Claude Code v2.1.309 ships roughly 60 changelog bullets, and the heart of it is closing gaps in the sandbox, Bash permission checks and worktree isolation guard. It also makes claude ultrareview require workspace trust and denies dangerous rm calls outright in bypass mode on Desktop and VS Code. Changelog-only analysis; not run.
Claude Code v2.1.307 adds a claude_code.safety_event OpenTelemetry event for tool calls stopped, prompted or sent back by permission rules, auto mode, hooks or the sandbox, plus /claude-api api-version to move code to API version 2026-10-21. It also fixes HTTP MCP tool calls being sent twice. Changelog-only analysis; not run.
Claude Code v2.1.305 adds an opt-in sandbox.allowNestedUserNamespaces setting, a usage-limit recheck for unattended retry mode, and a change to how allowedMcpServers treats managed stdio servers. v2.1.306 is two fixes. Changelog-only analysis: I did not run either release.
Claude Code v2.1.304 adds /auto-mode-setup (now on Bedrock, Vertex and Foundry), lets a mod’s tool.check demand a human decision with decider: “person”, warns before resuming an old conversation eats your 5-hour limit, and ships a long list of fixes, including a worktree exit that could lose commits.
Reflection AI announced Beam on October 5: a 501B-parameter sparse MoE (23B active) that it self-reports at 80.1 on Terminal-Bench 2.1 and 80.9 on SWE-bench Verified. Weights are promised for later in October, the license is not confirmed from Reflection’s own materials, and none of the numbers are independently verified.
Claude Code v2.1.301 (Oct 15) and v2.1.302 (Oct 16) cap how long unattended retries wait on a usage limit, let you choose the client-side auto mode classifier’s model, turn fork subagents on by default outside the terminal, and limit concurrent prompt/agent hooks to 12 per event.
On October 19, GitHub Copilot removes Gemini 3.7 Flash, GPT-5.5, GPT-5.4, GPT-5.4 mini, GPT-5 mini and Grok 4.5 from every Copilot surface. Replacements are Gemini 3.8 Flash, GPT-5.6 Sol and Luna, and Grok 4.6, auto-enabled for Business and Enterprise unless admins opted out.
Claude Code v2.1.296 lets a subagent auto-compact earlier than the main session and pins every workflow agent to one model; v2.1.300 splits OpenTelemetry cache writes into 5-minute and 1-hour buckets. Together they are the first real cost-control surface for multi-agent runs. Based on the changelog only; I have not tested these.
Claude Code v2.1.299 (Oct 14) narrows MCP allow rules to the exact named server, makes plugin hooks that can’t answer refuse the action, stops following redirects on connector proxies, and compacts idle 200K+ token sessions before the one-hour cache expires.
Since Claude Code v2.1.292 (Oct 6) local stdio MCP servers negotiate protocol 2026-07-28 by default, and v2.1.295 (Oct 8) does the same for claude.ai connectors. Servers that ignore the check get remembered for 7 days and connected the old way; MCP_PROTOCOL_NEGOTIATION=legacy opts out.