Claude Fable 5.1 launched September 1 with a headline number: cache reads cut 75%, to $0.25 per million tokens, specifically because Anthropic said cache reads can account for half or more of the tokens burned on long agentic sessions. Three days and two point releases later, Claude Code’s own changelog — code.claude.com/docs/en/changelog, fetched directly for every detail below — quietly admitted the discount wasn’t fully landing: v2.1.260 fixed “prompt caching on Fable 5.1 not covering context after tool results.” That’s not a cosmetic bug. It means that for a common agentic pattern — read a file, run a test, read the output, keep going — the newly-discounted cache tier wasn’t kicking in on the context that included the tool result, which is exactly the context agentic coding sessions accumulate the most of. It’s fixed now, but it’s a useful reminder that a pricing announcement and the code path that actually implements it don’t always ship in the same release.
That fix is the most consequential single line across four releases (v2.1.258 through v2.1.261, September 1-4), but it’s not the only one worth unpacking.
A fullscreen diff panel, finally#
v2.1.260 (Sept 3) added a diff panel that opens beside the conversation in fullscreen mode, toggled with /diff, showing uncommitted changes as Claude edits. This closes a gap that’s existed since fullscreen mode shipped: reviewing what an agent actually changed meant tabbing out to a terminal or IDE diff view. Now the review loop stays inside the same pane the agent is working in — a small UX change, but exactly the kind of friction removal that matters once you’re running Claude Code as your primary editing surface rather than an assistant bolted onto one.
The same release added the likely cause of prompt-cache misses to /cost and the status line’s prompt_cache field — genuinely useful now that cache economics are a bigger share of the bill, and directly related to the Fable 5.1 caching bug above: you can now actually see when a cache miss is happening instead of just noticing your bill looks wrong.
Managed MCP servers and a headless no-prompts mode#
v2.1.259 (Sept 2) added managedMcpServers, a managed setting letting organizations push HTTP/SSE MCP servers to every user without each person configuring them individually — the kind of primitive that matters once an org has a standard set of internal MCP servers (ticketing, internal docs, deploy tooling) it wants every engineer’s Claude Code to have by default rather than by convention.
The same release added --permission-prompts none, aimed squarely at unattended headless hosts: anything that would normally trigger a permission prompt is now denied automatically, while the active permission mode still governs what’s allowed outright. That’s a meaningful distinction from --dangerously-skip-permissions — it’s a fail-closed default for CI runners and scheduled jobs, not a blanket bypass.
Also notable: claudeMd no longer triggers the security approval dialog on its own, and allowedMcpServers was narrowed to govern only user-added servers rather than every server in scope — both are the kind of permission-model refinements that come from someone actually running large fleets of agents and finding the friction points.
A Bash security fix, then a partial rollback#
v2.1.259 also shipped a fix for Bash Read() deny rules not covering option values, file operands, or cd DIR && cat FILE constructions — closing a real bypass pattern where a deny rule on reading a specific file could be sidestepped through command chaining. But v2.1.260 reverted part of that same change (“reverted 2.1.259 change applying Read() deny rules to Bash arguments”), after it apparently caused other problems. Shipping a security tightening, then partially rolling it back three days later when it turned out too broad, isn’t a great look in isolation — but it’s a far better failure mode than shipping a broad fix and never publishing that it needed walking back. The changelog says so, in public, which is the whole point of a changelog.
v2.1.260 separately closed a more subtle sandbox bypass: Bash permission checks were auto-approving zsh commands that hid command substitution inside REPORTTIME, REPORTMEMORY, or DIRSTACKSIZE — obscure zsh environment variables that can execute arbitrary code when set to a command substitution, and which a naive allowlist check wouldn’t flag as suspicious. That’s a genuinely clever bypass class, and closing it is the kind of unglamorous hardening this blog has flagged before as more important than any benchmark score for teams actually running Claude Code against real credentials.
Context management gets more knobs#
v2.1.261 (Sept 4) added bashOutputMaxChars and taskOutputMaxChars, raising how much command and background-task output Claude receives inline — up to 128K characters — before it gets saved to a file instead. For anyone running verbose test suites or build tools through Claude Code, that’s fewer truncated outputs breaking the agent’s reasoning mid-task.
The same release added /skill-doctor, which surfaces loaded-but-unused skills and their context cost, aimed at trimming the context tax of skill libraries that have grown past what any single session actually uses — a direct, practical answer to the “your agent is drowning in tokens” problem this blog has written about before. It also tightened the dangerous-rm safety prompt to catch rm -rf hidden inside positional parameters and double-quoted sh -c scripts, closing another narrow but real path to an unconfirmed destructive command slipping past the guard.
Why four unglamorous releases are worth a post#
None of these four releases has a keynote-worthy headline. But together they show the same pattern this blog flagged in the August 17-23 week-in-review: security hardening (the zsh sandbox bypass, the Bash deny-rule fix-then-partial-revert), enterprise fleet management (managed MCP servers, fail-closed headless mode), and a genuine self-correction on the economics of the model launched the same week. That last part is the one worth sitting with. A lab that ships a pricing headline and then, in public changelog entries three days later, admits and fixes the bug that kept the discount from fully applying is doing exactly what “boring, continuous hardening” should look like — the alternative is quietly living with the gap between the announcement and the implementation and hoping nobody checks their bill.
Sources: Claude Code changelog (primary, fetched directly for all version details above); this blog’s own prior coverage of Claude Fable 5.1 and Mythos 5.1’s launch and the August 17-23 week-in-review for pattern context.
