Putting a Checkpoint at the Moment You Switch Models — Claude Code v2.1.251 Closes the Switch Hooks, the Cache Dial, and the Symlink Loophole All at Once
Claude Code v2.1.251 is out. It ships PreModelSwitch/PostModelSwitch hooks that intercept model switches, a prompt-cache breakdown and spend-limit bar in /cost, and a fix for a symlink loophole in file operations — all at once, shoring up the plumbing for unattended operation.
On August 28, 2026, Anthropic released v2.1.251 of its coding agent, Claude Code. This update targets workflows that run long, unattended sessions while switching between multiple models, and it touches three layers at once: hooks that intercept "the moment you switch models," instrumentation that puts a dial on cache and cost, and the closing of a loophole that lingered in file operations.
Making Room to Step In Before and After a Switch
The headline change is the addition of two hook events that respond to model switches. When the agent changes models mid-run, you can now insert your own processing before and after. There are three uses: stop, verify, and record.
| Hook | When it fires | What it can do |
|---|---|---|
PreModelSwitch | Just before switching models | Block the switch / insert a confirmation / attach an annotation |
PostModelSwitch | Immediately after switching | Record and notify that the switch happened |
Until now, it was hard to tell which model a piece of work had run on until after the fact. With these hooks, you can insert operational rules such as "require human approval before any automatic promotion to a more expensive, higher-tier model" or "log it whenever the agent drops down to a cheaper model." The more you automate model selection, the more this checkpoint pays off.
A Dial on Cache and Cost
Cost visibility has also advanced. To address how hard costs are to see in unattended runs, several measurements have been added.
- Prompt cache breakdown:
/costnow has a per-session line that surfaces hit rate, misses, the number of tokens re-cached, and the warm/cold distinction. - A cost preview on resume: the
SessionStartresume hook can now receive a session's staleness and the estimated cost required to re-cache it. Before reopening an interrupted session, you get a sense of the expense. - A spend-limit bar:
/usagenow includes a bar showing remaining spend against your limit, and the status line gains arate_limits.spend_limitfield (for users who set limits via a gateway).
If your cache hit rate drops, that shows up directly as wasted token resends — that is, expense. With the numbers on display, you can now tighten costs one move at a time, measuring instead of trimming by gut feel.
Closing a Loophole That Lingered in File Operations
This update also includes security fixes you can't afford to overlook. Each one is a hole that let the agent reach outside the scope you thought you had approved — the kind of thing that carries real risk in unattended runs or when working on someone else's repository.
- Symlink swaps in the file tools: fixed an issue where Read/Write/Edit would follow a symbolic link that had been swapped in within the working directory after the permission check. This is a so-called time-of-check-to-time-of-use loophole that exploits the gap between the check and the execution.
- Plugin path escape: plugin commands registered from a marketplace could point outside the plugin directory; this behavior is now rejected as path traversal.
- Deny-rule leak in search: fixed a case where Grep and Glob were not applying
Read(...)deny rules to the files a symbolic link pointed to.
It's no small thing that these "routes out beyond what was approved" persisted behind the convenience. Especially in setups that lean toward auto-approval by default, the robustness of the permission check itself is the foundation of safety. The fact that fixes have landed is welcome, but it's also a warning: the more you run unattended, the less you can afford to fall behind on updates.
Reining In an Always-Running Session From Your Own Machine
Tools for handling sessions that run in the background or remotely have also grown. claude --help now includes attach, logs, stop, respawn, and rm, and the --resume message now spells out the exact command needed to reconnect. On top of that, there's a new feature that streams a foreground subagent's tool calls and results to the Remote Control client in real time.
One Step Toward Visibility for Unattended Operation
On its own, v2.1.251 is short on flash, but its direction is consistent. A place to step into model switches, dials for cost and cache, the closing of loopholes, and controls for running sessions — all of it is the underpinning for running agents without a human watching over them the whole time. For adopters, a practical entry point is to first measure the waste in your own workflow using the new cost displays, then use the model-switch hooks to put your promotion and demotion rules into words. To pick up the file-operation fixes as well, it's safest to keep up with updates early.
References: Claude Code changelog (official) / anthropics/claude-code CHANGELOG.md / Releasebot: Claude Code updates
