Claude Code Auto Mode and Agentic Safety Land in the Same Week

Claude Code defaults to auto mode on August 14 — and two government labs just showed why that needs a policy answer

Starting August 14, auto mode becomes the default for new Claude Code sessions on Pro, Max, and Team plans. Simon Willison documented the change and surfaced the key admission from Anthropic's Cat Wu and Thariq Shihipar at AI Engineer World's Fair: virtually every Anthropic employee already runs auto mode, and Anthropic's own answer to prompt-injection risk is a combination of trust model and network controls, not a restricted mode.

For your engineering teams, this is a forcing function. If your Claude Code rollout hasn't produced a written auto-mode policy yet, August 14 is the date engineers will start sessions that make broader filesystem and tool decisions without per-step confirmation. That policy needs to define at minimum: which repo scopes are permitted in auto mode, whether headless/background agents inherit the same trust level, and how you audit what ran. The good news is the infrastructure to enforce this is already in the product.

Two AI safety institutes accidentally attacked real organizations with models — in the same week

Both the UK AI Security Institute and OpenAI's testing partner Irregular ran into the same failure mode within days of each other: evaluation environments with safety filters disabled that were supposed to be air-gapped but weren't. Simon Willison covered the UK AISI incident — 122 evaluation attempts, agents engaged in sustained unsanctioned activity against real organizations across a four-day window — and the OpenAI/Irregular event separately, where a fictional CTF target name resolved to a real company on the public internet.

Neither incident caused confirmed harm. Both caused a governance problem that lands directly on enterprise architects: if two well-resourced government safety programs failed to contain agentic evaluations, the assumption that your internal proof-of-concept environments are air-gapped is now suspect. Before your next Claude Code or Copilot agent POC, verify network egress at the infrastructure layer — not just at the model or prompt layer. The models respected the prompts; the networks didn't.

Claude Code v2.1.224 adds self-hosted runners and HTTPS plugin archives

The v2.1.224 release landed two capabilities that matter for regulated or air-gapped deployments. First, claude self-hosted-runner lets you turn your own machines or containers into the compute backing Claude Code web, mobile, and desktop sessions on Team and Enterprise plans. Second, plugins can now be installed from a zip over HTTPS with optional SHA-256 pinning — no git, no npm registry access required.

For clients in healthcare or financial services who have been holding back on Claude Code specifically because the runtime had to phone home to Anthropic infrastructure, the self-hosted runner is the unlock. Pair it with the ANTHROPIC_BEDROCK_REGION_PREFIX variable added in the same release to pin cross-region inference to a specific profile, and you have a viable path for Bedrock-backed deployments that stay within a defined regional boundary.

The v2.1.225 follow-on added gateway spend-limit support — the cap, its reset time, and the operator message now surface in the usage warning, which matters for any multi-tenant or chargeback deployment — and patched a Bash permission bypass where a crafted command could hide portions of itself from permission checks. That security fix warrants an immediate update for any team running Claude Code in a shared or CI environment.

Anthropic SDK v0.121.0 adds session budgets and advisor tooling

The Python SDK v0.121.0 (TypeScript SDK shipped the same features in v0.116.0) added session budgets, an advisor tool, pinned inference location, and skills auto-loading from GitHub. The mid-conversation-tool-changes beta header also graduated to a named API feature.

Session budgets give orchestration layers a token-level spend ceiling per session — critical if you are running multi-agent workflows where a runaway subagent can exhaust quota before a human reviews outputs. Pinned inference location is the API-side complement to the Bedrock region prefix in Claude Code: you can now express a preferred region at the SDK call level, not just via environment variable. If your data-residency commitments require inference to stay within a jurisdiction, this is the control surface to start with.

Copilot Studio adds Azure SQL knowledge source and Agent Readiness health check

Two Microsoft 365 Roadmap items closed the week on the Copilot side. Azure SQL knowledge source support in Copilot Studio extends the knowledge platform to business-critical SQL data, using the same connection framework already in place for SharePoint and other sources. If your Copilot Studio agents are currently routing SQL queries through a custom connector or a Power Automate flow, this is a simpler path — though you will want to evaluate row-level security passthrough before migrating production workloads.

Agent Readiness, targeting GA in September 2026, puts a persistent health indicator in the Copilot Studio build surface that surfaces policy blocks, missing evaluations, and publish blockers before a maker wastes time configuring something that was never going to clear DLP or sensitivity label checks. For tenants where governance review is the bottleneck on agent deployment, this should shorten the feedback loop between maker and admin considerably.

---

Watch next week for Anthropic's handling of the Claude Opus 5 system-prompt disclosure — the leaked system prompt documents how Anthropic instructs the model to accurately confirm the Fable/Mythos export-control suspension, and whether Anthropic formalizes that transparency posture into enterprise guidance will matter for customers operating in regulated export environments.