Image: Image: Anthropic / github.com/anthropics/claude-code Claude Code 2.1.251: Five Security Patches, Model Switch Hooks, and Opus 5 as the Enterprise Default
The August 28 Claude Code release closes five security vulnerabilities including symlink exploitation and plugin path traversal, adds hook events for model switches, and changes the Enterprise default model to Opus 5.
Claude Code 2.1.251 landed on August 28 with a dense changelog: five security fixes, new hooks for model switches, improved cost visibility, and a change that makes Opus 5 the default model for seat-based Enterprise accounts.
## Security Fixes
This release addresses five separate security issues:
1. **Symlink exploitation in file tools** — Read, Write, and Edit could follow symlinks swapped inside the working directory after a permission check, allowing reads or writes outside the approved location. Fixed.
2. **Plugin path traversal** — Plugin commands in marketplace entries pointing outside the plugin directory now get rejected with a path-traversal error rather than executing.
3. **Debug tracing bypass** — Project settings could enable detailed beta tracing or raw API body logging. The lower-scope beta tracing endpoint no longer bypasses the OTLP collector.
4. **Workflow tool scope check** — The Workflow tool was reading `scriptPath` outside the session's readable scope before the permission check ran. Now fixed.
5. **Grep and Glob symlink rules** — Both tools were not applying `Read(...)` deny rules to files reached through symlinked search paths.
None of these appear to require immediate action for most users, but the symlink and path traversal fixes are worth noting if you run Claude Code with untrusted plugins or in shared environments.
## PreModelSwitch and PostModelSwitch Hooks
Two new hook events let you intercept model changes: `PreModelSwitch` runs before a model switch and can block or confirm it, `PostModelSwitch` runs after and can annotate what happened. `SessionStart` resume hooks now also receive session staleness and the estimated re-cache cost — useful for deciding whether to pay for a warm cache or start fresh.
## Cost Visibility
The `/usage` command now shows a spend limit bar for sessions running behind a Claude apps gateway with spend limits configured. `/cost` gets a per-session prompt-cache line showing hit ratio, misses, tokens re-cached, and warm/cold status. The same data is exposed as a `prompt_cache` object for status line scripts.
## Enterprise Default: Opus 5
Seat-based Enterprise subscriptions now default to Opus 5. The `/effort` command also saves the default effort level per model rather than globally, so different models can have different defaults.
The `CLAUDE_CODE_SUBAGENT_MODEL` environment variable now sets the default rather than an override — agent definitions' `model:` field and explicit spawn model settings take precedence over it.
## Other Changes
**Bug fixes:** Conversations no longer get stuck on "text content blocks must be non-empty" errors after turns with only thinking blocks. Opus 5 requests no longer fail with "effort is not supported when thinking is disabled" (effort is now sent as `high`). The TUI lag that appeared with many parallel subagents is fixed. Agent team leads now actually receive their teammates' final answers.
**CLI improvements:** `attach`, `logs`, `stop`, `respawn`, and `rm` now appear in `claude --help`. The `--resume` message now names the exact `claude attach ` command.
**Remote Control:** Live streaming of foreground subagent tool calls and results is now available to Remote Control clients. Background subagents show status only.
**Performance:** The native binary is about 5 MB smaller. CPU usage during interactive session turns is lower thanks to reduced redundant UI re-renders.
The full release notes are on [GitHub](https://github.com/anthropics/claude-code/releases/tag/v2.1.251) and the [Claude Code changelog](https://code.claude.com/docs/en/changelog).