Changelog — September 1, 2026

The headline fact is that the price did not move. Fable 5.1 costs $10 per million input tokens and $50 per million output tokens — the same as the Fable 5 it replaces at the top of the range. What the unchanged price now buys is a 1M-token context window as the default rather than an opt-in, 128,000 max output tokens, always-on adaptive thinking, and cache reads at $0.25/MTok. That last number is the one worth doing arithmetic on: at 2.5% of the base input rate, re-reading a cached million-token context costs 25 cents against $10 cold. For any agent holding a large stable prefix across turns — a repository, a document set, a long system prompt — the cache is now the entire cost story, and a run that misses it pays 40×. Our cost calculator carries Fable 5.1, Mythos 5.1 and the demoted Fable 5 as of this run.

Mythos 5.1 is the same model on paper and unavailable to most readers. Same 1M context, same 128k output, same $10/$50, same always-on adaptive thinking — and limited to Project Glasswing participants. We list it in the calculator marked specialized rather than omitting it, because it now has published rates; missing rates are exactly why Mythos 5 stayed out for weeks. If you are not in Glasswing this line is informational, but the information is worth having: Anthropic charges the same for its gated research model as for the ungated one.

Now the part that breaks working code. On both models, tool_choice types any and tool are unsupported and return a 400. Forcing a tool call is a completely ordinary pattern for extraction, routing and structured-output loops, so a request that works today fails outright on 5.1. The replacements are strict_tool_use or structured_outputs. This is not a deprecation with a warning period; it is a 400 on the first call. Grep for tool_choice before you change a model string, because the failure presents as a model problem and is a parameter problem.

Two more constraints that matter more than they look. Thinking blocks are preserved only for the same or newer models — so a conversation started on 5.1 and continued on an older one loses its thinking context, which is a real trap for any router that falls back to something cheaper mid-conversation. And both models require 30-day data retention; zero data retention is not available. For a deployment approved on a ZDR basis that is a compliance blocker rather than a preference, and it is the most likely reason a regulated team stays on Opus 5. Relatedly, text from both models carries an Anthropic watermark, and images, video and audio produced by the code execution tool carry C2PA Content Credentials through the Files API.

Three beta features arrived alongside, all behind headers. Per-message effort changes (mid-conversation-output-config-2026-07-01), turn-scoped system messages (mid-conversation-system-clear-at-2026-08-21), and thinking.display: "updates" (thinking-display-updates-2026-08-18). The first two are the pair agent authors should look at: changing effort or system framing mid-conversation without restarting the turn is what lets one session triage cheaply and then solve expensively, which today usually means two sessions and a hand-off.

One administrative change that breaks scripts quietly. The Admin API, Enterprise Analytics API and Compliance API now require an anthropic-version header on every request. Internal tooling that called those endpoints without one stops working. A one-line fix, and an easy one to miss until a report comes back empty.

Also in this window, from August 26–27. The Compliance API took session endpoints out of beta for Cowork and Claude Code sessions and added beta local-session support for Claude Science and Microsoft 365 (Excel, PowerPoint, Word, Outlook) under the read:compliance_user_data scope. The Admin API reached the ant CLI and the Python, TypeScript, C#, Go, Java, PHP and Ruby SDKs via client.beta.organization. SDK updates (Python 1.2.0, TypeScript 0.122.0, Go 1.68.0, Java 2.59.0, Ruby 1.67.0, C# 12.44.0) dropped the beta-header requirement from client.beta.files and client.beta.skills, made client.beta.skills.delete() remove a skill with all its versions, and renamed BetaSkill to BetaContainerSkill. The Claude Console gained personal and service-account API keys, workspace-scoped or cross-workspace, with workspace API keys kept as a legacy option. And on September 3, ant CLI v1.30.0 added ant apply for creating and updating agents, environments, skills, memory stores and deployments from repository files, with a claude-lock.json lockfile.

Release notes → Affects: /claude-cowork/, /claude-cowork/vs-api/, /claude-cowork/pricing/, /tools/cost-calculator/

Start with the security fix, because it describes a race that defeats the whole permission model. v2.1.251 fixes "file tools (Read, Write, Edit) following a symlink swapped inside the working directory after the permission check, which could read or write outside the approved location." Read the ordering: the check runs against a path, the path is then re-pointed, and the operation follows it. That is a time-of-check-to-time-of-use bug, and it means an approved working directory was not a boundary against anything that could write a symlink into it — which includes the agent itself, and anything in a repository you cloned. Two siblings landed with it: Grep and Glob were not applying Read(...) deny rules to files reached through a symlinked search path, and plugin commands declared in a marketplace entry could point outside the plugin directory (now rejected as path traversal). Same shape three times — the rule was right and the path resolution was not.

Two more permission bugs in v2.1.260's line were serious enough to name here even though they land in the next entry. We flag them now because they share the theme: Edit/Write/Read rules whose path contains parentheses were dropped as invalid, which left "read-only" folders writable, and one rule with an uncompilable pattern made every file edit fail. A permission rule that is silently discarded is worse than one that errors, because the interface still shows it.

--restricted is the new blunt instrument, and it is a good one. v2.1.248 added --restricted (or CLAUDE_CODE_RESTRICTED=1): it removes the built-in tools that run commands or code and WebFetch unless named in --tools, keeps file tools inside the working directory, refuses bypassPermissions, and ignores user, project and local settings files. That last clause is what makes it trustworthy: a restricted session cannot be un-restricted by a .claude/settings.json in the repository you just cloned. If you have ever wanted to point Claude Code at untrusted code and read about it, this is the flag.

Auto mode got a rule aimed squarely at agent containment. v2.1.257 added a Containment Escape rule so cloud metadata-credential fetches, egress evasion and cross-tenant reach are no longer auto-approved unless the environment marks them expected. Cloud metadata endpoints are the classic path from "the agent can make an HTTP request" to "the agent has your instance role", and auto-approving that was a sharp edge. Alongside it, v2.1.257 added a one-time prompt before the first file read outside the working directories, with permissions.blockReadsOutsideWorkingDirectories to refuse them entirely.

Unattended hosts got a real answer. v2.1.259's --permission-prompts none — shipped in this window's tail — denies anything that would prompt while the active permission mode keeps deciding. That distinction is the useful part: it is not "allow everything" and not "fail on everything", it is "never block on a human". Organizations also gained managedMcpServers, which pushes HTTP/SSE MCP servers to every user with the same entry shape as .mcp.json; entries naming a command to run are skipped, which is the right refusal.

Model switching became hookable. v2.1.251 added PreModelSwitch and PostModelSwitch hook events that can block, confirm or annotate a switch, and SessionStart resume hooks now receive session staleness and the estimated re-cache cost. The second is quietly excellent: a resume hook can now decide whether resuming is worth the cache rebuild instead of guessing. v2.1.248 also added experimental.cacheTtl ("5m" or "1h") to agent frontmatter, and fixed a prompt-cache miss roughly once an hour in long sessions caused by tool definitions being re-rendered after an OAuth token refresh.

Fable 5.1 reached the CLI the day it launched. v2.1.257 added Claude Fable 5.1 (claude-fable-5-1) as the default Fable model, naming the same 1M context and $10/$50 with $0.25/MTok cache reads documented above. Same release: time-format and timezone settings (timeFormat, timeZone) for the turn-end clock and transcript timestamps, CLAUDE_CODE_SUBAGENT_MODEL_FORCE to apply one subagent model everywhere and ignore per-spawn overrides, and s in /effort for a session-only change, matching /model.

Everything else, briefly. v2.1.251 added live streaming of a foreground subagent's tool calls to Remote Control clients (background subagents still show status only), a Spend limit bar in /usage with a matching rate_limits.spend_limit status-line field, and a per-session prompt-cache line in /cost (hit ratio, misses, tokens re-cached, warm/cold) plus a prompt_cache object for status-line scripts. It also fixed project settings being able to enable detailed beta tracing or raw API body logging, and a lower-scope tracing endpoint bypassing an OTLP collector pinned by managed settings. v2.1.248 added claude self-hosted-runner --client-label, server-managed settings diagnostics in /doctor and /status, a /web-setup warning when the GitHub CLI token lacks the workflow scope, /usage-credits for Enterprise organizations billed through AWS Marketplace, and cross-session messaging on Bedrock, Vertex and Foundry and with telemetry disabled. v2.1.252 fixed Bash commands failing with "task output swap refused" on some Macs, "always allow" not saving in a project with no settings.local.json yet, Remote Control sessions stalling for minutes on a degraded connection, and very large background-task failure output pushing a conversation past the API request-size limit. v2.1.258 is a two-line release: it fixes Claude Code failing to launch on macOS 12 (Monterey), a regression from 2.1.255, and remote and scheduled sessions failing with "user messages must have non-empty content". v2.1.250 published no itemized notes.

No reverts in this window. We check every release for rollbacks of claims we have published, because v2.1.233 reverted two permission changes we had reported as shipped. Nothing here walks anything back. The narrower replacements for the reverted Cygwin-symlink and input-redirection permission checks have still not appeared — now nineteen days on, and long enough that we will stop listing them as pending and treat them as abandoned unless one lands.

Full changelog → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /openclaw/cost-optimisation/, /claude-cowork/, /security/

1.4.0 is a real minor release: 81 commits since 1.3.0, promoted to stable two days after its release candidate. The theme across the additions is survival — of approvals, of child runs, and of sandbox state — which is exactly the gap that separates a chat tool from something you can leave running.

The durable notification inbox is the headline and the most quietly important. Runs now publish authoritative outcomes and actionable gates to a per-user inbox, surfaced in the WebUI notification center, so approvals and auth prompts survive a missed session. Before this, an agent that needed you mid-run was blocked on you being there; a prompt raised into a session you had closed was a prompt nobody would answer. Making the gate outlive the session is the difference between an agent that can run overnight and one that merely runs long.

Background subagents get delivery semantics rather than just concurrency. A parent turn can spawn children that run and deliver on their own, with per-child delivery, activation provenance, a derived cap on autonomous wakes, and healing sweeps for orphaned children. Every clause there is a failure mode someone hit: children whose output went nowhere, wakes with no traceable cause, a wake loop with no ceiling, and children left running after their parent died. A cap on autonomous wakes in particular is the kind of limit you only write after an agent has woken itself a few thousand times.

Sandboxes became persistent, and the egress story got a proper answer. The local-Docker profile now has persistent per-user sandbox containers reached over Docker Exec, so container-local installs and state survive between commands — meaning a pip install in step one is still there in step four. The Railway preview profile keeps its ephemeral worker-per-command model and only its checkpointed workspace, which is the right split to document rather than paper over. Alongside it: a managed per-user sandbox egress proxy, with manifest-declared direct-exec credential bindings that stay behind it, so secrets are never handed to sandboxed code. Credentials that the sandbox can use but never read is the correct shape for this, and it is rarer in agent runtimes than it should be.

The rest. Run-now for automations plus exact run-capability facts; durable backend suggestions generated over the user's own no-approval read-only tools and gated on connected extensions; Google Docs semantic editing tools; run timing evidence in downloadable conversation artifacts; and opt-in in-worker SSH in the runtime image. On the fixes side, structured finalization stalls are now bounded and OpenAI-compatible reasoning-only responses are handled. Note that ironclaw-v1.3.1-rc.1 was cut on August 24 and superseded by this line.

Releases → Affects: /ironclaw/, /ironclaw/setup/, /ironclaw/configuration/, /ironclaw/security/, /ironclaw/skill-allowlisting/

The curated notes we have been reporting as deferred since early August are here, and they cover the whole deferred window. v0.21.0 rolls up v0.20.1 through v0.20.6 — roughly 5,800 commits, 2,475 merged PRs, 869,000 insertions and 2,100 issues closed across 760+ contributors. We flagged the documentation gap three times; it is closed, and the closure is retrospective rather than forward-only, which is the honest version.

Bot Mode is the headline, and it is now bundled and default-on. Every agent profile gets a name, a deterministic avatar, and a place in a shared roster; you can create Discord-style group chats where multiple bots and you talk in one room, @-mention any bot from the composer, and name and picture the rooms. The framing in the release notes is the part worth quoting back: multi-agent used to mean plumbing, and now it looks like a chat app full of coworkers. Whether that is the right interface for agent coordination is a genuinely open question — but it is the first mainstream agent runtime to answer it with a social metaphor rather than a graph.

Scheduled agents got memory, which is the fix that makes them worth scheduling. Cron jobs gained memory and continuity so scheduled agents actually learn between runs. A recurring agent with no memory re-derives the same context every fire and cannot notice a trend across runs; this is the difference between a cron job that reports and one that accumulates. Alongside it: subagents can be steered live mid-flight, the MCP surface became a command center, and the agent can drive the desktop's own browser.

The v0.20.6 patch window (August 27) is worth reading separately — about 1,313 commits and 525 PRs. It landed consent-gated real-profile browsing (use your default Chromium profile locally, with a Windows close-with-approval flow), the desktop Browser in its own OS window plus a managed SSH remote-update engine, a remote MCP catalog expansion past 50 live-verified vendor-hosted servers (Cloudflare, Grafana Cloud, Better Stack, Railway), TTL result caching for web_search/web_extract, lean-tail compression as the default, multi-query tool_search with stemming, opt-in OS-keychain encryption for stored secrets (no more per-launch macOS Keychain prompts), updaters that pause gateways over the control socket instead of tree-killing them, and image/package-managed installs refusing unsafe in-place updates. New models reached the pickers in that window too: GLM-5.3-Flash, MiniMax M3 free, and MiniMax H3 Max video.

Releases → Affects: /hermes/, /hermes/setup/, /hermes/tasks/, /hermes/memory/, /hermes/mcp-tools/, /hermes/discord-gateway/