The CLI's Default Model Just Swapped In a Million-Token Brain — Claude Code v2.1.257 Makes Fable 5.1 the Standard and Adds a 'Containment Escape' Checkpoint to Auto Mode

Claude Code v2.1.257, released on September 1, 2026, swaps out the default model itself for the command-line coding agent. Replacing the previous initial pick, the new model "Claude Fable 5.1" (model ID claude-fable-5-1), which can handle a one-million-token context, becomes the standard. On top of that, "auto mode"—which runs without pausing for human confirmation—gains new guardrails to keep dangerous operations from slipping through. For developers, it amounts to the tool's "brain" and its "safety mechanism" being swapped out in the same update.

What it means for the default to become a "million-token context"

The headline change is that Fable 5.1 has been promoted to the default model. Its context window is one million tokens, and you get that full length from the start—no beta header required. In practice, the benefit is that when you feed it an entire repository or a long design document at once, you run into fewer moments where the context overflows midway and you're forced to fall back on summarization. Pricing is as follows, per the source's stated figures.

"The default becoming a long-context model" also affects the many users who run it without touching any settings. A long context is convenient, but as the number of tokens you feed in grows, so does the cost. Once the default changes, it's safest to take a look at whether your own usage patterns are ballooning the input volume.

The three "no free pass" rules added to auto mode

v2.1.257 adds a new "Containment Escape" rule to auto mode, where the agent decides on approvals in the human's place. This means that, unless the environment explicitly marks them as "expected," the following operations are excluded from automatic approval. Rather than mixing them into the prose, they're broken out separately here.

• Retrieving cloud metadata credentials: attempts to pull out authentication credentials tied to the execution environment.
• Egress evasion: attempts to slip past the outbound restrictions on communication.
• Cross-tenant access: attempts to reach beyond the intended scope into a different environment.

Alongside this, a behavior was added that inserts a one-time confirmation before the agent reads a file outside the working directory for the first time. Using the permissions.blockReadsOutsideWorkingDirectories setting, you can reject such out-of-scope reads en masse. The more an agent runs unattended, the earlier you'll want to seal off any tendency to go read places you didn't anticipate.

Small touches for operators

They tend to get overshadowed by the model and safety overhaul, but there are also tweaks that lighten day-to-day operations.

• Time-display settings: with timeFormat you can choose 12-hour, 24-hour, UTC, or a custom pattern, and with timeZone you can specify the time zone. You can align the timestamps in logs and records to your own reference.
• Pinning the subagent model: the CLAUDE_CODE_SUBAGENT_MODEL_FORCE environment variable lets you force the same model on every subagent that gets spawned.
• Session-scoped effort adjustment: /effort s lets you change how much reasoning power is applied for just that session.
• Beyond these, it also includes a fix for a bug where settings in .claude/ weren't applied until a restart, as well as a /doctor warning about old sandbox mask files.

The convenience, and what to tighten behind it

With the default model changing to the million-token class, usage patterns that assume a long context become easier to pull off. At the same time, the fact that a "containment escape" guardrail landed in auto mode simultaneously is the flip side of a warning: the more you delegate judgment to unattended operation, the wider the surface area of risk becomes. This update tilts automatic approval toward the safe side, but if you misconfigure the settings that mark things as "expected" on the environment side, you'll end up throwing open the very checkpoint you were given. As you take in the convenience, operators need to stay conscious of where they draw the line—how far to block, by default, moves like credential retrieval and out-of-scope reads.

References: Claude Code official changelog / anthropics/claude-code Releases / Releasebot: Claude Code Updates / Claude Platform Docs: Context windows