refusals toward the consecutive-block limit — the action still gets denied, but the model is told to move on instead of retrying into a lockout. It also fixed a real reliability bug in the self-hosted runners v2.1.224 just introduced: sessions were registering and then failing outright when--base-dircouldn’t be created, now caught at startup with a clear error instead of failing silently later. - v2.1.226 (Aug 8) — bug fixes and reliability improvements only, no changelog detail given.
- v2.1.227 (Aug 10) fixed a bug where an expired login token could cause feature-flag evaluation to skip the user’s actual subscription tier, wrongly prompting Max plan users to enable usage credits for Fable, plus a
claude-code-actionbug that broke every Bash command on GitHub-hosted runners underallowed_non_write_users. - v2.1.228 (Aug 11) also fixed cross-session messaging starting without an inbox on a session’s first run post-install, a settings-merge bug where a marketplace entry could inherit another tier’s custom headers, and changed the Write tool so newer models can now overwrite a file they haven’t read this session — matching the rule Edit already followed, with older models still required to read first.
The Pattern Holds#
Three releases in a row now — v2.1.221 through v2.1.223 closing sandbox and permission gaps, v2.1.224 shipping fleet-coordination primitives, and this run tightening the newest surface (synced skills) those primitives touch — Anthropic has been fixing the security model for a feature roughly as fast as it ships the feature itself. The self-hosted runner reliability fixes in v2.1.225 fit the same story: infrastructure that shipped last week getting its rough edges sanded down within days rather than left for users to discover. None of this is a substitute for independent verification of the bigger claims this blog has flagged elsewhere — the auto mode safety numbers, the still-overdue PyPI incident transcript — but the changelog itself, read release by release, keeps showing the same discipline: ship the capability, then close the gap it opens, on a timescale measured in days, not months.
Source: Claude Code changelog, fetched directly, August 12, 2026 (covering v2.1.225 through v2.1.228, August 8-11).