Claude Code v2.1.281 Lets You Hide Attribution Entirely, Plus Big Gateway and Safety Upgrades

Hey everyone, it's Shii-chan! I went through the latest Claude Code release notes, and v2.1.281 is a big one packed with new features, fixes, and improvements. Let me walk you through the highlights!

Claude Code Release github.com

What was announced?

The Claude Code Release notes for v2.1.281 just landed, covering everything from settings management and Claude apps gateway upgrades to session resume reliability and stronger safeguards around dangerous commands. The GitHub release notes list dozens of items across Added, Fixed, Improved, and Changed categories.

One headline change: setting "attribution": false in settings.json now hides all commit and PR attribution at once. That should be handy for companies that want a consistent commit log format.

A few other additions worth calling out:

• assume_role was added to Claude apps gateway Bedrock upstreams, letting the gateway call Bedrock as an IAM role it assumes through STS, including roles in another AWS account.
• guardrail: {id, version} was added to Bedrock upstreams too, applying an Amazon Bedrock guardrail to every request that flows through that upstream.
• MCP URL-mode elicitation is now supported, letting a server ask Claude Code to open a browser-based flow.
• claude plugin validate now checks MCP servers, catching .mcp.json entries that would be silently dropped, undeclared ${user_config.*} references, and insecure URLs.
• /insights gained an auto mode recommendation that estimates how many permission prompts auto mode could have handled in your recent sessions.

The story so far

Until now, removing Claude Code's attribution from commits and PRs required handling it piecemeal. A single "attribution": false setting now takes care of it entirely.

On the auto mode side, server-side classifier review used to apply only to a subset of commands. This release extends that review to read-only and sandboxed shell commands too, so they get blocked if flagged.

There was also a gap where a recursive rm targeting only command-substitution output, like rm -rf "$(pwd)", could run without a confirmation prompt under auto mode or --dangerously-skip-permissions. It's a subtle but genuinely scary edge case if you miss it.

What changes

The dangerous rm handling got a notably safer default: even under --dangerously-skip-permissions or auto mode, a dangerous rm now waits up to two minutes for a response and gets denied with a suggested rewrite instead of running silently (unattended sessions can still continue). You can disable this behavior with CLAUDE_CODE_DISABLE_DANGEROUS_RM_TIMEOUT=1.

For self-hosted setups, CLAUDE_CODE_AUTO_MODE_SERVER now also applies to direct Anthropic API connections, so you can explicitly opt in or out of the server-side auto mode classifier with 0/1.

On the UI side, there's a small but nice touch: the fullscreen /skills, /mcp, and /plugin installed lists now have a scrollbar, making it easier to see where you are in a long list.

Dive Deep

A lot of the fixes are about session reliability. For example, crashes labeled "unrecoverable interface error" that could happen while an API request was being retried are fixed, along with a bug where unparseable tool calls and output-limit truncation alternated and caused turns to retry endlessly while ignoring --max-turns. That should help anyone running long sessions.

Resuming a very large session used to only restore the last few messages in some cases, and resumed sessions could resend prior turns in a changed format (like parallel tool-call turns or MCP tool-call inputs) — both are fixed now.

On the security side, permission dialogs and attachment checks for macOS paths under /.vol, /.nofollow, and /.resolve (reachable via network mounts) now apply properly before approval, and permission rules containing NUL bytes no longer expand into wildcard matches — such rules now match nothing.

Wrap-up

• Setting "attribution": false in settings.json now hides commit and PR attribution entirely
• Claude apps gateway Bedrock upstreams now support assume_role and guardrail, widening enterprise configuration options
• Dangerous rm commands (like rm -rf "$(pwd)") now wait up to two minutes for confirmation even under auto mode or --dangerously-skip-permissions
• Auto mode's server-side review now covers read-only and sandboxed commands too
• /insights gained an auto mode recommendation, and /skills//mcp//plugin lists gained a scrollbar
• Numerous reliability fixes around session resume crashes and infinite retries

This update matters both for teams that want a consistent commit log and for anyone relying on auto mode or the Claude apps gateway!