Claude Code v2.1.197 — Your Enterprise Deployment Just Changed Without Asking

Claude Code v2.1.197 dropped on July 11, 2026 with a change that matters more than its changelog position suggests: Auto Mode is now on by default for every Bedrock, Vertex AI, and Foundry deployment. No CLAUDE_CODE_ENABLE_AUTO_MODE=1 environment variable needed. Alongside that flip, Anthropic patched a bug where non-interactive runs — claude -p and SDK invocations — were permanently recording remote managed settings as consented without ever surfacing the consent dialog to a human. If you run Claude Code in CI against any cloud provider, your pipeline has been accepting security permissions nobody reviewed.

TL;DR

• Auto Mode is now opt-out on Bedrock, Vertex AI, and Foundry — no env var required, disable via disableAutoMode in settings
• Consent bug patched — headless claude -p and SDK runs were silently recording managed settings as consented without showing the security dialog
• Settings scope changed — autoMode is no longer read from .claude/settings.local.json (repo-resident); only ~/.claude/settings.json is honored
• Action: Treat this as a security event — audit your fleet’s disableAutoMode setting and review any managed policies accepted during headless runs

What Happened

Four changes landed in a single release that individually are reasonable but together demand immediate attention from any team running Claude Code against cloud providers.

Auto Mode goes opt-out. Previously, enabling Auto Mode on Bedrock, Vertex AI, or Foundry required setting CLAUDE_CODE_ENABLE_AUTO_MODE=1 explicitly. That gate is gone. Every cloud deployment now runs Auto Mode unless you set disableAutoMode in your settings. The practical effect: Claude Code’s autonomous action classifier now decides which operations need human approval and which proceed silently. If your security team approved Claude Code with Auto Mode off, that approval no longer matches your runtime behavior.

The consent bypass fix. This is the one that should trigger an incident review. In non-interactive runs — the SDK and claude -p invocations that power CI pipelines and automated workflows — remote managed settings were being permanently recorded as consented. The security consent dialog, which exists specifically to force a human to review and approve managed policies, never appeared. The settings were just accepted. Anthropic’s changelog calls this a fix, but the implication is clear: any team that has been running headless Claude Code with managed policies has an unknown number of silently approved permissions in their consent records.

Settings scope narrowed. The autoMode setting is no longer read from .claude/settings.local.json, which lives inside a repository. It now reads exclusively from ~/.claude/settings.json, the user-level config. Teams that configured Auto Mode at the project level through the repo-resident settings file silently lost that configuration. The setting still exists in the file — it just does nothing. No warning, no migration notice in the changelog.

Default model bumped to Opus 4.8. Bedrock, Vertex AI, and Claude Platform on AWS now default to Claude Opus 4.8, released May 28, 2026. Opus 4.8 runs at $5/$25 per million input/output tokens. If your team was running a prior model and relying on the platform default, your token costs just changed. The enforceAvailableModels setting that lets you pin to a specific model allowlist is enterprise-tier only.

A separate security hardening change blocks ${user_config.*} interpolation in shell-form hook, monitor, and MCP headersHelper commands. Teams using plugin config templating with shell-form commands must migrate to exec form (args arrays) or environment variables. This closes a shell-injection vector that could have allowed crafted plugin configs to execute arbitrary commands.

Why This Matters

The consent bug is not a minor fix. It is a retroactive discovery that your security posture was not what you thought it was. Every claude -p invocation against a managed deployment has been auto-accepting whatever policies the managed settings specified. If your organization uses Bedrock or Vertex with managed security policies, those policies were stamped as “consented” by a process that never consulted a human. The fix prevents future silent consent, but it does not undo past records. You need to audit your consent state manually.

The Auto Mode default flip compounds this. Auto Mode is genuinely useful — it reduces the interrupt rate for routine operations and makes Claude Code practical for longer autonomous tasks. But “useful” and “approved by your security team” are different categories. Regulated teams that went through an approval process for Claude Code likely evaluated it with Auto Mode disabled. That evaluation is now stale. The Auto Mode classifier decides what is safe to execute without human intervention, and those classifier rules are the ones your security team needs to have reviewed. Whether they actually did depends on whether anyone noticed this changelog entry.

The settings scope change is the quietest breaking change. If your team standardized on repo-level .claude/settings.local.json to enforce consistent Auto Mode behavior across developers — a reasonable practice — that enforcement is gone. The setting is now per-user only. There is no project-level override for autoMode anymore. This pushes Auto Mode configuration to individual developer machines or to managed deployment policies, which is where Anthropic clearly wants it, but the migration path is “discover it stopped working.”

The model default change has straightforward billing implications. Opus 4.8 is more capable than its predecessors, but teams running high-volume automated pipelines against Bedrock or Vertex are now paying Opus 4.8 rates unless they explicitly pin a cheaper model. The enterprise-only gate on enforceAvailableModels means non-enterprise teams cannot lock their fleet to a specific model — they get whatever the platform defaults to.

If you run claude -p or the SDK against Bedrock, Vertex AI, or Foundry in CI pipelines: your managed security policies were silently accepted without human review. Audit your consent records and re-review your managed settings before your next deployment.

Bundling these changes — especially the consent fix and the Auto Mode default — into a single release without a dedicated security advisory is a pattern we have seen before from Anthropic. When config file injection surfaced as an attack vector, the fix landed in a routine release without a CVE or incident post. The consent bypass arguably deserved its own disclosure. Silent acceptance of security policies in automated runs is exactly the kind of issue that enterprise security teams track as incidents, not as changelog bullets.

Check your fleet immediately: run grep -r "autoMode" ~/.claude/settings.json and any .claude/settings.local.json files in your repositories. The repo-level setting is now ignored — move it to user-level config or managed deployment policies.

The Take

Auto Mode going opt-out on cloud providers is the right call for enterprise adoption. The opt-in gate was the single biggest friction point for teams evaluating Claude Code against Bedrock and Vertex — it required every developer to set an environment variable that most forgot, creating inconsistent behavior across the fleet. Removing that gate is a pragmatic move.

But Anthropic bundled it with a consent-bypass fix that deserves incident-level treatment, not a changelog line item. If your CI pipeline has been running claude -p against any cloud provider with managed policies, you accepted permissions you were never shown. That is not a bug fix — that is a disclosure that your security consent records are unreliable for an unknown period.

I would treat this release as a security event. Rotate your managed settings review. Audit what disableAutoMode is set to across your fleet. Verify that the Auto Mode classifier rules match what your security team actually approved. And if you are on a keyless Workload Identity Federation setup, double-check that your IAM policies still reflect the permissions Claude Code is actually exercising — because the defaults just shifted under you.