Claude Report — 2026-08-30

🚀 Anthropic Official

Claude Code v2.1.248 (Aug 27, 22:12 UTC)

Adds --restricted (or CLAUDE_CODE_RESTRICTED=1), which strips command/code-execution tools and WebFetch, confines file tools to the working directory, refuses bypassPermissions, and ignores user/project/local settings files; adds experimental.cacheTtl in agent frontmatter for per-agent prompt-cache TTL; adds cross-session messaging (SendMessage/ListAgents) between sessions on the same machine on Bedrock, Vertex, and Foundry; adds /usage-credits for AWS-Marketplace, self-serve, and trial Enterprise orgs; adds server-managed settings diagnostics (startup warning plus /doctor//status detail) and a GitHub-CLI-scope warning in /web-setup.

• Also fixes a prompt-cache miss from tool definitions re-rendering after OAuth token refresh, Claude Desktop/Cowork sessions vanishing after 30 days, and a login-screen bug when another Claude Code process held the token-refresh lock.

Claude Agent SDK TypeScript v0.3.248 / Python v0.2.146 (Aug 27, ~22:12-22:26 UTC)

TS adds a per-server timeout for SDK-hosted MCP servers (createSdkMcpServer({ timeout })), overriding MCP_TOOL_TIMEOUT for that server's tool calls; Python bumps its bundled Claude CLI to v2.1.248 for parity.

How Anthropic employees use Claude Tag (Aug 28)

Documents internal use of Claude Tag (@claude in Slack threads) across legal, support, and debugging workflows, including a legal-review channel that cut marketing-asset turnaround from a day to 30 minutes.

Automated Researchers Can Reliably Mitigate Alignment Failures (Aug 28)

Shows automated alignment researchers searching literature, proposing fixes, and training against 10 misalignment benchmarks (deception, sycophancy, jailbreaks), improving every benchmark without capability loss, at roughly $4/hour versus $150/hour for human researchers; open-sources the harness.

🔌 Claude Code Plugins

Plugin tracking skipped this run — marketplace install-count cache unavailable.

🛠️ Skills

agentskillexchange/skills

Adds an Agent QA regression testing skill (#61) and an automation integration preflight skill (#60), plus a preflight install-instructions fix (#62), Aug 30, continuing its near-daily automated catalog sync.

tt-a1i/archify

Merges a vulnerable fast-uri dependency override (#209), a dataflow fix for degenerate vertical-edge points (#203), a vulnerability-reporting security policy (#164), and a chat-first onboarding improvement (#162), Aug 29-30.

Unchanged in window: Piebald-AI/claude-code-system-prompts (last diff Aug 28, covering v2.1.251), alirezarezvani/claude-skills (last push Aug 26), anthropics/skills (last push Aug 21).

🤖 Agents & Subagents

nicobailon/pi-subagents

Merges a run of performance PRs — caching trusted external-run Fleet records, reusing fresh agent-discovery snapshots, serving untargeted RPC status from memory, and adding session-aware background-work listing — all Aug 30.

anthropics/claude-agent-sdk-typescript

See Anthropic Official above — reaches v0.3.248 (Aug 27) with per-server MCP timeouts.

anthropics/claude-agent-sdk-python

See Anthropic Official above — reaches v0.2.146 (Aug 27) for CLI parity.

Unchanged in window: AMAP-ML/LongHorizon-Harness (last push Aug 20), VoltAgent/awesome-claude-code-subagents (last push Aug 12).

🔗 MCPs & Integrations

DeusData/codebase-memory-mcp

Merges cross-file base-class resolution for the Python/TS cross-LSP, a new manage_adr section-splice mode, index-time BM25 full-text search over prose content, and first-party Chialisp language support, through Aug 29.

Unchanged in window: modelcontextprotocol/python-sdk (last merge Aug 28, already reported), github/github-mcp-server (last merge Aug 26), modelcontextprotocol/typescript-sdk (last merge Aug 25), oraios/serena (last push Aug 20).

💡 Community — Workflows & Ideas

Breaking Claude Code Opus 5 Auto Mode (Aug 27)

Researcher Johann Rehberger (wunderwuzzi) shows Claude Code's Auto Mode can be hijacked ~80% of the time just by asking it to summarize a malicious website: a failed WebFetch nudges Claude into extracting a ZIP archive, and Python's module loader picks up an attacker-controlled struct.py from that directory instead of the standard library, executing arbitrary code — a reminder that a 0% classifier-measured injection rate doesn't cover multi-step benign-looking chains.

📰 Quick Mentions

• Sony Music Publishing and Warner Chappell sue Anthropic (Aug 28) — allege piracy-based training on "tens of thousands" of copyrighted songs, seeking up to $150k per work, building on the Bartz v. Anthropic precedent.