Claude Code v2.1.251 ships hook events, Remote Control subagent streaming, and a symlink path-traversal fix
Anthropic
Anthropic released Claude Code v2.1.251 on 2026-08-28 with a broad changelog. New capabilities: PreModelSwitch / PostModelSwitch hook events (block / confirm / annotate a model switch); live streaming of foreground subagent tool calls and results to Remote Control clients; a spend-limit bar on /usage and a rate_limits.spend_limit status-line field; a per-session prompt-cache line on /cost. Notable security fixes: file tools (Read/Write/Edit) now block reading/writing outside the approved location when a symlink is swapped inside the working directory after the permission check. Behaviour changes: default commit trailer is Co-Authored-By: Claude Code when the active model is not a recognised Claude model; seat-based Enterprise default model is now Opus 5; /effort saves default effort per model. A separate v2.1.250 (Aug 28) shipped as a bug-fixes point release.
Why it matters
v2.1.251 bundles a real symlink path-traversal fix that closes a sandbox-bypass class in the file tools, and the first built-in lifecycle hooks around model switches, which give teams a way to enforce policy on model choice rather than only on Bash or Edit. v2.1.250 was a quieter same-day point release.
Importance: 3/5
major Claude Code release; closes symlink path-traversal sandbox-bypass class