Claude Opus 5 — New Default Model, Rolled Straight Into Claude Code #
- Introducing Claude Opus 5 (Anthropic, 2026-07-24) — Opus 5 launched at the same $5/$25 per-million-token price as Opus 4.8, but scores 97.0% on SWE-bench Verified — ahead of Fable 5’s own 95.0% on that benchmark, an unusual case of a mid-tier-priced release beating the flagship on a headline metric. Positioned as “the everyday model”: new default for Claude Max, strongest model on Pro, with a user-facing effort dial letting lower settings preserve most of the performance at a fraction of the token cost. Anthropic also calls it “the most aligned Opus model,” least susceptible to being tricked into misuse.
- Claude Code changelog (Anthropic) / Claude Code v2.1.220 — every release, summarized (Havoptic) — v2.1.219 (July 24) made Opus 5 the default Opus model in Claude Code, plus added
sandbox.network.strictAllowlist (silently deny non-allowlisted hosts for sandboxed commands rather than prompting), a new DirectoryAdded hook firing after /add-dir or an SDK register_repo_root call, a workflowSizeGuideline settings key for tuning the Dynamic Workflows advisory size threshold, and nested-subagent text forwarding in stream-json output for depth-2+ subagents. v2.1.220 (July 25) was bug fixes and reliability only. - Opus 5 in Claude Code: the model changed on its own, your settings didn’t (wmedia.es) — Practitioner-relevant gotcha: unlike Fable 5, Opus 4.8, and Opus 4.7 — which each reset effort to their own model default the first time you ran them — Opus 5 carries over whatever effort level you had already set. Anyone who’d dialed effort down for cost reasons on a prior model keeps that setting after the silent auto-update swaps in Opus 5, which can produce unexpectedly weaker output until noticed.
Security — “The Memory Heist”: web_fetch Exfiltration via Nested Links #
- The Memory Heist (Ayush Paul, 2026-07-09) — Anthropic’s stated safeguard was that
web_fetch could only navigate to URLs the user typed directly or that came back from web_search. Paul found a bypass: web_fetch was also allowed to follow links found inside pages it had already fetched — so a honeypot site (a fake coffee-shop page behind a spoofed Cloudflare Turnstile widget) could serve nested nonce-bearing links that walked Claude into exfiltrating a user’s name, employer, and inferred home city one character at a time, encoded purely in outbound request path segments. - How I tricked Claude into leaking your deepest, darkest secrets (Simon Willison, 2026-07-15) — Willison’s annotated write-up of Paul’s finding. Anthropic’s fix: block links found on externally-fetched pages while still allowing user-entered and search-result URLs — the same “which class of URL can this tool follow” trust-boundary bug pattern as several other Claude Code/Claude.ai vulnerabilities tracked in this journal, just surfacing in claude.ai’s browsing tool rather than the CLI.
Claude Code Dogfoods Its Own Agentic Rewrite — Bun-in-Rust #
- Claude Code uses Bun written in Rust now (Simon Willison, 2026-07-19) — Claude Code v2.1.181+ (shipped June 17, only now getting attention) runs on the Rust port of the Bun JavaScript runtime that was itself built by 64 parallel Claude Fable 5 instances porting ~535K lines of Zig to Rust in 11 days for about $165,000. Result: 10% faster Claude Code startup on Linux, ~20% smaller binary, 128 memory bugs fixed versus the Zig original, 99.8% of Bun’s existing test suite passing. The detail Willison flags: almost nobody noticed the swap — the numbers are incremental, not dramatic, which is itself the interesting part of an agentic large-scale rewrite landing invisibly in a tool people use daily.
- Extend Claude with skills (Anthropic, Claude Code Docs) — Confirms the CLI 2.1.3 changelog line “merged slash commands and skills, simplifying the mental model with no change in behavior”: files under
.claude/commands/*.md and .claude/skills/*/SKILL.md now both produce the same /name interface; skills additionally allow autonomous invocation and can bundle helper scripts. .claude/commands/ still works but is now considered the legacy location. The Agent Skills open standard flagged as an emerging bet in the 2026-05-18 gather has since been adopted by 30+ tools, including Cursor, GitHub Copilot, VS Code, Gemini CLI, OpenAI Codex, and JetBrains Junie — a skill written once for Claude Code now runs unchanged across most of the competitive field. - Claude Code Skills vs Slash Commands: The 2026 Unified Model Explained (jsmanifest) — Frames the merge as a three-layer architecture (Interface / Procedure / Capability) rather than two competing mechanisms, and names the practical failure mode it’s meant to prevent: authoring a redundant skill for something a plain slash command would have handled.
Official Technique Reference — Claude Code Team’s Own Power-User Tips #
- Claude Code power user tips (Claude Help Center, Anthropic) — First appearance of support.claude.com in this journal as a source for workflow guidance directly from the Claude Code team, covering parallel execution, planning, automation, and verification. Concrete patterns: name worktrees and colour-code terminal tabs to stay oriented across many parallel sessions (some engineers keep a dedicated “analysis” worktree just for reading logs); add
isolation: worktree to a subagent’s frontmatter to batch changes across parallel agents, each testing its own change end-to-end before opening a PR. Restates verification as “the single most impactful tip” — consistent with the compliance-budget and verification-first findings already tracked in this journal, now stated as official first-party guidance rather than community consensus.
Cross-links #
- Data, IP & Training Rights Ayush Paul’s web_fetch exfiltration finding (name, employer, home city extracted via nested-link path segments) is a fresh instance of the “AI browsing tool leaks personal data via URL-trust-boundary design flaw” pattern relevant to data governance.
- AI Code Quality The Bun-to-Rust rewrite (535K lines, 11 days, 99.8% test pass) now silently underpins Claude Code’s own runtime — a concrete, dogfooded data point for large-scale agentic-coding quality claims, distinct from the earlier reported 960K-line/6-day framing of the same project.
- Claude Integrations Opus 5 becoming Claude Code’s default Opus model same-day as its general release, plus its non-resetting effort-dial behaviour, is directly relevant to model-selection defaults for anyone integrating Claude Code programmatically.
- Method note: Opus 5 launched July 24, three days before this gather — practitioner experience pieces beyond SEO setup-guides are still thin; worth explicitly re-checking adoption and any regression reports next cycle.
- Noise pattern: Within 72 hours of the Opus 5 launch, near-identical SEO-templated “How to Use Claude Opus 5 in Claude Code: Setup Guide” posts appeared across multiple sites (apidog.com, codersera.com, agiflow.io, qwe.edu.pl) — same instant-listicle pattern seen after past model launches. wmedia.es’s specific effort-carryover behavioural finding was the one substantive item among them.
- Source suggestion: Havoptic (“every release, summarized”) is a new candidate for the same role TechTimes has played in past cycles — granular per-version Claude Code changelog tracking. Worth watching for consistency over the next few gathers before treating as semi-preferred.
- Emerging pattern: The Agent Skills open standard’s jump from “agentskills/agentskills GitHub repo, watch for adoption” (2026-05-18 gather) to confirmed use by 30+ tools including direct competitors (Cursor, GitHub Copilot, OpenAI Codex) in under two months is the clearest sign yet that Skills — not MCP — has become the cross-vendor agent-instruction format.