Anthropic · 2026-09-23 · major
Claude Code 2.1.281 — auto mode now asks before rm -rf "$(pwd)"
Claude Code 2.1.281 stops a recursive rm aimed at command-substitution output from running unprompted in auto mode, adds an "attribution": false setting, and fixes resumed sessions that lost earlier reasoning or the prompt cache.
A risky rm pattern now always asks, attribution can be switched off, and resumed sessions keep their reasoning and cache.
Quick facts
| Version | v2.1.281 |
|---|---|
| Maker | Anthropic |
| Released | 2026-09-23 |
| Safety fix | rm -rf "$(pwd)" asks even with a Bash allow rule |
| New setting | "attribution": false hides commit and PR attribution |
| Gateway | Bedrock assume_role and guardrails on upstreams |
What is it?
Claude Code 2.1.281 closes a gap where a recursive rm whose target was only command-substitution output, such as rm -rf "$(pwd)", ran without a prompt in auto mode and with --dangerously-skip-permissions. The command now asks even when a Bash allow rule matches. The release also adds "attribution": false in settings.json to hide all commit and PR attribution.
How does it work?
The dangerous-rm check now also flags removals at a shell variable followed by a top-level directory name or at a variable derived from the working directory. In unattended auto mode, the dangerous-rm prompt waits two minutes and then denies the command with a rewrite hint, so the session keeps going. Where auto mode's classifier runs server-side, read-only and sandboxed shell commands now also wait for its review.
Why does it matter?
Long sessions get more reliable. Anthropic fixed several ways a resumed session sent earlier turns in a changed form, which could make the API drop prior reasoning or break the prompt cache. Teams on the Claude apps gateway can now call Bedrock through an assumed IAM role and apply a Bedrock guardrail to every request. Send now (ctrl+enter) moves running tools to the background instead of cancelling the turn.
Who is it for?
Claude Code users running auto mode or long sessions
Frequently asked questions
- How do I turn off Claude Code's commit and PR attribution?
- Claude Code 2.1.281 accepts "attribution": false in settings.json to hide all commit and PR attribution. Anthropic warns that older Claude Code versions skip a settings file that holds this value, so teams sharing one settings file across versions should keep using the object form of the attribution setting.
- What happens to a dangerous rm command when nobody is watching the session?
- In Claude Code 2.1.281, the dangerous rm prompt in auto mode and --dangerously-skip-permissions waits two minutes for an answer. If nobody replies, Claude Code denies the command and gives the model a hint to rewrite it, so an unattended session keeps working. CLAUDE_CODE_DISABLE_DANGEROUS_RM_TIMEOUT=1 turns the timeout off.
- Does Claude Code 2.1.281 change how self-hosted runners pass system prompts?
- Yes. Claude Code 2.1.281 makes self-hosted runners pass system prompts as private files instead of command-line text, so large prompts no longer fail to launch. A wrapper or command hook that appends --system-prompt or --append-system-prompt must switch to --system-prompt-file or --append-system-prompt-file.
- What changed for Bedrock users on the Claude apps gateway?
- Claude Code 2.1.281 adds assume_role on Claude apps gateway Bedrock upstreams, so the gateway calls Bedrock as an IAM role it assumes through STS, even in another AWS account and optionally one session per developer. A guardrail setting applies an Amazon Bedrock guardrail to every request sent through those upstreams.
Try it
npm i -g @anthropic-ai/claude-code@2.1.281