Claude Code 2.1.321 Lets Mods Skip the Permission Prompt

• Claude Code 2.1.321 shipped November 9 and lets mods Claude writes turn on without asking in auto and bypass modes

• Mod tool calls skip permission prompts too, even under your own ask rules in dontAsk and -p runs

• Two safeguards still apply, deny rules and organization policy, only the ask step itself is gone

• The same release makes Claude Fable 5.2 the default Fable model, with a 1M-token context window

Claude Code 2.1.321 landed on November 9 and changed how much say you get the moment Claude finishes writing a mod. In auto and bypass modes, a mod now turns itself on without asking, and its own tool calls run without a permission prompt either, even if your settings would normally ask first. That's a real convenience, and it's also a change worth reading closely before you run it unattended.

What Changed in Claude Code 2.1.321?

Two related changes landed in the same release, both about mods, the small pieces of code Claude writes to customize Claude Code itself: a status line, a panel beside the chat, a slash command, a hook that fires on your tool calls. Before 2.1.321, a mod Claude just wrote waited for you to turn it on, the same as any new capability would. Now, in auto mode and bypass mode, that wait is gone.

The mod just activates.

The changelog is specific about how far this reaches. It turns on even when your managed settings set allowUnsandboxedCommands: false or restrict Claude to an approved list of domains with allowManagedDomainsOnly. Those settings exist to put a ceiling on what Claude can do without asking, and this release lets a freshly written mod clear that ceiling automatically, as long as you're in auto or bypass mode. The one mode where it doesn't apply is dontAsk: a mod simply won't load there at all, which reads like Anthropic drawing one firm line even while it loosens the others.

I'd read "mods Claude writes" literally: it names a mod Claude generates mid-session, the kind you'd get by asking it to build a quick status line or a custom hook on the fly, not one you downloaded from somewhere and installed yourself. Those Claude-written mods used to get the same new-capability prompt as anything else Claude hadn't done before in that session. Now they don't, at least not in the two modes most people actually run day to day.

That distinction is easy to miss on a quick read of the changelog. It's worth sitting with for a second before moving on.

It's one line in a changelog that also covers a model release and a remote-control settings flag. But it's the kind of change that doesn't show up until you notice a mod running that you don't remember approving, and by then you want to already understand why it happened.

Why Do Mods Skip Permission Prompts Now?

The second change covers what a mod does once it's running, not just whether it turns on. A mod's own tool calls, the changelog names $.tool.call and $.mcp.call specifically, now raise no permission prompt. That holds even under your own custom ask rules, and even in dontAsk mode or a scripted -p run, two places where you'd expect every action to either go through quietly or get blocked outright.

Picture a mod that pops a toast when a long command finishes. If that mod needs to call a tool to check command status, it used to hit your ask rules like anything else would, possibly pausing a session you're not watching to confirm something small and automatic. Now it just runs. The friction that used to flag "something new is calling a tool" is gone for mods specifically, while every other tool call in the same session still follows your rules exactly as written.

Two things still stop a mod, and the changelog leans on the same pair for both changes: deny rules and organization policy. If you've explicitly denied a command pattern or a domain, that denial still fires no matter where the call came from. If your org has locked something down at the policy level, a mod doesn't get a pass either. What's gone is only the ask step, the prompt that used to sit between "Claude wants to do this" and "this happens." The deny step and the policy step weren't touched.

That's narrower than it sounds on first read. It isn't "mods can now do anything." It's "mods no longer wait for you to say yes to things you hadn't already said no to." The difference matters a lot if you've been treating the ask prompt itself as your review step, rather than writing explicit deny rules, because the prompt is exactly the part this release removes.

Think about what a prompt actually did for you before this release. It wasn't the real security boundary, that's always been deny rules and org policy, but it was a moment where you saw a new action named out loud and could stop it cold just by doing nothing. That moment is what's missing now for a mod's own calls. The boundary didn't move. The warning light in front of it did.

Is This Safe for a Solo Builder Running Mods?

For a one-person studio, the honest answer is: safe enough if you already lean on deny rules, less safe if the prompt has been doing that job for you.

Most solo setups don't run with a long deny list. They run on defaults, plus whatever gets approved in the moment a prompt shows up. That's exactly the workflow this release changes. If you write a mod, ask Claude to extend one, or just let a session build one on the fly while you're in auto mode, it now starts working immediately, tool calls included. You won't see the prompt that used to announce a new thing just switched on.

I'd do two things with this today. First, if auto mode or bypass mode is your default, read any mod Claude writes before you keep working, the same way you'd read a script before running it, since the one checkpoint that used to exist here is gone. Second, if there's a command pattern or a domain you never want a mod touching, write it as an explicit deny rule now instead of counting on a prompt to catch it later. A deny rule still works under this change. Careful prompt-answering habits don't, because there's one fewer prompt to answer.

I wouldn't swing the other way and start asking for everything again, that undoes the point of auto mode in the first place. AGENTS.md files hidden in a downloaded repo are a different risk, but the lesson rhymes: the fewer prompts stand between Claude and a tool call, the more the actual content of what Claude is running matters, not just whether you clicked yes once.

Same logic applies if you take on client work with Claude Code running in auto mode. A mod that's fine on your own machine, touching your own test data, isn't automatically fine on someone else's. I'd check deny rules per project before this release, and I'd check them again now, since a default that was safe a month ago inherits a slightly different meaning once mods stop asking first.

What Else Shipped in 2.1.321 and 2.1.322?

The same release made Claude Fable 5.2 the default Fable model, with a 1M-token context window, Anthropic's largest for that tier. If you'd saved a Fable 5.1 pick, it moves to fable automatically on Pro and Max plans, with Team and Enterprise following once an org turns it on; /model claude-fable-5-1 switches back if you specifically want the older model. I covered the Fable 5.2 launch itself a day earlier. This release is where it actually becomes what fable means by default inside Claude Code.

2.1.321 also added --settings <file> to claude remote-control, which applies a settings file to every session remote-control starts. Edit that file and nothing changes until you restart remote-control, since no new session picks it up mid-run. That's easy to miss if you're used to settings taking effect the moment you save them.

A day later, 2.1.322 added fast mode on Vertex across its global, US, and EU regions, falling back to standard speed if Vertex refuses the request. That's a narrower rollout than the mods change, useful mainly if you're running Claude through Google's Vertex AI rather than directly, and it's the only change logged for that version.

2.1.321's notes also list smaller fixes worth knowing about even if they don't touch mods directly. Headless sessions now reload mods in .claude/skills when their files change, with CLAUDE_CODE_PLUGIN_DIR_WATCH=0 to turn that off if a mod you're editing shouldn't hot-reload mid-run. Nested skill folders inside ~/.claude/plugins stopped loading when Claude works on files in that directory, which closes a path where a plugin's own skills could quietly apply to work that had nothing to do with the plugin.

None of this touches the MCP task backgrounding and deny setting from three releases back, but the pattern across all of them is the same. Fewer pauses for anything running without a person watching it.

Bottom Line

Mods turning on without a prompt is a deliberate trade, not a bug: less friction for auto mode, in exchange for one fewer checkpoint between Claude finishing a mod and that mod actually running. For most solo setups, that trade is fine as long as you've actually written the deny rules you'd want to lean on, since the prompt that used to catch everything else is the part that's gone now.

If you haven't written those rules yet, this is the week to do it, before a mod surprises you with something a prompt would have caught last month.

Update to 2.1.321 or later if you want Fable 5.2 as your default model, and check your deny rules regardless of whether mods are something you use today. Auto mode is only getting quieter from here, not louder. I'd rather tighten the one safeguard that still works than find out later I was relying on the one that just quietly stopped.