Anthropic released Claude Code v2.1.207 with a significant shift: auto mode is now enabled by default on Bedrock, Vertex AI, and Foundry, without needing the CLAUDE_CODE_ENABLE_AUTO_MODE flag. Users who don’t want it can disable it from settings (disableAutoMode).

The release comes ten days after the session leak incident on July 5, when a user received output related to a project they never requested. This version fixes precisely the bug that logged consent to remote settings without showing the security dialog, plus repairs the terminal that froze during streaming long responses.

Why it matters to you: if you use Claude Code on one of the three supported platforms, you now have auto mode active by default, and handoffs between agents should be more stable. The consent fix reduces the risk that remote-managed settings (for example in an enterprise team) were applied without you seeing them. If you worked with Git worktrees, the release also fixes the issue that broke go-git when you removed the last worktree.

In detail

The context: stabilization after the leak

When on July 5 an enterprise user reported cross-workspace output in Claude Code, Anthropic confirmed they were investigating. This release doesn’t explicitly declare fixing that specific leak, but the fix for consent to remote settings closes a plausible vector: if remote-managed settings were logged as consented without ever showing the dialog, a workspace could inherit configurations that weren’t its own.

Auto mode, which previously required an explicit environment variable, is now standard behavior on three of the managed platforms (Bedrock, Vertex AI, Foundry). Users accessing it through Anthropic’s public APIs continue with the flag. The change simplifies the experience for teams working on shared infrastructure: an agent that starts a task completes it without asking for confirmation at every step, but with limits configured upfront.

Bugs fixed

Beyond the consent fix, the release corrects:

• Terminal frozen during streaming: when a response contained very long lists, tables, or code blocks, keys stopped responding. Now the flow is stable.
• Auto-updater overwriting custom launchers: if you had a symlink or custom script at ~/.local/bin/claude, each update replaced it. Now /doctor alerts you if the launcher is externally managed and the updater leaves it alone.
• Crash loop in agent teams: a malformed message in a teammate’s mailbox sent the agent into an error loop every second until you deleted the file manually. Now corrupted messages are skipped instead.
• Malformed glob patterns: in .ignore, .worktreeinclude files and rules, patterns with broken square brackets blocked file reading. Now they’re ignored instead of breaking the worktree.

Practical implications

If you manage a team on Bedrock or Vertex AI, check your disableAutoMode settings: auto mode now runs by default, and if your workflow preferred step-by-step confirmation, it needs to be explicitly disabled. If you encountered the frozen terminal bug, this version should resolve it without further action.

For those developing Git worktrees with Claude Code, the fix to the extensions.worktreeConfig field means tools like tea (which use go-git) work again after removing a sparse worktree.

What we still don’t know

The release doesn’t state whether the July 5 session leak was reproducible or if it’s been definitively closed. The consent fix reduces one vector, but neither confirms nor refutes the shared cache hypothesis across workspaces. Anthropic hasn’t published a public post-mortem on the incident, so it remains unclear whether there were other factors beyond remote settings.

The build was released July 11 at 00:52 UTC, so those updating now already have this version. Those managing large-scale deployments should verify that auto mode by default doesn’t cause unexpected loops on unsupervised tasks.