Claude Code Daily Briefing - 2026-06-24

Release Summary

VersionDateKey Changes
v2.1.1876/23sandbox.credentials (block sandboxed commands from reading credential files and secret env vars), org-configured model restrictions (picker, --model, /model, ANTHROPIC_MODEL), mouse clicks in fullscreen menus, remote MCP tool calls abort after a 5-min hang (CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT), fixed pasted Korean/CJK mojibake, /install-github-app workflow step now optional, and more
v2.1.1866/22claude mcp login/logout <name>, ! bash output now gets an automatic Claude response (respondToBashCommands), CLAUDE_CODE_MAX_RETRIES capped at 15 + RETRY_WATCHDOG, background subagent permission prompts surfaced in the main session

Last night (6/23) shipped v2.1.187 — a feature release two days running after v2.1.186 (6/22). The headlines are sandbox.credentials, which blocks sandboxed commands from reading credentials and secrets, and org-level model restrictions (see New Features below). The second axis of the day is another platform incident on 6/23 — the third stability wobble this week (Security & Limitations).

Full release notes

New Features & Practical Usage

sandbox.credentials — stop sandboxed commands from reading credential files and secret env vars (v2.1.187)

This is the release headline. The new sandbox.credentials setting blocks commands running in the sandbox from reading credential files (e.g., ~/.aws/credentials, .env, token files) and secret environment variables.

// .claude/settings.json — block sandboxed commands from touching credentials/secrets
{
  "sandbox": {
    "credentials": "deny"   // follow the official settings docs for the exact key/value
  }
}

The practical point is clear: the environment an agent runs in almost always has API keys, cloud credentials, and tokens sitting somewhere, and running arbitrary shell commands under automation creates paths for those secrets to leak via command output, logs, or outbound calls. sandbox.credentials closes that path with a runtime block rather than the model’s good intentions — the same spirit as the 6/22 point “enforce must-follow rules with a hook, not a prompt” (here a sandbox setting plays that role). Today’s recommended read, “Hacking Google with AI for $500K,” is the exact pairing: since the most common bugs it surfaced were missing-auth APIs and absent permission checks, the cheapest first line of defense is reducing the credentials an agent can touch at all. GitHub v2.1.187

Orgs can restrict which models are available — enforced across the picker, --model, and ANTHROPIC_MODEL (v2.1.187)

Admins can now define an allowed model list at the org level. When a user selects a restricted model — whether via the model picker, the --model flag, the /model command, or the ANTHROPIC_MODEL env var — they now see a “restricted by your organization’s settings” message.

The key is that it applies consistently across every entry point — someone routing around it via ANTHROPIC_MODEL hits the same restriction. Read against the current backdrop, the meaning sharpens: with model availability in flux under export controls (see Fable 5 / Mythos 5 below) and models quietly deprecated or auto-swapped (6/20), orgs now have a lever to pin “our team uses only these models” centrally. When you want to fix a model for compliance, cost, or reproducibility in CI or a team standard, you can now enforce it as org policy rather than per-developer config. GitHub v2.1.187

Developer Workflow Tips

Close the secret-exfiltration path in unattended automation with sandbox.credentials

The first place to apply sandbox.credentials is unattended automation. When an agent runs arbitrary shell commands in CI, cron, or a background session, those commands could, by default, read credential files and secret env vars on the machine — and intentional or not, once a secret lands in output it can leak through logs, artifacts, or outbound calls.

The recipe is simple: in your automation profile’s .claude/settings.json, block credential/secret reads with sandbox.credentials, and push any task that genuinely needs a secret (say, a specific API call) behind a tool or MCP server that doesn’t expose the secret to the model. This sits alongside the 6/21 WIF (no static keys) and the 6/19 least-privilege subagents (narrow tools:) — it’s the third tool pointing the same direction: shrink the surface of secrets an agent can touch. (Follow the official settings docs for the exact key/value.) GitHub v2.1.187

Hung remote MCP tool calls now abort instead of blocking forever — CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT

If you run Claude Code unattended in CI or cron, grab this one-liner of a fix: a remote MCP tool call that hangs with no response for 5 minutes now aborts with an error instead of blocking indefinitely. The threshold is tunable via CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT.

# Keep a dead remote MCP server from freezing the whole session (e.g., abort after 60s idle)
export CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT=60

The point is a guard against one hang stalling an entire unattended run. When a remote MCP server drops its response to a network issue, the tool call used to sit there and freeze the whole session. Now an idle timeout cuts the call so the agent can move on or fail cleanly — the kind of change that reduces “why did last night’s job sit stalled until morning?” in a cron pipeline. If you run long unattended jobs, set this variable short, to match your workload. GitHub v2.1.187

Security & Limitations

Another incident on 6/23 — elevated error rates across multiple models (third this week)

On 6/23, Claude hit another incident. Per status.claude.com, Anthropic opened an investigation into elevated error rates across multiple models at 14:19 UTC, moved to identified with a fix by 14:25 UTC, and resolved at ~16:44 UTC (~2.5 hours). The blast radius was wide — Claude.ai, Claude Console, Claude API, Claude Code, and Claude Cowork were all affected, and Downdetector logged 8,000+ reports in the US alone at peak.

Each incident recovered, but the pattern is the signal — after the 6/18 full outage and the 6/20 “Opus 4.8 errors,” this is the third stability wobble this week. Claude Code in the terminal rides the same backend, so even a short outage can break an unattended run wholesale. If you run Claude Code in CI or cron, the standing answer is to build retries, backoff, and failure alerts into the pipeline (and revisit them alongside the 6/22 CLAUDE_CODE_MAX_RETRIES cap of 15 and RETRY_WATCHDOG). Claude Status — Incident History · TechRadar

Fable 5 / Mythos 5 — day 12 of the export-control suspension, still offline for everyone, and subscription inclusion has ended too (6/23)

A multi-day story, so just the update: two things converged on 6/23. (1) On day 12 of the export-control directive (issued 6/12), Fable 5 and Mythos 5 remain offline for every user — not just foreign nationals, but everyone worldwide, because there’s no real-time way to segment US persons from foreign nationals. The “back in days” an executive voiced on 6/19 has not materialized as of 6/24. (2) At the same time, Fable 5’s free subscription-inclusion window (6/9–6/22) ended on 6/23 — so even when the model returns, it falls under separate billing (usage credits) rather than a bundled plan.

In short, both “when does it come back” and “how is it billed when it does” landed on the unfavorable side. Foreign-national developers (Korea, Japan, etc.) were already cut off, so the practical answer is unchanged: keep an Opus 4.8-class fallback wired in via fallbackModel / availableModels, and design automation on the premise that model availability can hinge on geopolitics and policy, not your company. Anthropic statement · cryptobriefing

Minor Changes

Practical changes and fixes in v2.1.187 not covered above.

Interesting Projects & Tools

By subscribing, you agree to our Privacy Policy.