Claude Code's Permission Shift and the Copilot Identity Clampdown

Claude Code Flips to Manual Permissions by Default

If your engineering teams run Claude Code in any kind of shared or CI environment, Claude Code v2.1.200 is the release that changes their daily workflow. The "default" permission mode has been renamed "Manual" and that's now the default across the CLI, VS Code, and JetBrains. AskUserQuestion dialogs no longer auto-continue — the agent waits for explicit human input unless you've opted into an idle timeout via /config.

This is a meaningful posture shift. Up until now, unattended Claude Code sessions could proceed through tool calls without a human in the loop. For a developer running it locally on a personal project, that was a productivity win. For a 10,000-seat org where someone has wired Claude Code into a shared worktree or a pipeline that touches production systems, the prior default was an audit problem waiting to happen. The same release also tightened MCP server trust: claude mcp list / get no longer auto-spawns servers that a repo self-approved via a committed .claude/settings.json. Untrusted workspaces now show ⏸ Pending approval.

What to do: If you've built any automation around the old permissive default, you'll need to explicitly set "defaultMode": "manual" or --permission-mode manual in your configuration to acknowledge the change, then decide whether individual workflows warrant an idle timeout. Treat the MCP trust change as a prompt to audit any repos that have a committed .claude/settings.json with self-approved servers — those approvals are now blocked in untrusted contexts.

Claude Sonnet 5 Is Now the Default Model in Claude Code

Claude Code v2.1.197 made Claude Sonnet 5 the default model, with a 1M-token context window and promotional pricing through August 31. Simon Willison's breakdown of what's new in Sonnet 5 notes that Anthropic describes its performance as "close to that of Opus 4.8, but at lower prices" — and the system card explains why it cleared US export controls that initially blocked Mythos 5: its cyber-task capabilities are deliberately constrained relative to the frontier models.

For clients running Claude Code across engineering teams, this is the most cost-relevant change of the month. A 1M context window changes what's practical for large-codebase work — full repo ingestion without chunking gymnastics is now the default starting point, not a special-case prompt strategy.

What to do: Update to v2.1.197 or later. If your org console has pinned a specific model, revisit that pin — the new org-default-model feature (shipped in v2.1.196) lets admins set a model in the console that surfaces as "Org default" in /model. That's cleaner than per-repo overrides for most enterprises.

Copilot Studio Moves to Block Maker Credential Oversharing

Two entries landed on the Microsoft 365 Roadmap this week that belong together. First: admins will be able to block AI agents from using maker-provided credentials entirely — preventing a situation where an agent inherits a builder's access rights and runs with them at scale. Second: credential oversharing detection will surface at publish and share time, not after the fact, blocking agents and flows that rely on unsafe identities before they reach end users.

Both are targeting GA in September 2026, with the oversharing detection entering preview this month. If you've built Copilot Studio agents in a tenant where makers have broad SharePoint or Dataverse access, this is the governance gap these features are closing. The risk pattern is straightforward: a maker with Global Reader or a broad service account builds an agent, shares it org-wide, and the agent now has that maker's data access for every user who invokes it.

What to do: Before September GA, map which of your current Copilot Studio agents use maker credentials for connector authentication. Any agent touching sensitive data — HR systems, finance connectors, regulated SharePoint sites — should be re-evaluated now. The enforcement is coming whether you're ready or not; a controlled migration is better than an emergency remediation when the policy starts blocking publishes.

Tool Schema Drift Is Getting Worse With Newer Models

Simon Willison flagged a report from Armin on a schema compliance regression affecting Opus 4.8 specifically. The short version: newer Claude models are sometimes emitting extra, invented fields in tool call arguments — fields that don't exist in the schema. The tool call content is often correct, but the arguments don't match, so a strict schema validator rejects the call and the model retries. What's notable is that this is getting worse with newer models, not better.

For any client building MCP-connected agents or custom tool-use integrations, this is a live reliability issue. If your tool handlers do strict schema validation — which is the correct security posture — you may be seeing silent retry loops that inflate token costs and latency without obvious errors in your logs.

What to do: Audit your tool call validation layer. Consider whether you can tolerate additional properties via additionalProperties: true on non-security-critical tools, while keeping strict validation for any tool that writes data or crosses a trust boundary. Log rejected tool calls explicitly — the failure mode here is invisible if your retry logic swallows the error.

Claude Code Background Agents Now Open Draft PRs Automatically

Claude Code v2.1.198 changed the behavior of background agents launched from claude agents: when a session finishes code work in a worktree, it now commits, pushes, and opens a draft PR automatically, rather than stopping and requiring a manual push. The same release added notification hooks (agent_needs_input / agent_completed) so your tooling can respond to agent state changes without polling.

This closes the last manual step in the "assign work to a background agent, walk away, come back to a PR" workflow. For engineering teams using Claude Code for parallel feature work or issue triage, the practical shape of that workflow just got simpler. The draft PR pattern also fits naturally into review-gated pipelines — the agent produces the artifact, a human or CI system gates it.

What to do: If you're running background agents for any automated work, update to v2.1.198 and verify your repo permissions allow the Claude Code identity to push branches and open PRs. Set up the notification hooks if you want Slack or webhook alerts when agents complete — the agent_completed hook is the trigger you want for downstream automation.

---

Next week, watch whether Anthropic clarifies the Fable 5 / Mythos 5 export control restoration timeline — the lifted restriction notice was brief, and enterprise clients in regulated sectors will want explicit guidance on what "restoring access" means for GCC-High and sovereign cloud deployments.