Claude Code 2.1.251: Five Security Patches, Model Switch Hooks, and Opus 5 as the Enterprise Default

Claude Code 2.1.251 landed on August 28 with a dense changelog: five security fixes, new hooks for model switches, improved cost visibility, and a change that makes Opus 5 the default model for seat-based Enterprise accounts.

Security Fixes

This release addresses five separate security issues:

1. Symlink exploitation in file tools — Read, Write, and Edit could follow symlinks swapped inside the working directory after a permission check, allowing reads or writes outside the approved location. Fixed.
2. Plugin path traversal — Plugin commands in marketplace entries pointing outside the plugin directory now get rejected with a path-traversal error rather than executing.
3. Debug tracing bypass — Project settings could enable detailed beta tracing or raw API body logging. The lower-scope beta tracing endpoint no longer bypasses the OTLP collector.
4. Workflow tool scope check — The Workflow tool was reading scriptPath outside the session’s readable scope before the permission check ran. Now fixed.
5. Grep and Glob symlink rules — Both tools were not applying Read(...) deny rules to files reached through symlinked search paths.

None of these appear to require immediate action for most users, but the symlink and path traversal fixes are worth noting if you run Claude Code with untrusted plugins or in shared environments.

PreModelSwitch and PostModelSwitch Hooks

Two new hook events let you intercept model changes: PreModelSwitch runs before a model switch and can block or confirm it, PostModelSwitch runs after and can annotate what happened. SessionStart resume hooks now also receive session staleness and the estimated re-cache cost — useful for deciding whether to pay for a warm cache or start fresh.

Cost Visibility

The /usage command now shows a spend limit bar for sessions running behind a Claude apps gateway with spend limits configured. /cost gets a per-session prompt-cache line showing hit ratio, misses, tokens re-cached, and warm/cold status. The same data is exposed as a prompt_cache object for status line scripts.

Enterprise Default: Opus 5

Seat-based Enterprise subscriptions now default to Opus 5. The /effort command also saves the default effort level per model rather than globally, so different models can have different defaults.

The CLAUDE_CODE_SUBAGENT_MODEL environment variable now sets the default rather than an override — agent definitions’ model: field and explicit spawn model settings take precedence over it.

Other Changes

Bug fixes: Conversations no longer get stuck on “text content blocks must be non-empty” errors after turns with only thinking blocks. Opus 5 requests no longer fail with “effort is not supported when thinking is disabled” (effort is now sent as high). The TUI lag that appeared with many parallel subagents is fixed. Agent team leads now actually receive their teammates’ final answers.

CLI improvements: attach, logs, stop, respawn, and rm now appear in claude --help. The --resume message now names the exact claude attach <id> command.

Remote Control: Live streaming of foreground subagent tool calls and results is now available to Remote Control clients. Background subagents show status only.

Performance: The native binary is about 5 MB smaller. CPU usage during interactive session turns is lower thanks to reduced redundant UI re-renders.

The full release notes are on GitHub and the Claude Code changelog.