--- title: "Claude Code v2.1.243-246: The Auto Mode Steering Wheel Its Critics Asked For" date: 2026-08-26 tags: ["claude-code","auto-mode","changelog","agentic-coding","anthropic"] categories: ["AI Tools"] summary: "Three Claude Code releases shipped August 25 (v2.1.243, 245, 246), the biggest adding an Auto mode tab to /permissions for viewing and editing the classifier's rules, plus a startup warning for dangerous wildcard Bash allow-rules and a fix for auto mode wrongly denying tool calls on large sessions — concrete tooling answering the concrete complaints that surfaced when Auto mode went default eleven days earlier." --- ![Claude Code v2.1.243-246: The Auto Mode Steering Wheel Its Critics Asked For](/images/claude-code-v2-1-243-246-auto-mode-permissions-tab.png) Eleven days ago, this blog [covered day one](/2026/08/claude-code-auto-mode-day-one-reactions/) of Auto mode as the default permission mode for Pro, Max, and Team sessions. The rollout itself shipped clean, but the Hacker News reaction split on a specific, useful axis: not "is the classifier's 89%-versus-13.6%-catch-rate study real" (nobody seriously disputed the numbers), but "what happens in the 11% gap, and can I see or steer what the classifier is actually doing." Concrete anecdotes did the arguing — a permanently broken SSH config, a `rm -rf` against a home directory mid-TDD-loop, a lost git stash. The honest conclusion at the time was that a stricter `defaultMode` pin or narrower workspace scoping was the best available mitigation, because there wasn't yet a way to see the classifier's own rules, let alone edit them. Eleven days later, on August 25, three releases landed back to back — v2.1.243, v2.1.245, and v2.1.246, all same-day, per [code.claude.com/docs/en/changelog](https://code.claude.com/docs/en/changelog) — and the biggest one is a direct answer to exactly that gap. ## What shipped **v2.1.246** added an **Auto mode tab to `/permissions`**, for viewing and editing the classifier's rules directly. Until this release, Auto mode was a black box you either trusted or turned off — you could see *that* it caught 89% of dangerous commands in Anthropic's study, but you had no interface into *which* rules it was applying to your own sessions. That's the single most requested piece of visibility from the day-one critique, and it shipped as an actual UI surface rather than a blog post promising more transparency later. The same release added a narrower but sharper fix: a **startup warning for Bash allow-rules with a wildcard placed before the subcommand** — the changelog's own example is `Bash(git * main)` — because a wildcard positioned there also matches options inserted ahead of the subcommand, not just the subcommand itself. That's precisely the failure mode behind the messiest permission complaints: an allowlist rule that looks narrowly scoped to a human reading it, but that actually matches a much wider set of commands than intended once you account for how shells parse arguments. A rule you wrote to permit `git main`-adjacent operations can silently also permit something with an injected flag ahead of `main` — the exact kind of gap that makes a "safe-looking allowlist" different from an actually-safe one. Anthropic now tells you about the ambiguity at startup instead of leaving you to discover it via an unexpected command sailing through. Two smaller Auto mode fixes rounded out the pair of releases: - **v2.1.246** also fixed auto-mode tool calls being wrongly denied as "temporarily unavailable" on very large sessions, by scaling the safety-check timeout to the size of the prompt instead of using a fixed deadline. If you'd hit this, it looked like Auto mode randomly refusing to work rather than a timing bug — a reliability complaint that reads as a safety complaint if you don't know the cause. - **v2.1.243** fixed Auto mode staying disabled at startup after a cached "temporarily disabled" flag failed to refresh, and fixed the same "temporarily unavailable" denial happening after brief API overload. Both are the unglamorous kind of bug where the safety system's own plumbing, not the classifier's judgment, was the thing failing. **v2.1.245** was a single-line hotfix: a startup crash on Linux distributions shipping glibc 2.44 (Arch, CachyOS, Fedora Rawhide) — unrelated to Auto mode, but worth noting for the cadence point below, since it means Anthropic shipped three releases addressing three different classes of problem on the same calendar day. ## Tooling, not retreat The useful frame here is what Anthropic *didn't* do. Nothing in this release cycle walks back the August 14 default, narrows Auto mode's scope, or concedes the HN skeptics' stronger claim — `quotemstr`'s "if you're relying on a prompt to constrain agent behavior, you've already lost" is a structural objection an editable rules tab doesn't resolve, because a rule you can see and edit is still a rule, not a guarantee. What Anthropic shipped instead is the more defensible middle position: give people who want more control an actual surface to exercise it, and close the specific correctness gaps (the wildcard-scoping ambiguity, the timeout-driven false denials) that made the system harder to trust for reasons that had nothing to do with its underlying detection rate. That's a meaningfully different response than "here's a new blog post explaining why the numbers are fine." It's the kind of shipping cadence — a real UI feature and two real bug fixes, eleven days after a public rollout drew specific complaints, verified directly against the changelog rather than a press release — that's been the actual differentiator on this blog's read of Claude Code all year: not any single model or feature, but the rate at which concrete feedback turns into concrete changes. v2.1.246 alone shipped 40-plus other fixes and improvements the same day, from a 75MB (down from 340MB) native binary install size to plugin-cache deduplication to workload-identity-federation credential scoping — the Auto mode work wasn't a special one-off sprint, just the most newsworthy slice of an otherwise ordinary release day. If you administer Claude Code for a team, the actionable step is straightforward: after updating, open `/permissions` and actually look at the new Auto mode tab rather than assuming the classifier's defaults match what you'd choose. And if you'd written any Bash allow-rule with a wildcard ahead of a subcommand — the exact `Bash(git * main)` shape the changelog calls out — this is the release that will tell you about it on startup instead of leaving you to find out the hard way. **Sources**: [Claude Code changelog](https://code.claude.com/docs/en/changelog) (primary, fetched directly for all version details above); this blog's own prior coverage of [Auto mode becoming the default](/2026/08/claude-code-auto-mode-default-pro-max-team/) and [day-one reactions](/2026/08/claude-code-auto-mode-day-one-reactions/) for context.