# Claude Code

> Source: https://aiwiki.ai/wiki/claude_code
> Updated: 2026-08-01
> Categories: AI Agents, AI Code Generation, Anthropic, Developer Tools
> License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)
> From AI Wiki (https://aiwiki.ai), the free encyclopedia of artificial intelligence. Reuse freely with attribution to "AI Wiki (aiwiki.ai)".

Claude Code is an agentic software development product made by [Anthropic](/wiki/anthropic). It uses models from the [Claude](/wiki/claude) family to inspect software projects, propose and apply changes, run development tools, and report results through a conversational interface. Anthropic introduced it as a limited research preview alongside Claude 3.7 Sonnet on February 24, 2025, and made it generally available with the Claude 4 release on May 22, 2025.[1][2] As of August 2026 it runs on a terminal client, editor extensions for Visual Studio Code and JetBrains IDEs, a desktop application, a browser client and a mobile client, all driven by the same underlying engine and configuration files.[3][4]

Claude Code is one of a broader class of [AI agents](/wiki/ai_agents) designed for software work. Its distinctive operating model is access to a developer's actual project and tools rather than generation of an isolated code snippet. Depending on the interface and permissions, it can read files, search a repository, edit source code, run tests and shell commands, use version-control workflows, and connect to external services. These capabilities can affect source code, credentials, networks, and build systems, so Anthropic's documentation treats user review, scoped permissions, and sandboxing as core parts of the product rather than optional precautions.[3][24]

Three related names are easy to confuse and are worth separating at the outset. Claude is the underlying model family. Claude Code is the agent product built on it. The [Claude Agent SDK](/wiki/claude_agent_sdk), renamed from the Claude Code SDK in September 2025, is a Python and TypeScript library that exposes the same agent loop and tools to other applications; Anthropic's branding guidance explicitly forbids partners from calling an SDK-based product "Claude Code".[19][34]

The official client repository is publicly viewable, but its license reserves all rights to Anthropic and subjects use to Anthropic's commercial terms. It is therefore inaccurate to describe Claude Code itself as open-source software.[35]

## Product model and workflow

Claude Code operates as a conversational agent around a working software project. A user can ask it to explain unfamiliar code, trace a defect, plan a change, edit files, run a test suite, investigate a build failure, or prepare version-control changes. The agent combines a language model with tools for file access, text search, editing, command execution, and task coordination. Tool availability differs by surface and by administrator or user configuration.[3]

The normal workflow remains supervised, although how much supervision is expected has shifted. Claude Code can take many steps without a new prompt, but access to tools does not establish that its output is correct. Anthropic's security guidance directs users to review proposed code and commands, particularly when a task involves sensitive files, production systems, package installation, or untrusted repository content.[24] This matters because plausible source code can still contain logic errors, insecure assumptions, fabricated APIs, or changes outside the intended scope.

Each interactive session has a finite context. Project instructions can be placed in `CLAUDE.md` files, while auto memory can retain concise notes that Claude Code derives from earlier work. The documented instruction scopes include organization-managed policy, user-level preferences, project instructions committed with a repository, and local project instructions that are not intended for version control.[11] A `CLAUDE.md` file supplies model context. It is not an access-control mechanism, and deterministic restrictions should instead use permissions, managed settings, hooks, or an external sandbox.[11][22]

## Interfaces and execution environments

Anthropic describes the surfaces as sharing one engine: `CLAUDE.md` files, settings, and configured MCP servers apply across them, while each is tuned to a different way of working.[3][4] The table summarises the first-party surfaces as documented in August 2026.

| Surface | Platforms | Status and notes |
|---|---|---|
| Terminal CLI | macOS 13+, Windows 10 1809+ or Server 2019+, Ubuntu 20.04+, Debian 10+, Alpine 3.19+ | The original and most complete surface. Scripting, non-interactive `-p` runs, and third-party model providers are CLI-oriented[3][28] |
| [Visual Studio Code](/wiki/visual_studio_code) extension | Wherever VS Code runs; also installable in [Cursor](/wiki/cursor) | Inline diffs, @-mentions, plan review, conversation history[3][4] |
| JetBrains plugin | IntelliJ IDEA, PyCharm, WebStorm and other JetBrains IDEs | Distributed on the JetBrains Marketplace under the name "Claude Code [Beta]"; requires the CLI installed separately and runs it in the IDE terminal[3][20] |
| Desktop application | macOS universal build, Windows x64 and ARM64, Linux in beta via apt or .deb for Ubuntu and Debian | A Code tab inside the Claude desktop app alongside Chat and [Cowork](/wiki/claude_cowork). Parallel sessions in isolated git worktrees, visual diff review, scheduled tasks, SSH and WSL sessions, and computer use on macOS and Windows[5] |
| Web | Desktop browsers at claude.ai/code | In research preview for Pro, Max and Team users, and for Enterprise users with premium or Chat + Claude Code seats. Each task runs in an isolated Anthropic-managed virtual machine[6][7] |
| Mobile | Claude app for iOS and Android | A thin client into cloud sessions, or into a local session through Remote Control[4] |

The interfaces are related but not identical. Terminal and editor sessions can reach local tools permitted by the operating system and Claude Code configuration. Cloud sessions use an Anthropic-managed environment with its own repository and network configuration; isolation reduces direct access to the user's computer, but a task can still affect any repository, secret, or network destination made available to its environment, so credentials and network access have to be scoped to the task.[6][24] Feature parity is incomplete in both directions: the desktop app has no `dontAsk` permission mode, no agent teams, and no scripting interface, while the CLI has no file attachments and isolates sessions through an explicit `--worktree` flag rather than automatically.[5]

Several mechanisms move work between surfaces or drive it from elsewhere. `claude --cloud` starts a cloud session from a local checkout and `claude --teleport` pulls a cloud session and its branch back into the terminal; Remote Control exposes a running local session for steering from a browser or phone; channels push external events such as CI results into a running session; and routines run tasks on Anthropic-managed infrastructure on a schedule, on an API call, or in response to GitHub events.[4][6]

## Capabilities

### Models, effort, and fast mode

Claude Code selects models through aliases rather than fixed identifiers, and the version an alias resolves to depends on the provider and changes over time. As of August 2026 the documented aliases are `default`, `best`, `fable`, `opus`, `sonnet`, `haiku`, the extended-context forms `opus[1m]` and `sonnet[1m]`, and `opusplan`, which uses Opus while planning and switches to Sonnet for execution.[8]

On the [Anthropic API](/wiki/anthropic_api), `opus` resolves to [Claude Opus 5](/wiki/claude_opus_5) and `sonnet` to [Claude Sonnet 5](/wiki/claude_sonnet_5). Third-party deployments lag: on [Amazon Bedrock](/wiki/amazon_bedrock) and Google Cloud's Agent Platform, formerly [Vertex AI](/wiki/google_vertex_ai), `sonnet` resolved to Sonnet 4.5, and on Microsoft Foundry `opus` resolved to Opus 4.6 and `sonnet` to Sonnet 4.5.[8]

There is no single default model. The `default` setting resolves by account type: Opus 5 on Max, Team Premium, Enterprise pay-as-you-go and the Anthropic API; Sonnet 5 on Pro, Team Standard and Enterprise subscription seats; and Sonnet 4.5 on Microsoft Foundry. Administrators can override this with an organization default model, and an `availableModels` allowlist in managed settings can restrict which models are selectable at all.[8]

[Claude Fable 5](/wiki/claude_fable_5) is described in Anthropic's documentation as the most capable model available in Claude Code and is aimed at long autonomous sessions, but it is not the default on any account type and must be chosen explicitly. It is unavailable to organizations under zero data retention. Requests that its cybersecurity or biology safety classifiers flag are automatically re-run on an Opus model, and thinking cannot be turned off on it.[8] [Claude Haiku 4.5](/wiki/claude_haiku_4_5) remains available through the `haiku` alias for simple tasks and is commonly assigned to subagents to reduce cost.[8][33]

Separately from model choice, an effort level controls how much the model reasons per step. The documented levels are `low`, `medium`, `high`, `xhigh` and `max`, with `high` the default on every model that supports effort except Opus 4.7. The `/effort` menu also offers `ultracode`, which Anthropic describes as a Claude Code setting rather than a model effort level: it sends `xhigh` to the model and additionally has Claude orchestrate dynamic workflows for substantive tasks.[8]

Fast mode, a research preview, is not a separate model. Anthropic describes it as "a high-speed configuration for Claude Opus, making the model up to 2.5x faster at a higher cost per token", supported on Opus 5 and Opus 4.8 and priced at US$10 per million input tokens and US$50 per million output tokens. It is available only through the Anthropic API or a Claude subscription, requires usage credits to be enabled, is off by default for Team and Enterprise organizations until an owner turns it on, and is not supported in the VS Code extension.[9]

### Tools, sessions, and checkpoints

Claude Code's built-in tools support common software-development operations, including reading and editing files, searching a codebase, invoking shell commands, and coordinating tasks. It can use ordinary command-line programs already present in the environment, which lets it work with test runners, compilers, package managers, and version-control clients without a product-specific integration for each one.[3]

File checkpointing provides a recovery mechanism for direct edits made by Claude Code during a session. A user can rewind the conversation, restore code, or do both. Checkpoints do not capture files changed by shell commands, changes made manually by the user, or changes made outside the session, and they are not a replacement for version control.[10] This boundary matters for migrations, generated files, formatters, and scripts whose effects may extend beyond files edited through Claude Code's file tools.

Sessions can be resumed, forked or continued across supported interfaces, but the available context still depends on the session and its stored state. Claude Code compacts an extended conversation to remain within the model's context window, and on Sonnet 5 with its one-million-token window the documented automatic compaction threshold is around 967,000 tokens.[3][8] Important project requirements should therefore live in durable project documentation and tests rather than only in a long chat transcript.

### Project instructions, skills, and hooks

`CLAUDE.md` and files under `.claude/rules/` let a project describe commands, architecture, coding conventions, review expectations, and directory-specific guidance. More specific instruction files can be loaded for relevant paths. Managed settings can impose organization-wide configuration that users cannot override, including an organization-wide `CLAUDE.md` that sessions cannot exclude.[11][26]

Agent skills, the same mechanism marketed elsewhere as [Claude Skills](/wiki/claude_skills), package reusable instructions and supporting resources in a `SKILL.md` file. Claude Code can discover skills and invoke them when their descriptions match a task, and Anthropic's cost guidance recommends moving specialised instructions out of `CLAUDE.md` and into skills so they load only when needed. Custom slash commands remain supported and are documented alongside skills.[12][33] Plugins bundle skills, subagents, hooks and MCP servers into an installable unit distributed through marketplaces, which administrators can restrict.[26] Output styles adapt Claude Code's behaviour for uses beyond software engineering, including a proactive style that keeps the agent working with fewer clarifying questions.[20]

Hooks are user-defined commands, HTTP requests, model prompts, or agent checks that run at documented lifecycle events. They can validate a proposed command, run formatting after an edit, record an event, or block an operation under specified conditions.[13] Because command hooks execute with the user's operating-system privileges, a project should review hook definitions before trusting them. A hook can make a rule deterministic, but a prompt-based hook still depends on model behavior.

### External tools and the Model Context Protocol

Claude Code can connect to external tools and data through the [Model Context Protocol](/wiki/model_context_protocol). An [MCP server](/wiki/mcp_server) can expose actions or resources such as issue trackers, databases, documentation systems, and browser automation. The client supports local and remote server configurations, authentication for compatible remote services, project-scoped configuration, and managed organization policy.[14] To limit context cost, MCP tool definitions are deferred by default so only tool names enter the context window until a tool is used.[33]

An MCP connection expands the agent's authority. A server may return untrusted content or permit consequential actions, and its credentials can provide access beyond the current repository. Anthropic states that it reviews connectors against listing criteria before adding them to its directory but "does not security-audit or manage any MCP server", so provenance, transport security, permissions and output must be evaluated separately from Claude Code itself.[14][24]

### Subagents and multi-agent workflows

Claude Code can delegate a bounded task to a [subagent](/wiki/claude_code_subagents) with its own context, system instructions, tool access, and permission mode. The subagent returns its result to the calling session, helping separate research, testing, or review from the main context.[15] Subagents are not independent security principals unless their tools and permissions are actually restricted; they run in the same process as the parent session and inherit its sandbox configuration.[23] Anthropic added a default cap of 20 concurrently running subagents in version 2.1.217 and allowed nesting up to three levels by default in 2.1.219.[36]

Agent teams are a distinct experimental feature in which multiple Claude Code sessions coordinate through shared tasks and messages. Anthropic's documentation marks the feature as disabled by default and lists limitations involving session resumption, task coordination, and shutdown behavior; its own cost guidance states that teams use roughly seven times more tokens than standard sessions when teammates run in plan mode.[16][33] Dynamic workflows, introduced in May 2026, expand a task into parallel subagents based on work discovered at runtime, with an advisory size guideline that defaults to fewer than 15 agents.[17][36]

## Integrations and automation

Claude Code's GitHub Actions integration can respond to an `@claude` mention in an issue or pull request and perform work on a GitHub-hosted runner. The workflow uses the repository's configured permissions and secrets, and its result can include a commit or pull request.[18] A GitLab CI/CD equivalent exists, as does a Slack integration; Anthropic's documentation notes that the earlier Slack version is being retired for Team and Enterprise workspaces in favour of Claude Tag, while remaining the setup path on Pro and Max plans.[4] None of these eliminate the need for branch protection, least-privilege workflow permissions, and human review of generated changes.

The Claude Agent SDK exposes the same agent loop, built-in tools, hooks, subagents, permissions, sessions and skill loading for custom applications in Python and TypeScript. To drive the same loop from another language, Anthropic directs developers to run the CLI as a subprocess with `-p` and JSON output. The SDK is related to Claude Code but is not the command-line client, and Anthropic's branding rules forbid presenting an SDK-based product as Claude Code. Applications built with it have their own security, privacy, and licensing responsibilities, and Anthropic states that third-party developers may not offer claude.ai login or rate limits for such products without prior approval.[19]

Organizations can authenticate Claude Code directly with Anthropic or configure supported cloud platforms, including Amazon Bedrock, Google Cloud's Agent Platform, Microsoft Foundry, and Claude Platform on AWS. Provider choice changes authentication, model availability, billing, telemetry defaults, and some data-governance details. Several features that depend on a claude.ai account, including Claude Code on the web, routines, Code Review, Remote Control, and the Chrome integration, are not available through Console API keys or cloud-provider credentials alone.[26]

## Permissions, sandboxing, and security

### Permission modes and rules

Claude Code's permission system classifies tool uses through allow, ask, and deny rules. Deny rules take precedence, and users and administrators can scope rules by tool and, for supported tools, by command or resource pattern.[22] Layered on top of the rules are permission modes, which set the baseline for how often the agent pauses:

| Mode | What runs without asking |
|---|---|
| `default`, labelled Manual in the interface | Reads only |
| `acceptEdits` | Reads, file edits, and a fixed set of filesystem commands such as `mkdir`, `mv` and `cp` inside the working directory |
| `plan` | Reads, plus classifier-approved commands where auto mode is available |
| `auto` | Everything, subject to a background classifier |
| `dontAsk` | Only pre-approved tools; anything else is auto-denied |
| `bypassPermissions` | Everything |

Auto mode, announced on March 24, 2026 as a research preview for Team customers and later extended to all Claude Code users, replaces the per-action prompt with a separate classifier model that reviews each pending action. Anthropic states that the classifier blocks work that "escalates beyond your request, targets unrecognized infrastructure, or appears driven by hostile content Claude read".[20][21] The documented default block list is long and specific: downloading and executing code, force pushes, production deploys and migrations, destroying infrastructure, printing live credentials into a transcript, opening pull requests against repositories the user did not name, and writing to Claude Code's own session transcripts, among others. The classifier runs on Claude Sonnet 5 by default, sees user messages, tool calls and `CLAUDE.md` content but not tool results, and pauses auto mode after three consecutive or twenty total blocks.[20] Anthropic warns that auto mode "reduces permission prompts but does not guarantee safety".[20]

Writes to a documented set of protected paths, including `.git`, `.claude`, shell startup files and package-manager configuration, are never auto-approved except in bypass mode, and allow rules in settings files cannot pre-approve them.[20] The initial workspace-trust prompt is a security boundary because a repository can contain project instructions, hooks, MCP configuration, and other material that influences an agent session.[24] Bypassing permission checks entirely removes these controls and should be limited to an externally isolated environment; the flag that does so is covered separately at [claude --dangerously-skip-permissions](/wiki/claude_--dangerously-skip-permissions).

### Sandboxing

Optional sandboxing adds operating-system enforcement around shell subprocesses. Anthropic documents Apple's Seatbelt on macOS and `bubblewrap` on Linux and Windows Subsystem for Linux 2, with `socat` used to route sandboxed traffic and an optional seccomp filter that blocks Unix domain sockets. Native Windows is not supported and WSL1 is not supported.[23]

Under the default configuration, sandboxed commands can write only to the working directory and the session temporary directory while retaining broad read access to the rest of the machine, which Anthropic notes still permits reading credential files unless they are explicitly denied. No network domains are pre-allowed; a proxy running outside the sandbox enforces an allowlist, and a `strictAllowlist` setting added in version 2.1.219 denies non-allowlisted hosts outright rather than prompting.[23][36] Administrators can require the sandbox through managed settings, refuse to start when it is unavailable, and disable the escape hatch that lets a failed command be retried outside it.[23]

Anthropic documents the sandbox's limits candidly. The built-in proxy makes its allow decision from the client-supplied hostname without terminating TLS by default, so "code running inside the sandbox can potentially use domain fronting or similar techniques to reach hosts outside the allowlist"; broad allowlist entries such as `github.com` are described as creating paths for data exfiltration. Other named weaknesses include privilege escalation through permitted Unix sockets, a weaker nested mode used inside unprivileged containers, and the `allowAppleEvents` setting, which removes code-execution isolation on macOS.[23]

### Prompt injection and vulnerability reporting

[Prompt injection](/wiki/prompt_injection) is a particular concern when an agent reads source code, issue text, web pages, logs, or tool output controlled by another party. Anthropic lists the permission system, context-aware analysis of requests, input sanitization, workspace trust verification, an isolated context window for web fetches, command-injection detection, fail-closed matching for unrecognised commands, and a requirement that network-fetching commands such as `curl` and `wget` be approved rather than auto-allowed. It also notes that a server-side probe scans incoming tool results for suspicious content before Claude reads them. Its own summary is that "while these protections significantly reduce risk, no system is completely immune to all attacks".[24][20]

Anthropic accepts vulnerability reports for Claude Code through HackerOne[25] and asks researchers not to disclose vulnerabilities publicly before remediation.[24]

## Enterprise deployment and administration

Anthropic documents four delivery mechanisms for managed policy, applied in priority order: server-managed settings from the claude.ai admin console, which reach devices at authentication time and refresh hourly; a macOS plist or Windows HKLM registry policy; a managed settings file on disk; and the Windows user registry, which the documentation flags as writable without elevation and therefore a convenience default rather than an enforcement channel. Managed values take precedence over user and project settings, and array settings such as `permissions.allow` merge across scopes so developers can extend but not remove managed entries.[26]

The documented enforcement surface is broad. Administrators can set permission allow and deny rules, lock permissions so that only managed rules apply, disable bypass-permissions mode and auto mode, require sandboxing with a domain allowlist, deploy an organization-wide `CLAUDE.md`, restrict or fix the set of usable MCP servers, restrict plugin marketplaces, block skills and hooks that do not come from plugins or managed settings, restrict which login method or Anthropic organization may be used, disable background agents, and set version floors or a required version range that makes Claude Code refuse to start outside it.[26] Cloud sessions on the web are governed separately through organization-shared cloud environments that fix network access level, environment variables and setup scripts.[6][26]

For visibility, OpenTelemetry export works on every provider and is the only option that streams per-user token and cost metrics into an organization's own observability stack. Team and Enterprise plans additionally have an analytics dashboard and a spend report with CSV export, Enterprise has an analytics API, and Console organizations have a Claude Code dashboard and analytics API. Usage on Amazon Bedrock, Google Cloud's Agent Platform or Microsoft Foundry is not reported back to Anthropic, so those deployments rely on cloud billing tools, OpenTelemetry, or a gateway.[26][33]

Anthropic publishes its own cost baseline for planning purposes: across enterprise deployments the average is "around $13 per developer per active day and $150-250 per developer per month, with costs remaining below $30 per active day for 90% of users". These are Anthropic's figures for its own customer base, not an independent measurement.[33]

## Data handling

Data terms depend on how Claude Code is obtained. Anthropic states that it does not train generative models on code or prompts sent to Claude Code under commercial terms for Team, Enterprise, API, third-party platform and Claude Gov users, unless the customer opts into a program such as the Development Partner Program. Consumer users on Free, Pro, or Max choose whether their data, including Claude Code sessions, may be used to improve models.[27] The applicable consumer or commercial terms, rather than the interface alone, determine the contractual treatment.[29]

Retention differs by account type. Commercial accounts have a standard 30-day retention period, with zero data retention available to qualified Claude for Enterprise accounts rather than being included in the standard plan. Consumer accounts that allow data use for model improvement have a five-year retention period, and those that do not have 30 days. Transcripts submitted through `/feedback`, `/bug` or `/share` are retained for five years, while a transcript volunteered after a session-quality survey is retained for up to six months.[27]

Locally run Claude Code stores session transcripts in plaintext under `~/.claude/projects/` for 30 days by default, adjustable through `cleanupPeriodDays`. Users must protect this directory because transcripts can contain source excerpts, command output, and other sensitive context.[27]

Two kinds of operational telemetry are documented. Usage metrics cover latency, reliability and usage patterns and "never include your code, prompts, or file paths". Error reports contain error messages and stack traces from Claude Code's internals with known secret, path, email and personal-information patterns redacted, and are enabled only for Pro or Max sign-ins on version 2.1.198 or later that connect directly to the Claude API without a zero-data-retention or HIPAA agreement. Both default to off on Amazon Bedrock, Google Cloud's Agent Platform, Microsoft Foundry and Claude Platform on AWS. A separate WebFetch safety check sends the requested hostname, but not the full URL or page contents, to Anthropic regardless of provider.[27]

Hosted Claude Code tasks run in isolated virtual machines. Anthropic states that GitHub credentials never enter the sandbox, that authentication is handled through a scoped-credential proxy, that outbound traffic passes through a security proxy for audit logging, and that git pushes are restricted to the working branch.[6][24][27] Administrators should still evaluate the exact telemetry and logging configuration used in their environment.

## Installation and authentication

Anthropic recommends its native installer, which auto-updates in the background on a selectable `latest` or `stable` release channel. Supported package-manager routes include Homebrew on macOS, WinGet on Windows, and signed apt, dnf and apk repositories on Linux, none of which auto-update by default. npm remains an alternative route; as of version 2.1.198 it requires Node.js 22 or later and installs the same platform-specific native binary as the standalone installer, which does not itself invoke Node at runtime. Each release publishes a `manifest.json` of SHA256 checksums signed with an Anthropic GPG key, and macOS and Windows binaries carry platform code signatures.[28]

The documented minimum platforms are macOS 13.0 or later, Windows 10 version 1809 or Windows Server 2019 or later, Ubuntu 20.04, Debian 10, and Alpine Linux 3.19, with at least 4 GB of memory and an x64 or ARM64 processor. Windows sessions can use a native installation or Windows Subsystem for Linux, but sandboxing requires WSL 2.[28]

Direct Anthropic authentication supports paid Pro, Max, Team, and Enterprise access, or metered use through an Anthropic Console account. Claude Code is not included in Anthropic's free plan. Authentication through a supported cloud provider instead uses that provider's identity and billing configuration.[28] Anthropic's legal guidance says that plan subscribers should use the interactive login intended for their plan, while applications and services built for other users should use API credentials rather than relaying a personal plan login.[19][29]

## Plans and pricing

Pricing is time-sensitive. On August 1, 2026, Anthropic listed the following United States prices before applicable tax and subject to usage limits:

| Plan | Listed price | Claude Code access |
|---|---:|---|
| Free | US$0 | Not included |
| Pro | US$17 per month with the annual discount, billed as US$200 up front, or US$20 billed monthly | Included |
| Max | From US$100 per month | Included, with higher usage tiers |
| Team Standard | US$20 per seat per month billed annually, or US$25 billed monthly | Included |
| Team Premium | US$100 per seat per month billed annually, or US$125 billed monthly | Included, with a larger seat allowance |
| Enterprise | US$20 per seat plus usage at API rates | Included for provisioned users |

These prices and entitlements come from Anthropic's pricing and plan documentation, not from a permanent product guarantee.[30][31] Entitlements have moved before: The Register reported that in April 2026 Anthropic briefly removed Claude Code from the Pro plan on its pricing page, and Anthropic's head of growth described the change as "a small test on ~2 percent of new prosumer signups" that did not affect existing subscribers.[46] Pro again listed Claude Code as included in August 2026.[30]

Usage allowances are shared across Claude surfaces for a subscriber rather than being specific to Claude Code, and limits vary with model, workload, context length, and plan.[32] On Team and Enterprise plans each member's usage draws from a per-seat allowance that resets on a rolling five-hour window and a weekly window, shared with Claude chat and Cowork, with the allowance depending on whether the seat is Standard or Premium.[33] Usage credits allow work to continue past the allowance where an organization enables them, and fast mode draws from usage credits directly rather than counting against included usage.[9][33] API and cloud-provider use is billed separately under the relevant account.

## License and source availability

Anthropic maintains a public GitHub repository for Claude Code release records, issue reporting, and documentation pointers. Public visibility does not by itself grant an open-source license. The repository's license states in full that Anthropic retains all rights and that use is subject to its commercial terms of service.[35] Users should not assume rights to redistribute, modify, or incorporate the client beyond those terms.

The Anthropic API, Claude Agent SDK, MCP servers, extensions, plugins, and third-party integrations are separate components with different licenses and contractual boundaries. An application built with the Agent SDK is not part of Claude Code, and an open-source MCP server does not make the Claude Code client open source.[14][19][29]

## Release history

Claude Code changes frequently, with releases roughly daily during 2026. The following milestones describe product availability and major interfaces rather than every point release.

| Date | Milestone |
|---|---|
| February 24, 2025 | Limited research preview released with Claude 3.7 Sonnet; first npm publish the same day[1][37] |
| May 22, 2025 | General availability announced with Claude 4, alongside beta development-environment integrations and an SDK[2][37] |
| September 29, 2025 | Claude Code 2.0 added a native Visual Studio Code extension, checkpoints, and an updated terminal experience; Anthropic also renamed the Claude Code SDK to the Claude Agent SDK[34][37] |
| October 20, 2025 | Claude Code on the web launched, still in research preview as of August 2026[6][7] |
| February 20, 2026 | Claude Code Security entered limited research preview[38] |
| March 9, 2026 | [Claude Code Review](/wiki/claude_code_review) entered research preview for Team and Enterprise plans[39] |
| March 24, 2026 | Auto mode announced as a research preview on the Team plan, with a classifier reviewing each action in place of a permission prompt[21] |
| May 28, 2026 | Dynamic workflows introduced for parallel, runtime-directed subagent work[17] |
| June 9, 2026 | Version 2.1.170 added Claude Fable 5, described as the most capable model available in Claude Code[36][37] |
| June 30, 2026 | Version 2.1.197 added Claude Sonnet 5 with a native one-million-token context window[36][37] |
| July 24, 2026 | Version 2.1.219 added Claude Opus 5 as the model the `opus` alias resolves to, added the `strictAllowlist` sandbox setting, and removed Opus 4.7 from fast mode[36][37] |
| July 24, 2026 | Version 2.1.220, still the latest published release on August 1, 2026, contained reliability and bug fixes[36][37] |

Model availability depends on plan, provider, administrator policy, and release channel, so a version that adds a model does not make it available to every session.[8]

## Associated services

[Claude Code Review](/wiki/claude_code_review) is a pull-request review service that Anthropic introduced in research preview for Team and Enterprise customers. It assigns multiple agents to examine a change from different perspectives and posts findings for human review. Anthropic states that it does not approve a pull request, leaving that decision to a person. The service uses additional tokens and was separately billed during the preview.[39] A related in-session command, `/code-review ultra` or ultrareview, runs a deep multi-agent review in a cloud sandbox.[36]

Claude Code Security is a separate research-preview service for vulnerability analysis and patch suggestions. At launch, Anthropic opened the limited preview to Team and Enterprise customers and invited open-source maintainers to apply for free, expedited access. Suggested findings and patches require human validation; the launch announcement did not establish that the system detects every vulnerability or that its suggestions are safe to apply automatically.[38]

[Claude Cowork](/wiki/claude_cowork) shares the desktop application with Claude Code but is a separate agentic-work product for non-engineering tasks; Anthropic's own documentation states that Cowork "is not a Claude Code surface" and does not receive server-managed settings.[8] [Claude Dispatch](/wiki/claude_dispatch), a persistent conversation in the Cowork tab, can spawn a Claude Code session on a paired desktop machine.[5] These services should not be conflated with the local client's ordinary code explanation, testing, and review capabilities. Their availability, billing, execution environment, and data handling can differ from an interactive Claude Code session.

## Research and evaluation

Evidence about Claude Code's use and effects remains limited and should be separated from product marketing. Three 2026 studies provide useful but non-equivalent observations.

An Anthropic-authored analysis examined roughly 400,000 interactive Claude Code sessions from about 235,000 people between October 2025 and April 2026. Using privacy-preserving, model-based classifiers, the authors estimated that people made about 70 percent of planning decisions and about 20 percent of execution decisions in the sampled interactions.[40] The report characterizes patterns in Anthropic's own product data. It is not an independent audit, a randomized comparison, or evidence that a particular division of decisions produces better software.

Santos and colleagues studied 328 `CLAUDE.md` configuration files drawn from the 100 most popular public projects in their sample. Their workshop paper found that architecture and system-design guidance was a common concern in these files and proposed a taxonomy of configuration practices.[41] The sample covers prominent public repositories, not typical private projects, and the authors note that one researcher performed the initial classification before review by two others. The findings describe published configuration files during a fast-changing period rather than a universal best-practice standard.

Murphy-Hill and colleagues reported an observational analysis of command-line coding-agent adoption among tens of thousands of Microsoft engineers in early 2026. Across the evaluated tools, adopters produced about 24 percent more merged pull requests than an estimated no-adoption counterfactual. In a tool-specific within-person analysis, weeks with any Claude Code use were associated with an 11.4 percent increase in merged pull requests, with a reported 95 percent confidence interval from 9.4 to 13.6 percent.[42] The 24 percent estimate must not be attributed to Claude Code alone. The paper is a preprint, merged pull requests are an incomplete proxy for productivity and quality, and observational deployment data cannot establish that the tool caused the entire measured difference.

No single benchmark captures Claude Code's practical reliability. Repository-level coding tasks such as [SWE-bench](/wiki/swe_bench) test model and agent performance under controlled conditions, while deployed results also depend on project instructions, available tools, permissions, test quality, repository complexity, and human review. Performance claims should identify the model, client version, environment, task set, and evaluation method.

## Reception and criticism

Independent scrutiny of Claude Code has concentrated on the consequences of giving an agent real system access, and on incidents rather than on capability benchmarks.

In February 2026 The Register reported three vulnerabilities found by Check Point researchers Aviv Donenfeld and Oded Vanunu.[43] All three sat on the same boundary, between opening a project directory and trusting it, and Anthropic fixed each. The first, GHSA-ph6w-f82w-28w6 (published September 3, 2025, fixed in 1.0.87), was that the startup prompt asking "Do you trust the files in this folder?" did not state that choosing to proceed would let Claude Code execute files in the directory without further confirmation; Anthropic rewrote the warning text rather than changing the behavior.[49] The second, CVE-2025-59536 (published October 3, 2025, fixed in 1.0.111), was a code injection bug in the startup trust dialog itself: Claude Code could be tricked into executing code contained in a project before the user had accepted the dialog at all.[50] The third, CVE-2026-21852 (published January 21, 2026, fixed in 2.0.65), let a malicious repository ship a settings file that set `ANTHROPIC_BASE_URL` to an attacker-controlled endpoint; Claude Code read the configuration and issued API requests before showing the trust prompt, potentially leaking the user's API key.[51] The researchers argued that checked-in configuration files create a supply-chain risk.

On March 31, 2026 Anthropic accidentally published Claude Code's source. A source map shipped in the official npm package referenced an unobfuscated TypeScript archive on an Anthropic Cloudflare R2 bucket, exposing roughly 1,900 files and more than 512,000 lines of code. Anthropic attributed the incident to human error in its build process and said no customer data or credentials were exposed; mirrors were widely forked on GitHub before the original upload was replaced.[44] Two days later, Zscaler's ThreatLabz researchers reported a GitHub repository posing as the leaked source that instead delivered a Rust dropper carrying the Vidar information stealer and GhostSocks proxy malware, which ranked near the top of search results for the leak; The Register reported that the ranking had dropped by the time it published, but that at least two of the trojanized repositories were still on GitHub.[48]

Researchers then analysed the released code. Reporting on those analyses described persistent telemetry carrying identifiers such as user ID, session ID and email, error reporting that captured working directories and file paths, remotely managed settings that Anthropic could refresh hourly, an auto-updater able to disable specific versions, and a file named `undercover.ts` containing instructions for concealing AI authorship in open-source contributions. Anthropic responded that remote traffic is disabled when a third-party inference provider is used and pointed to configuration options that limit data transmission.[45] These are researcher characterisations reported by a trade outlet rather than audited findings, and some are contested by Anthropic's own published telemetry documentation, which states that metrics never include code, prompts or file paths and that error reporting is off by default for several account and provider combinations.[27][45]

In July 2026 The Register reported that China's National Vulnerability Database told developers to stop using Claude Code versions 2.1.91 through 2.1.196, alleging a "built-in monitoring mechanism" that could gather a user's location and identity and forward it to remote servers. The Register's report cites no technical evidence from the database, and Anthropic did not respond to a request for comment. Separately and distinctly, Anthropic acknowledged a steganographic mechanism it had added to detect model distillation by competitors, which an Anthropic engineer said had been superseded by stronger mitigations and which was removed in version 2.1.198.[47]

## Limitations

Claude Code inherits limitations of [large language models](/wiki/large_language_model) and adds risks associated with real tool access. It can misunderstand requirements, make unnecessary edits, select an incorrect dependency, write insecure code, misread tool output, or stop after a locally plausible result. Tests can reduce these risks only when they cover the relevant behavior and are themselves correct.

The agent's effectiveness depends strongly on the environment. Missing build tools, stale dependencies, unavailable services, weak project documentation, oversized repositories, or a limited context window can prevent a reliable result. Parallel agents can increase coverage but also increase cost, duplicate work, and create conflicting changes, which is why Anthropic caps concurrent subagents and publishes token-cost warnings for agent teams and dynamic workflows.[15][16][33]

Permission prompts, deny rules, classifier review, sandboxing, and isolated hosted environments reduce different kinds of risk but do not form an absolute security boundary. Allowed commands can still be destructive, network responses can still contain hostile instructions, credentials can still authorize actions outside the repository, and Anthropic's own documentation states that the sandbox's default network filtering can be evaded by domain fronting and that no system is immune to prompt injection. Checkpoints omit changes made through shell commands and external tools.[10][20][23][24]

Finally, the product's interfaces, models, plan entitlements, pricing, and point releases change frequently, sometimes within a single week. A factual account should attach dates to mutable details and prefer current official documentation for deployment decisions. Self-reported adoption, productivity, security, and quality claims require independent validation before they are treated as general evidence.

## See also

- [AI coding agent](/wiki/ai_coding_agent)
- [Claude Agent SDK](/wiki/claude_agent_sdk)
- [Claude Code Subagents](/wiki/claude_code_subagents)
- [Claude Code Review](/wiki/claude_code_review)
- [Claude Opus 5](/wiki/claude_opus_5)
- [GitHub Copilot](/wiki/github_copilot)
- [Model Context Protocol](/wiki/model_context_protocol)
- [Software development](/wiki/software_development)

## References

1. Anthropic. "Claude 3.7 Sonnet and Claude Code." February 24, 2025. https://www.anthropic.com/news/claude-3-7-sonnet
2. Anthropic. "Introducing Claude 4." May 22, 2025. https://www.anthropic.com/news/claude-4
3. Anthropic. "Overview." Claude Code documentation. Accessed August 1, 2026. https://code.claude.com/docs/en/overview
4. Anthropic. "Platforms and integrations." Accessed August 1, 2026. https://code.claude.com/docs/en/platforms
5. Anthropic. "Desktop application." Accessed August 1, 2026. https://code.claude.com/docs/en/desktop
6. Anthropic. "Use Claude Code on the web." Accessed August 1, 2026. https://code.claude.com/docs/en/claude-code-on-the-web
7. Anthropic. "Claude Code on the web." October 20, 2025. https://claude.com/blog/claude-code-on-the-web
8. Anthropic. "Model configuration." Accessed August 1, 2026. https://code.claude.com/docs/en/model-config
9. Anthropic. "Speed up responses with fast mode." Accessed August 1, 2026. https://code.claude.com/docs/en/fast-mode
10. Anthropic. "Checkpointing." Accessed August 1, 2026. https://code.claude.com/docs/en/checkpointing
11. Anthropic. "How Claude remembers your project." Accessed August 1, 2026. https://code.claude.com/docs/en/memory
12. Anthropic. "Extend Claude with skills." Accessed August 1, 2026. https://code.claude.com/docs/en/skills
13. Anthropic. "Hooks reference." Accessed August 1, 2026. https://code.claude.com/docs/en/hooks
14. Anthropic. "Connect Claude Code to tools via MCP." Accessed August 1, 2026. https://code.claude.com/docs/en/mcp
15. Anthropic. "Create custom subagents." Accessed August 1, 2026. https://code.claude.com/docs/en/sub-agents
16. Anthropic. "Orchestrate teams of Claude Code sessions." Accessed August 1, 2026. https://code.claude.com/docs/en/agent-teams
17. Anthropic. "Introducing dynamic workflows in Claude Code." May 28, 2026. https://claude.com/blog/introducing-dynamic-workflows-in-claude-code
18. Anthropic. "Claude Code GitHub Actions." Accessed August 1, 2026. https://code.claude.com/docs/en/github-actions
19. Anthropic. "Agent SDK overview." Accessed August 1, 2026. https://code.claude.com/docs/en/agent-sdk/overview
20. Anthropic. "Choose a permission mode." Accessed August 1, 2026. https://code.claude.com/docs/en/permission-modes
21. Anthropic. "Auto mode." March 24, 2026. https://claude.com/blog/auto-mode
22. Anthropic. "Configure permissions." Accessed August 1, 2026. https://code.claude.com/docs/en/permissions
23. Anthropic. "Configure the sandboxed Bash tool." Accessed August 1, 2026. https://code.claude.com/docs/en/sandboxing
24. Anthropic. "Security." Accessed August 1, 2026. https://code.claude.com/docs/en/security
25. Anthropic. "Security policy." Accessed August 1, 2026. https://raw.githubusercontent.com/anthropics/claude-code/main/SECURITY.md
26. Anthropic. "Set up Claude Code for your organization." Accessed August 1, 2026. https://code.claude.com/docs/en/admin-setup
27. Anthropic. "Data usage." Accessed August 1, 2026. https://code.claude.com/docs/en/data-usage
28. Anthropic. "Advanced setup." Accessed August 1, 2026. https://code.claude.com/docs/en/setup
29. Anthropic. "Legal and compliance." Accessed August 1, 2026. https://code.claude.com/docs/en/legal-and-compliance
30. Anthropic. "Plans and pricing." Accessed August 1, 2026. https://claude.com/pricing
31. Anthropic Help Center. "Use Claude Code with your Team or Enterprise plan." Accessed August 1, 2026. https://support.claude.com/en/articles/11845131-use-claude-code-with-your-team-or-enterprise-plan
32. Anthropic Help Center. "How do usage and length limits work?" Accessed August 1, 2026. https://support.claude.com/en/articles/11647753-how-do-usage-and-length-limits-work
33. Anthropic. "Manage costs effectively." Accessed August 1, 2026. https://code.claude.com/docs/en/costs
34. Anthropic. "Enabling Claude Code to work more autonomously." September 29, 2025. https://www.anthropic.com/news/enabling-claude-code-to-work-more-autonomously
35. Anthropic. "Claude Code license." Accessed August 1, 2026. https://raw.githubusercontent.com/anthropics/claude-code/main/LICENSE.md
36. Anthropic. "Claude Code changelog." Accessed August 1, 2026. https://raw.githubusercontent.com/anthropics/claude-code/main/CHANGELOG.md
37. npm registry. "@anthropic-ai/claude-code package metadata." Accessed August 1, 2026. https://registry.npmjs.org/@anthropic-ai/claude-code
38. Anthropic. "Making frontier cybersecurity capabilities available to defenders." February 20, 2026. https://www.anthropic.com/news/claude-code-security
39. Anthropic. "Bringing Code Review to Claude Code." March 9, 2026. https://claude.com/blog/code-review
40. Zoe Hitzig, Maxim Massenkoff, Eva Lyubich, Ryan Heller, and Peter McCrory. "Agentic coding and persistent returns to expertise." Anthropic, June 16, 2026. https://cdn.sanity.io/files/4zrzovbb/website/433472e34b60db1a52ebf0b8c6600f057b6908c5.pdf
41. Hélio Victor F. Santos, Vitor Costa, João Eduardo Montandon, and Marco Tulio Valente. "Decoding the Configuration of AI Coding Agents: Insights from Claude Code Projects." Accepted at the 1st International Workshop on Agentic Engineering, pages 63-67; arXiv:2511.09268, revised May 25, 2026. https://arxiv.org/abs/2511.09268
42. Emerson Murphy-Hill, Jenna Butler, and Alexandra Savelieva. "Adoption and Impact of Command-Line AI Coding Agents: A Study of Microsoft's Early 2026 Rollout of Claude Code and GitHub Copilot CLI." arXiv:2607.01418, July 1, 2026. https://arxiv.org/abs/2607.01418
43. Jessica Lyons. "Claude collaboration tools left the door wide open to remote code execution." The Register, February 26, 2026. https://www.theregister.com/security/2026/02/26/claudes-collaboration-tools-allowed-remote-code-execution/4753986
44. Brandon Vigliarolo. "Anthropic goes nude, exposes Claude Code source by accident." The Register, March 31, 2026. https://www.theregister.com/software/2026/03/31/anthropic-accidentally-exposes-claude-code-source-code/5227940
45. Thomas Claburn. "Claude Code source leak reveals how much info Anthropic can hoover up about you and your system." The Register, April 1, 2026. https://www.theregister.com/software/2026/04/01/claude-codes-source-reveals-extent-of-system-access/5222658
46. Thomas Claburn. "Anthropic tests reaction to yanking Claude Code from Pro." The Register, April 22, 2026. https://www.theregister.com/software/2026/04/22/anthropic-tests-reaction-to-yanking-claude-code-from-pro/5224929
47. Connor Jones. "China tells devs to ditch Claude Code over 'backdoor code' fears." The Register, July 8, 2026. https://www.theregister.com/security/2026/07/08/china-ditch-older-claude-versions-with-backdoor-code/5268371
48. Jessica Lyons. "They thought they were downloading Claude Code source. They got a nasty dose of malware instead." The Register, April 2, 2026. https://www.theregister.com/security/2026/04/02/fake-claude-code-source-downloads-actually-delivered-malware/5223464
49. "Claude Code Vulnerable to Arbitrary Code Execution Due to Insufficient Startup Warning", GitHub Security Advisory GHSA-ph6w-f82w-28w6, published September 3, 2025. https://github.com/advisories/GHSA-ph6w-f82w-28w6
50. "Claude Code's startup trust dialog could lead to Command Execution attack", CVE-2025-59536, published October 3, 2025. https://www.cve.org/CVERecord?id=CVE-2025-59536
51. "Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation", CVE-2026-21852, published January 21, 2026. https://www.cve.org/CVERecord?id=CVE-2026-21852