Anthropic

Added Claude Fable 5.1 (claude-fable-5-1) — now the default Fable model with 1M context — plus a Containment Escape rule that stops auto-approving cloud credential fetches, egress evasion, and cross-tenant reach. Fixes include unbounded memory growth from piped non-JSONL data, an OAuth credential leak risk, and dozens of smaller fixes across subagents, time formatting, and sandboxing.

Fixed Bash commands failing with "task output swap refused" on some Macs when the tasks directory was moved or linked, and resolved Remote Control sessions stalling for minutes after a tool finished under degraded claude.ai connections. Also fixed "always allow" not saving in projects without a settings.local.json and background task notifications with very large failure output exceeding API limits.

Added PreModelSwitch and PostModelSwitch hook events, live streaming of foreground subagent tool calls to Remote Control clients, and a Spend limit bar to /usage. Fixed multiple security issues including file tools following swapped symlinks, plugin commands with path traversal, and beta tracing bypasses, plus dozens of correctness fixes across sessions, MCP, and teams.

Release notes describe general bug fixes and reliability improvements without specifying individual changes.

Added --restricted mode that removes command/code tools and WebFetch (unless named), keeps file tools inside the working directory, refuses bypassPermissions, and ignores settings files. Fixed a prompt-cache miss (with lost extended-thinking context) roughly once an hour in long sessions caused by tool definitions re-rendering after OAuth token refresh, plus dozens of smaller fixes across agents, hooks, MCP, and remote control.

Added /claude-api cost-optimize to profile and reduce a project's Claude API spend, plus the SendFeedback tool for drafting feedback reports. Fixed sub-agents failing on model 404s (now use the session's fallback chain), unbounded memory growth when hook output files couldn't be written, and a dotfile-managed settings symlink being deleted by Bash sandbox cleanup. Also hardened plugin marketplace against control/invisible characters and improved MCP failure reporting in Bedrock, Vertex, and Foundry sessions.

Fixed telemetry and metrics requests to Anthropic carrying the API key for a third-party gateway, so a credential is only sent to its own host. Also fixed fullscreen blank-transcript and scrolling regressions after resize, a transcript slowdown on very long lines, and dozens of other fixes spanning MCP, plugins, background sessions, and Bash tooling, plus an Auto mode tab in /permissions.

Fixed a crash on startup for Linux distributions with glibc 2.44, such as Arch Linux, CachyOS, and Fedora Rawhide.

What's changed

• Bug fixes and reliability improvements

What's changed

• Bug fixes and reliability improvements

Fixed a Bedrock streaming bug behind proxies that stripped response Content-Type headers, silently doubling billed API calls, plus a startup hang with SSO profiles behind HTTPS proxies. Added /claude-api upgrade to migrate Python projects from anthropic 0.x to 1.x, a one-time fullscreen renderer offer on Bedrock/Vertex/Foundry setups, and cost estimates that now include the 1.1× US-only inference premium for data-residency workspaces. Another four dozen fixes span vim mode, fullscreen rendering, remote sessions, and /resume behavior.

Fixed unbounded memory growth in long interactive sessions by releasing subagent tool results once they leave the recent display window, and added a keybindingFlavor setting with a "readline" option for Bash-style Ctrl+W. Also fixed output styles drifting back to default voice mid-session and dozens of Remote Control, MCP, and cross-session messaging fixes.

Fixed prompt caching for sessions using an LLM gateway or custom base URL. Added a built-in "Concise" output style that leads with results and skips preamble, selectable under Output style in /config.

New ANTHROPIC_DEFAULT_MODEL env var sets a session's starting model while preserving /model overrides, and cross-session SendMessage gains one-shot idle notifications. Also fixed sandbox read-deny wildcards being bypassed via renaming, plus clipboard/renderer/crash regressions across fullscreen, /model picker, and remote control.