Claude Code is Anthropic's official agentic coding tool — now available as a CLI, desktop app (Mac/Windows), web app (claude.ai/code), and IDE extensions for VS Code and JetBrains. It autonomously reads, writes, and runs code across your entire project.
Architecture Deep Dive → Claude Code Architecture Breakdown — two-layer harness design, context engineering strategies, permission model, MCP extension points, and how it compares to Codex's kernel-level sandboxing.
Why It's in Adopt
Claude Code has evolved significantly since its initial CLI-only release. It remains one of the most capable agentic coding tools available, now with multiple interfaces:
- Terminal CLI — the original and still the most powerful interface for shell-heavy workflows
- Desktop app — native Mac and Windows app for a more visual experience
- Web app — claude.ai/code for browser-based access
- IDE extensions — VS Code and JetBrains integrations
- Background agents — run tasks asynchronously while you work on other things
- MCP auto-background (v2.1.212, July 17, 2026) — MCP tool calls running longer than 2 minutes automatically move to the background so the session stays usable; configure the threshold or disable with
CLAUDE_CODE_MCP_AUTO_BACKGROUND_MS - Scheduled tasks — recurring agents on a cron schedule for automated maintenance
- Routines (April 2026) — automations that run without an active session, bundling a prompt, repo, and connectors into a single configuration. Routines can run on a schedule, fire from an API call, or trigger off GitHub events like new PRs — replacing the need for custom CI-based agent wrappers
- Hooks — 17 programmable hook events that execute shell commands in response to Claude Code actions (tool calls, file edits, command execution, etc.)
- Agent Teams (experimental, opt-in via
CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS) — coordinate multiple fully-independent Claude Code sessions as a team. One session acts as the team lead; others are teammates, each with their own context window. Unlike subagents (which only report back to the caller), teammates share a task list, claim work autonomously via file-locking, and message each other directly. Teams support two display modes: in-process (Shift+Down to cycle) or split-pane (tmux/iTerm2). New hooks:TeammateIdle,TaskCreated,TaskCompletedlet you enforce quality gates. Teammate roles can be defined as reusable subagent definitions. Known limitations: no session resumption for in-process teammates, task status can lag, one team per lead, no nested teams. Requires v2.1.32+. (docs) - Computer Use Agent (research preview, March 23 2026) — Claude can see and control your desktop via a screenshot-analyze-act loop, clicking buttons, opening apps, and navigating browsers. Available in both Claude Code and Cowork on Pro/Max plans (Anthropic blog, CNBC)
- MCP server support — connect to external tools, databases, and APIs
- Skills (
.claude/skills/SKILL.md) — domain knowledge and reusable workflows loaded on demand; won't bloat every conversation the way CLAUDE.md does. Invoke with/skill-name. Usedisable-model-invocation: truefor side-effect workflows you trigger manually. - Subagents (
.claude/agents/) — specialized assistants with their own tools, models, and context; delegate research or review without polluting your main conversation - Plugins — bundled skills, hooks, subagents, and MCP servers in one installable unit; browse with
/plugin - Plan Mode — read and plan without making any changes (Ctrl+G to edit plan in your editor before proceeding)
/btw— side questions that never enter conversation history, keeping context clean/rewind— checkpoint restoration: restore conversation, code, or both to any previous state/compact <instructions>— selective compaction (e.g./compact Focus on the API changes)/code-reviewsubagent (v2.1.218, July 22, 2026) —/code-reviewruns as a background subagent, keeping review work out of your main conversation; note that/code-reviewand/verifynow require explicit invocation — they no longer run automatically (changed in v2.1.215, July 19, 2026)claude --continue/--resume— pick up where you left off across sessions
As of April 17, 2026, Claude Code introduced Opus 4.7 as the primary agentic model, with a new xhigh effort level, Auto mode for Max subscribers (model selection handled automatically), and new /effort and /ultrareview slash commands for fine-grained control over reasoning depth. Windows support and permission prompt ergonomics also improved. Claude Opus 4.8 (released May 28, 2026) is now available in Claude Code, bringing improved agentic judgment: more effective clarifying questions, better self-error detection before reporting completion, and reduced silent failure in multi-step tasks. (Claude Opus 4.8 entry) Claude Opus 5 (released July 24, 2026, v2.1.219) is now the default Opus model in Claude Code (claude-opus-5). It exceeds Opus 4.8's benchmark performance at the same base price ($5/$25 per MTok), adds self-verification behavior, and supports fast mode at $10/$50 per MTok. Note: fast mode (/fast) now applies to Opus 5 and Opus 4.8; Opus 4.7 is no longer in fast mode. (Claude Opus 5 entry) Claude Fable 5 (alias: fable) is also supported as the primary model in Claude Code, providing the highest capability ceiling available in the tool. Note: Fable 5 cannot be used as the advisor model, and extended thinking cannot be disabled when Fable 5 is selected.
Claude Code now authors ~4% of all public GitHub commits (~135K/day). Claude Opus 5 is the new default Opus model as of July 24, 2026 — Frontier-Bench v0.1: 43.3% (above Fable 5's 33.7%); ARC-AGI 3: 30.2% (20× Opus 4.8). Claude Opus 4.8 achieves 88.6% on SWE-bench Verified and 69.2% on SWE-bench Pro (complex, real-world GitHub issues). Claude Fable 5 achieves 95% on SWE-bench Verified as a standalone model.
It's particularly well-suited to tasks that span many files or require running code to verify correctness — things that in-editor tools struggle with.
August 2026: Auto Mode Becomes the Default
Starting August 14, 2026, new Claude Code sessions on Pro, Max, and Team plans use auto mode by default unless a user or administrator has pinned another mode. Enterprise and API/cloud-platform users remain opt-in initially. Auto mode evaluates each tool call with a classifier aimed at irreversible, destructive, or out-of-environment actions; it can deny the action, let Claude find a safer path, or fall back to manual approval after three consecutive blocks or twenty blocks in one session. Broad allow-rules that would grant arbitrary code execution do not bypass the classifier while auto mode is active. (announcement, permission-mode docs)
Anthropic's evidence is stronger than a normal product launch but remains vendor-produced. In a controlled study of 1,053 paid testers, humans rejected 13.6% of substituted dangerous commands while auto mode blocked 89% of the same commands. A separately commissioned evaluation reported zero successful attacks across 720 indirect prompt-injection attempts against Fable 5, Opus 5, and Sonnet 5 in auto mode; the scenarios were held out from Anthropic, but the study still tested a specific July 17 tool integration and software versions. Anthropic also reports that Teams and Enterprise adopters using auto mode ship about 25% more PRs, with Adobe, Nuro, Gusto, and Garner Health using it as their production default. Treat these as promising operational signals, not proof that classifier-mediated execution eliminates risk; Anthropic explicitly retains human review guidance for high-stakes production changes. (methodology and caveats)
Claude Code v2.1.225 also tightened unattended-session behavior: claude agents now prompts for workspace trust in untrusted directories, auto-mode safety-filter refusals no longer consume the consecutive-block budget, and self-hosted runners fail at startup when their base directory cannot be created or written instead of registering a runner that fails every task. It also prevents a stored login's short-lived token from replacing a long-lived CLAUDE_CODE_OAUTH_TOKEN in headless sessions. (v2.1.225)
Claude Code v2.1.228 then hardened synchronized skills from claude.ai: their descriptions are sanitized and labeled, they cannot shadow local commands or MCP prompts, and locally materialized bodies cannot run ! commands or expand @ file references. The release also prevents project-memory cleanup from deleting the memory folder's contents, isolates marketplace entries across settings-precedence tiers, and repairs first-run inbox creation for cross-session messaging. Teams that sync remote skills or operate multiple unattended sessions should upgrade and test those boundaries explicitly. (v2.1.228)
Versions 2.1.229 and 2.1.232 extend both the multi-agent operating model and its enforcement boundaries. Forked subagents now inherit the full conversation and prompt cache by default, ordinary interactive subagents start in the background, and named live sessions can message one another under an explicit accept/hold/refuse policy. Self-hosted runners can receive server-supplied hooks, while command-sourced plugin directories can be resolved afresh each session without a restart. (v2.1.229, v2.1.232)
Those capabilities arrive with important hardening: nested Git repositories require independent trust, dangerous Git flags are no longer auto-approved in the commit/PR workflow, ambiguous IPv6 sandbox rules fail closed, and PowerShell, shared-/tmp socket, and Linux protected-path bypasses were closed. Teams should treat session discovery, background fan-out, dynamic plugin sources, and server-delivered runner hooks as governed control-plane surfaces rather than convenience-only features.
Version 2.1.233 adds an opt-in Linux memory cgroup for Bash commands, repairs cloud sessions lost while waiting for permission prompts and MCP v2 subscription streams that reopened indefinitely, and closes a Windows NT-device-prefix path that bypassed UNC validation and could leak NTLM credentials. It also reverts the 2.1.232 permission changes for Windows Cygwin-style symlinks and shell input redirection while Anthropic prepares narrower fixes; teams should not treat those two command-boundary issues as closed solely because 2.1.232 shipped. (v2.1.233)
Version 2.1.234 (published August 17) extends that hardening and adds new capabilities. It now rejects Windows NT-namespace (\??\) paths in remote file reads, session restore, CLAUDE.md includes, workflow scripts, and file uploads — further narrowing remaining pre-approval file accesses against the same NTLM credential-leak vector. It also adds automatic session continuation when a claude.ai usage limit resets, cross-session messaging recovery for Claude Desktop, permission-preview credential masking that hides commands/paths/destinations from approvers, remote-control permission-mode and effort-level synchronization across phone/desktop/watch surfaces, and reduces the context cost of loading the built-in claude-api skill from ~200k+ to ~25k tokens by loading reference docs on demand. The v2.1.233 reversion of shell input-redirection and Cygwin symlink command-boundary changes remains un-restored as of 2.1.234; those two follow-up fixes are still pending. (v2.1.234)
Version 2.1.235 (August 18) is a smaller hardening and UX release. It adds an optional spellcheck setting that underlines misspelled words using installed aspell, hunspell, or ispell, fixes whole-prompt-cache invalidation when a language server disconnects or reconnects mid-session, tightens permission dialogs so "don't ask again" is withheld when contents cannot be fully displayed, and fixes the agent tool advertising a general-purpose default in sessions where that agent is unavailable. (v2.1.235)
Versions 2.1.236 and 2.1.237 (both August 19) and 2.1.238 (August 20) press the same hardening arc forward with smaller surfaces. v2.1.236 tightens macOS sandbox enforcement so wildcard read-deny rules (e.g. **/.env) now take precedence inside allowed read regions, cover the matched directory's contents, and cannot be bypassed by renaming the denied file — closing a rename-abuse path for credential files. It also adds ANTHROPIC_DEFAULT_MODEL, which sets the model new sessions start on while /model still overrides and persists (unlike ANTHROPIC_MODEL), and an opt-in notify_when_idle cross-session notice. v2.1.237 adds a built-in "Concise" output style and fixes prompt caching for LLM-gateway or custom base-URL sessions. v2.1.238 releases subagent tool results once they leave the recent display window (fixing unbounded memory growth in long interactive sessions), lets plugin-marketplace entries mint short-lived HTTP headers for catalog fetches via a per-entry headersHelper command, and adds --defer-shutdown-max-min plus --proxy-authorization-command for self-hosted runners behind egress proxies. The 2.1.233 reversion of Windows shell input-redirection and Cygwin symlink command-boundary changes remains un-restored as of 2.1.238. (v2.1.236, v2.1.237, v2.1.238)
Version 2.1.239 (published August 21) is a substantial cross-platform capability release. Most notably, Windows now has cross-session messaging: Claude Code sessions across your Windows machines can message each other with SendMessage and find each other with ListAgents, as previously available on macOS and Linux. Cost estimates (/cost, the status line, and --max-budget-usd) now include the 1.1× US-only-inference premium for data-residency workspaces, so the number shown reflects actual charges. A new /claude-api upgrade command migrates Python projects from anthropic 0.x to 1.x (timeouts change to anthropic.Timeout), and cloud sessions now display plugins synced from claude.ai as name@synced — these can be enabled/disabled by name and never override a same-named plugin you installed. Alpine/musl builds now load native image-paste, clipboard, and audio-capture add-ons (musl-built binaries instead of the glibc ones the runtime previously refused). Reliability fixes include correcting Bedrock streaming behind proxies that strip the Response Content-Type header (which had silently doubled billed API calls by re-running every turn as non-streaming), honoring HTTPS_PROXY in the Bedrock SSO credential pre-check, and releasing WebFetch's cached page content after the intended 15 minutes instead of holding it for the whole session. Distraction fixes stop mouse-report sequences in browser-based terminals from injecting escape-sequence garbage into the prompt and keep <Pasted text #N> placeholders from corrupting Ctrl+W/U/K edits. Remote sessions now keep sending keep-alives during long SessionStart/Setup hooks so their container is not idle-reaped mid-hook, and SendMessage to your own agent name reports itself instead of "no agent named…". The 2.1.233 reversion of Windows shell input-redirection and Cygwin symlink command-boundary changes remains un-restored as of 2.1.239; versions 2.1.240 and 2.1.241 (August 22–23) carry bug fixes and reliability improvements only, with no restoration mentioned. (v2.1.239, v2.1.240, v2.1.241)
Versions 2.1.245 and 2.1.246 (published August 25) continue the bug-fix arc without restoring the reverted command-boundary changes. v2.1.245 fixes a startup crash on Linux distributions that ship glibc 2.44 (e.g. Arch Linux, CachyOS, Fedora Rawhide). v2.1.246 adds a startup warning for Bash allow rules with a wildcard before the subcommand (e.g. Bash(git * main)), an Auto-mode tab in /permissions for editing the classifier rules, and an elapsed-time footnote on the end-of-turn line. Among its many fixes it always requires approval for malformed commands with a dangling && or ||, honors requiresUserInteraction on MCP permission prompts, stops --strict-mcp-config sessions from prompting to approve .mcp.json servers they would never load, sends telemetry or API-key credential material only to its own host when a third-party gateway (ANTHROPIC_BASE_URL) is configured, fixes MCP tool arguments being sent as JSON strings when a parameter schema is {}, and caps idle-session /goal check-ins on long-running background work at three per goal. The 2.1.233 reversion of Windows shell input-redirection and Cygwin symlink command-boundary changes therefore remains un-restored as of 2.1.246; the two follow-up fixes are still pending. (v2.1.245, v2.1.246)
Versions 2.1.247, 2.1.248, and 2.1.250 (published August 26–28) keep the multi-agent and control-plane momentum going without restoring the reverted boundaries. v2.1.247 adds a SendFeedback tool behind /feedback (Claude drafts a feedback report for human review; toggle off with feedbackDrafts), a /claude-api cost-optimize command that profiles an existing project's Claude API spend and walks through cost levers one measured change at a time, expansion of the /claude-api skill to Admin API coverage (organization members, invites, workspaces, API keys, rate-limit reports, workload identity federation, CMEK), organizational control over rotating spinner tips, and it changes Sonnet 5's default auto-compact window to its full 1M context (auto-compacting at ~967K tokens instead of ~934K). v2.1.248 adds --restricted (removes the built-in command-and-code-executing tools and WebFetch unless named in --tools, keeps file tools inside the working directory, refuses bypassPermissions, and ignores user, project, and local settings files — a tighter envelope for unattended or exposed sessions), an experimental per-agent prompt-cache TTL (experimental.cacheTtl), extends cross-session SendMessage/ListAgents to Bedrock, Vertex, and Foundry sessions plus telemetry-disabled sessions, adds /usage-credits for Enterprise usage-credit increases, and cuts the Workflow tool's prompt footprint from ~5.7k to ~1k tokens by moving script-writing guidance into a bundled workflow-authoring skill. v2.1.248 also fixes a roughly-hourly prompt-cache miss (tool definitions re-rendered after an OAuth token refresh) and a resumed-session cache miss from ScheduleWakeup definition drift — reclaiming extended-thinking context long sessions were losing. v2.1.250 (August 28) is bug-fix only. The 2.1.233-reverted Windows shell input-redirection and Cygwin symlink changes remain un-restored through 2.1.250; the two follow-up fixes are still pending. (v2.1.247, v2.1.248, v2.1.250)
Version 2.1.251 (published August 28) is a hardening release with one notable boundary fix: file tools (Read, Write, Edit) whose targets were swapped for a symlink inside the working directory after the permission check could previously read or write outside the approved location — 2.1.251 closes that race. It also rejects plugin commands that point outside their plugin directory (path-traversal), applies Read(...) deny rules to Grep and Glob paths reached through a symlinked search path, and reads Workflow-tool scriptPath targets before honoring the session's read boundaries. (v2.1.251) The release also adds PreModelSwitch/PostModelSwitch hook events (with SessionStart resume hooks now receiving session staleness and an estimated re-cache cost), live streaming of a foreground subagent's tool calls and results to Remote Control clients, a per-session prompt-cache line in /cost (hit ratio, misses, tokens re-cached, warm/cold), and a Spend limit bar for Claude apps gateway users with spend limits. Permission handling tightens further: server-managed settings that terminate sandbox TLS, route sandbox traffic through a proxy, inject credentials, or weaken sandbox isolation now require approval before applying — as do ANTHROPIC_CUSTOM_HEADERS that set a credential or routing header; project-level .claude/settings.json env no longer overrides CLAUDE_CONFIG_DIR, CLAUDE_CODE_TMPDIR, or TMPDIR; and Bash commands that assign an arithmetic expression to an integer variable (e.g. OPTIND=1/0) are no longer auto-approved. The 2.1.233-reverted Windows shell input-redirection and Cygwin symlink command-boundary changes remain un-restored through 2.1.251.
As of August 31 no official Anthropic response to Rehberger's breakout had appeared. v2.1.251's only auto-mode-adjacent changes are behavioral — managed-settings disableAutoMode arriving mid-session now returns an already-running auto-mode session to default mode, and first launch now starts in default mode rather than auto for accounts whose startup default is auto — with no classifier-evaluation change stated. Neither the vendor-commissioned figure (0/720) nor an independent rerun reconciles the tension between it and the two contrary independent data points (veganmosfet's earlier bypass and Rehberger's chain), so Auto Mode's real-world blast radius remains independently unqualified; run unattended work in an OS sandbox or container regardless of selected mode. (v2.1.251)
A week after Anthropic reported zero successes across 720 held-out indirect prompt-injection attempts for Auto Mode, an independent test cut sharply the other way: security researcher Johann Rehberger's "Breaking Claude Code Opus 5 Auto Mode" (August 27) achieves code execution through Auto Mode at 60–80% on a small sample despite the category-leading evaluation. The chain is subtle: a page returns HTTP 415 to nudge Claude off WebFetch onto curl; a redirected ZIP archive ships a decoy decoder-darwin binary Claude prudently declines to run; Claude then writes its own Python decoder and runs it inside the attacker-chosen extracted directory, where the archive's struct.py shadows the Python standard library while import base64 executes obfuscated module-level code — downloading and launching a native payload (and, in a bonus variant, spawning a second headless claude -p). In a few runs Auto Mode then blocked Claude's own cleanup command once Claude spotted the compromise: "The safety mechanism itself can become part of the failure. The classifier allowed the creation of the malware process, but then it blocked the command intended to stop it!" Simon Willison concurs with Rehberger's conclusion that Auto Mode is not a substitute for isolation: run unattended coding agents in a container, VM, or OS sandbox, restrict network egress, and monitor. (Rehberger, Willison)
How It Works
# Install
npm install -g @anthropic-ai/claude-code
# Run in your project directory
claude
# Then describe what you want in plain English
> Add rate limiting to the /api/login endpoint
Claude Code reads your files, plans a solution, makes the changes, and can run your tests to verify. You review and approve changes before they're committed.
August 2026 Safety Update
Claude Code v2.1.221 through v2.1.224 closed several permission-boundary failures that matter for unattended and parallel sessions. v2.1.221/v2.1.222 changed hidden commands inside zsh [[ ]] regular-expression conditionals and quoted PowerShell paths to require approval, prevented worktree-isolated sessions and subagents from running destructive Git commands against the main checkout, and stopped PreToolUse auto-allow hooks from bypassing restrictions in background tasks. v2.1.221 also added a Linux/WSL credential-file mask mode that exposes sentinel content inside the sandbox and substitutes the real secret only on approved egress. (v2.1.221, v2.1.222)
v2.1.223 then fixed two command-obfuscation paths — crafted Bash text and commands padded with tabs or invisible Unicode — plus dynamic import() escaping the workflow sandbox and agent definitions ignoring the organization's bypass-permissions disable policy. v2.1.224 fixed trailing-slash sandbox deny entries being bypassable and expanded credential masking with structured-value extraction, JWT claim masking, and AWS SigV4 re-signing. Teams using worktrees, background agents, workflows, permissive hooks, or filesystem deny rules should upgrade to at least v2.1.224 and re-test their policies. (v2.1.223, v2.1.224)
The same v2.1.224 release also adds self-hosted runners for Team and Enterprise plans and cross-session messaging across macOS and Linux. Messages entering a session that is running with bypassed permissions are held for approval, while ordinary cross-session messages auto-deliver. This turns multi-session coordination into a first-party capability, but it also creates a new trust boundary: operators should define which sessions may discover and message one another before using it for unattended work. (v2.1.224)
Safety Architecture
Claude Code enforces safety at the application layer — a fundamentally different approach from OpenAI Codex's OS kernel-level sandboxing (Landlock, seccomp, Seatbelt). The trade-off:
| Dimension | Claude Code | Codex CLI |
|---|---|---|
| Enforcement | Application layer (permission model + 17 hook events) | OS kernel (syscall-level deny) |
| Programmability | High — hooks can encode business logic, run linters, validate schemas | Low — coarse allow/deny |
| Escape-proof | No — but highly configurable | Yes — model cannot circumvent OS-level denial |
This means Claude Code is more expressive for teams that want to encode policy (e.g. "run ESLint before every file write", "block commits to main"), while Codex is stronger against adversarial escape. Both approaches are valid — they optimize for different concerns.
Configuration: CLAUDE.md vs AGENTS.md
CLAUDE.md is Claude Code's project configuration file — more powerful within Claude (persistent context, coding conventions, build commands, project structure) but only works with Claude Code. AGENTS.md is the cross-tool open standard (Linux Foundation / AAIF) that works across Codex, Cursor, Copilot, Windsurf, Gemini CLI, and others. Teams using multiple tools benefit from AGENTS.md portability; teams committed to Claude Code get more depth from CLAUDE.md. Both can coexist in the same repo.
Key Concepts for Newcomers
- Agentic: Unlike a chat interface, Claude Code takes actions — it doesn't just tell you what to do, it does it.
- Permission model: Claude Code asks before running commands or making changes you haven't approved.
- Context: It automatically reads relevant files rather than requiring you to paste them in.
- CLAUDE.md: A project file that gives Claude Code persistent context about your codebase — coding conventions, build commands, project structure.
Key Characteristics
| Property | Value |
|---|---|
| Interface | Terminal CLI, Desktop app, Web app, IDE extensions |
| Provider | Anthropic |
| License | MIT (CLI); Proprietary (Claude.ai Terms) |
| Pricing | Anthropic API usage or Claude Max subscription |
| Underlying model | Claude Fable 5, Opus 5 (default Opus), Opus 4.8, Opus 4.7, Sonnet 4.6, Haiku 4.5 |
| SWE-bench Verified | 95% (Fable 5 model score); 88.6% (Opus 4.8) |
| Sandbox | Application layer (permission model + 17 hook events) |
| GitHub | anthropics/claude-code |
| Website | claude.com/product/claude-code |
| Docs | docs.anthropic.com/en/docs/claude-code |
Cost of Ownership
Claude Code's pricing model is fundamentally different from its competitors — and the difference matters more than the headline price.
| Tool | Pricing Model | Monthly Cost (Individual) | Cost Structure |
|---|---|---|---|
| Claude Code | API usage or Max subscription | Max ~$100–200/mo; API varies | Pay for tokens consumed |
| Cursor | Subscription + credits | $20–200/mo | Fixed seat + model credits |
| GitHub Copilot | Subscription | $10–39/mo/seat | Flat rate, all-you-can-eat |
| OpenAI Codex | Bundled with ChatGPT | $20–200/mo | Included with subscription |
| Devin | Subscription + compute | $20/mo + $2.25/ACU | Pay per 15-min task unit |
| OpenHands | Self-hosted + API keys | $0 + API costs | Ops overhead is the hidden cost |
The real cost question is cost per completed task, not monthly subscription. Claude Code on API billing uses ~4x more tokens than Codex per task (trades efficiency for thoroughness), but its higher SWE-bench score means fewer failed attempts and less human rework. A task that takes Claude Code $2 in tokens but succeeds on the first try is cheaper than a $0.50 attempt that requires a human to finish.
For teams: GitHub Copilot at $19–39/seat is the cheapest all-you-can-eat option and the right choice if your primary use case is completions and light agent work. Claude Code on API billing makes sense for heavy agentic usage where per-task success rate matters most. Cursor's credit model is the most complex to budget — the "unlimited auto-mode" is unlimited only when Cursor picks the model.
Claude Code Security (Research Preview)
Anthropic launched Claude Code Security on February 20, 2026 — an AI-driven vulnerability scanning capability built on top of Claude Code (web). Unlike traditional SAST tools, it reasons about code rather than pattern-matching: it traces data flows across files, understands context, and identifies multi-component vulnerability patterns that rule-based scanners miss.
Key characteristics:
- Uses Claude Opus 4.6 as the scanning engine
- Multi-stage verification: findings are re-analyzed to filter false positives before surfacing
- Human-in-the-loop: each finding includes a confidence rating; patches are suggested but require human approval before application
- Identified 500+ high-risk vulnerabilities across production OSS codebases in its initial runs — some issues had existed for decades, surviving many rounds of manual review
- Available to Enterprise and Team customers, with expedited access for OSS maintainers
(Anthropic announcement, Help Net Security)
Effective Patterns (from Official Docs)
The single highest-leverage practice: give Claude a way to verify its own work. Tests, screenshots, or expected outputs let Claude self-correct without requiring your attention on every mistake.
Explore → Plan → Code → Commit — use Plan Mode to read and plan before touching any files. For multi-file changes or unfamiliar code, this avoids solving the wrong problem. Skip planning for trivial, single-sentence fixes.
Writer/Reviewer pattern — run two parallel sessions. Session A implements; Session B reviews from a clean context (no bias toward code it just wrote). Reviewers regularly surface edge cases the writer missed.
Context threshold: agents are token-intensive — monitor context usage and act before hitting ~60% capacity. Use /compact, /handoff, or start a fresh session to avoid the degraded performance that comes from a nearly-full context window.
MCP servers and context cost: every connected MCP server loads its tool definitions into the context window at startup. Be selective — connect only the servers you actively use in a given session rather than leaving all of them enabled by default.
Common failure patterns to avoid:
- Kitchen sink session: unrelated tasks in one session pollute context —
/clearbetween tasks - Correction loop: two failed corrections signal a bad prompt, not a dumb model —
/clearand rewrite with what you learned - Over-specified CLAUDE.md: too many rules means important ones get lost — prune to what Claude actually gets wrong
- Infinite exploration:
"investigate X"without scope reads hundreds of files — use subagents so exploration doesn't consume main context
Further Reading
- Claude Code Architecture Breakdown — full deep dive into the agentic harness, context engineering, and safety model
- Claude Code Security — official product page
- Effective Context Engineering for AI Agents (Anthropic)
- Building Effective Agents (Anthropic)