Claude Code's Safety Checks Just Got Free. Your Weekly Budget Didn't.

Two changes, five days apart, one direction

On September 14, the temporary 50% boost to Claude Code's weekly usage limits expired. Its permanent replacement raises the baseline by 25%, which reads as a win until you do the subtraction: measured against the boosted level everyone had been running on all summer, it is a 17% cut. Anthropic deleted its original announcement thread and posted a clarification that says so outright: "Compared to today, this works out to a 17% reduction in weekly limits on Claude Code."

Five days later, on September 19, Claude Code 2.1.278 moved in the other direction. Auto mode's safety classifier, the process that vets shell commands and network requests before they run unattended, stopped being billed for Claude API and Enterprise accounts and on Bedrock, Vertex, Foundry and gateways, wherever Anthropic's server-side checks can actually reach the session. The mechanism deciding what an autonomous agent is allowed to do got cheaper in the same week the budget for running that agent got smaller.

We don't think these are secretly the same lever. They land on the same customers, in the same product, five days apart, and anyone who budgets Claude Code by usage should read them as one week rather than as two unrelated changelog lines.

The budget cut, in plain numbers

The mechanics are arithmetic the announcement made harder than it needed to be. Claude Code carried a temporary 50% increase in weekly limits, flagged from the start as time-limited. On expiry the standing increase became 25% over the original baseline, permanently, for Pro, Max, Team and seat-based Enterprise plans. If the original weekly allowance was 100 units, the temporary period gave you 150; the permanent state gives you 125. More than before the promotion, and noticeably less than the week before the cutover.

Anthropic's framing led with the first comparison, a permanent 25% increase. The second reached customers only after the original thread came down and a follow-up post admitted the 17%. We'd call that a communications miss rather than a pricing scandal: a permanent 25% bump over the pre-promotion baseline is a real number, and teams that never scaled into the temporary boost see straightforward improvement. But if your team spent the summer calibrating against a 150-unit ceiling, September 14 is a genuine reduction in what you can run.

The practical move is a comparison, not a dashboard glance. Pull what your team actually consumed in the weeks before the cutover from your usage dashboard or admin console, and set that against the new ceiling. /status tells you where you stand inside the current week; it won't tell you what you were burning in August. For an agency running client work across several concurrent projects, 17% is the difference between a Friday-afternoon refactor finishing inside the week's allowance and a session stalling mid-task with a delay to explain. Price it into sprint capacity now rather than meeting it mid-week.

The classifier tax, and the gateway that keeps you paying it

Auto mode became Claude Code's default permission mode on August 14, and we covered the mechanics and the 97%-rubber-stamp data behind that decision at the time. The classifier that replaced manual review runs a safety check on every risky-looking tool call, and until 2.1.278 those checks were billed as ordinary model requests whenever Claude Code ran its own local classifier.

From 2.1.278, Anthropic's documentation describes a cleaner split. On Enterprise plans and Claude API accounts, and on Claude Platform on AWS, Amazon Bedrock, Google Cloud's Agent Platform and Microsoft Foundry, the check runs server-side as part of the session's existing model requests, at no extra charge, wherever that platform's rollout has reached. Pro, Max and Team plans were never billed for classifier overhead, so nothing changes for most individual developers.

The catch lives in the phrase "wherever the server's checks reach the session". When they don't, Claude Code falls back to its own classifier requests, billed exactly as before, and holds the next checked action behind a one-time notice: "We're changing auto mode to no longer charge for classifier requests in Claude Code. However, this session isn't eligible." Press Enter and the session continues on the billed path. If the notice named a gateway, acknowledging it suppresses the message on that machine for 24 hours, which is convenient and is also how a team stays on the expensive path for weeks without noticing.

Two details matter if you run agents outside an interactive terminal. In headless mode, claude -p prints that text to stderr and stream-json output emits it as a system warning your Agent SDK application can read off the message stream. And on Bedrock, Google Cloud's Agent Platform, Microsoft Foundry and signed-in gateway sessions, only Claude Sonnet 5, Opus 4.7 or later and the Fable models support auto mode at all, so a pipeline pinned to an older model was never on this path to begin with.

The obvious diagnosis, that a billed fallback means your proxy is misconfigured, is only half right. Anthropic's docs name two distinct causes. The first is a gateway or proxy that strips or rewrites headers, drops body fields it doesn't recognise such as safeguards, or edits responses by dropping safeguard_results or rewriting tool-use IDs. That one is yours to fix, and it is specific enough to hand straight to a platform team: pass requests and replies through unchanged, per the gateway compatibility guide. The second is that server-side checks haven't reached your platform, region or credential yet, and no amount of proxy configuration will move that.

One more thing to check before you start debugging. Setting CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS=1 turns the server's checks off as a side effect while CLAUDE_CODE_AUTO_MODE_SERVER is unset, so a team that set that flag months ago to avoid pre-release behaviour is now paying classifier overhead for a reason that has nothing to do with gateways. If you already know your gateway can't carry the checks, CLAUDE_CODE_AUTO_MODE_SERVER=0 silences the notice and keeps the old billing. Anthropic labels that variable temporary and liable to removal, so treat it as a stopgap rather than a setting.

The direction of travel matters more than the exact date. Version 2.1.273 had defaulted Bedrock, Vertex and Foundry to the local classifier "for now", with CLAUDE_CODE_AUTO_MODE_SERVER=1 as the opt-in to server-side checks. Five releases later the default is inverted and the same variable exists only to opt out. That looks like Anthropic treating server-side classification as the destination and the local fallback as the stopgap. If /status still reads Disabled on your platform, you are waiting on a rollout rather than sitting on a dead-end configuration.

Cheaper to check is not safer to leave running

A billing change is not a reliability change, and the two are easy to conflate when they arrive in the same release note. Nothing in 2.1.278 alters what the classifier catches or how often it is right; it alters who pays for the check. The docs say plainly that a session which falls back keeps working in auto mode with the same behaviour, which is the clearest available confirmation that the server-side path is a cost optimisation and not a safety upgrade.

That distinction deserves weight this week, because community reports of unattended Claude Code sessions causing real file-system damage keep circulating, and we have not independently verified any of them. Our postmortem on Anthropic's own sandbox-escape incidents made the point from the vendor side: classifiers and outbound-network controls shrink the blast radius of a bad tool call without making background execution risk-free. If you run Claude Code with --bg or a headless agent loop against real user data, the control that saves you is a filesystem snapshot or a sandboxed working directory. A classifier that now costs nothing is still a classifier.

AGENTS.md, and the same platform lag

One more change worth flagging, because it shapes how you configure agents rather than what they cost. Version 2.1.277, shipped the day before the billing change, added native AGENTS.md support: in a project with no CLAUDE.md, Claude Code reads AGENTS.md instead. It drew 734 points and 275 comments on Hacker News, the loudest single item in the week's Claude Code coverage, which suggests plenty of teams would rather standardise on one shared instructions file across Claude Code, Codex and the rest than maintain a vendor-specific one per tool.

The changelog footnote repeats the week's theme: the AGENTS.md fallback is not yet on Bedrock, Vertex or Foundry either. Two features, shipped a day apart, both landing on the direct API first and the managed platforms later. If your organisation standardised on a cloud marketplace deployment for procurement reasons, that lag is turning into a recurring line item in what you can actually use.

What we're watching next week

Two things. First, whether Auto mode server: Disabled turns out to be a common finding once teams start checking /status, which would tell us how much distance the server-side rollout still has to cover across Bedrock, Vertex and Foundry. Second, whether Anthropic delivers the "exciting changes" it teased alongside the weekly-limits clarification, promising "more visibility and control of your usage". A usage cut with a vague promise attached is the kind of line worth holding a vendor to.

Want to know what your agents are actually allowed to do, and what each guardrail costs you per session? get in touch.