클로드 코드 실수 분석: 60초 자동 승인 기능의 위험성

#AI #security #cli #automation Claude Code: Anatomy of a Misfeature by Olaf Alders · July 17, 2026 · 29 min read · 6,163 words contents " Mechanical egg timer " by Hustvedt is licensed under CC BY-SA 3.0 . Padded to a wider frame; this adaptation is likewise licensed CC BY-SA 3.0. On Canada Day (July 1), 2026, Anthropic shipped a surprising “easter egg” to users of Claude Code: 2.1.198 includes an efficiency bypass which allows agents to continue on without being blocked on direction from a human. You essentially get a 60 second timer after Claude Code asks for input. If you miss the window, Claude Code helpfully does what it thinks is best and continues on its way. It looks like this: ● Claude asked: ⎿ … ● No response after 60s — continued without an answer ● The user stepped away. I'll proceed with best judgment. My plan: Note: the above is taken verbatim from one of my own claude sessions, with the questions having been trimmed. If you find this behaviour surprising, you’re not alone. Let’s consider the possible consequences: Do you have to take your laptop to the kitchen with you when you’re making a sandwich? What happens if you are afk during this window? How many agents are you running at once? Can you possibly observe them all at the same time? What if two or more agents ask for your input during the same 60 second window? What if the agent makes the wrong choice? How many tokens have been burned in the meantime? What if you are using agents for deployments? (Yes, I know, but what if ) These are reasonable things you might consider when shipping this feature and maybe you’d document your reasoning in the changelog. But what if you never mentioned the new defaults in the changelog at all? Wouldn’t that be even more surprising? (Spoiler: it was!) The story has a (sort of) happy ending. Move fast and break things does not necessarily preclude move fast and fix things. Within a couple of days a fix was shipped, but where does that leave user trust in this product? We’ve learned a few things: Surprising features in Claude Code can in theory (and in practice) be shipped by Anthropic on a daily cadence Not every feature will necessarily appear in the changelog Things that should not be defaults may not have a documented off switch Claude Code’s auto update feature feels more like YOLO mode than we might have suspected early on There are a few things I don’t know if we have learned: How do humans fit into this equation? Did a human dream up the feature? Did a human write (or have an agent write) this feature? Did a human review the feature? Did a human sign off on the feature? Did a human merge the feature? Did a human opt out of documenting the feature or adding it to the changelog? Did a human release manager diff the release with the previous release and give it their seal of approval before it went out the door? Personally I would find it hard to believe that a human was gating all of these steps without asking “is this a good idea?”. If you told me that Claude Code actually built the feature, shipped it, signed off on it and then deemed it unworthy of documentation, that’s something I’m more inclined to believe, but I just don’t know. Maybe it’s some combination of those two things. Maybe a number of things went wrong, but I think it’s clear that this never should have happened. And I say this as someone who has had at least one performance review where my manager said “well, you did put a serious bug into production”. I’ve wondered a bit about how this happened and what kind of post-mortem is available in the public record. So, I’ve asked Claude Code to investigate itself. To Claude’s credit, it seems to have no filter that prevents self-reflection regarding this code. So, full disclosure, what follows is mostly Claude’s work, so take that for what it’s worth and if you rely on any key assumptions, it’s worth reproducing them in isolation. Claude’s research begins here. # Timeline 2026-06-29 — 2.1.196 released; the reporter’s “last working version (I am guessing)” 2026-06-30 — 2.1.197 released; one changelog line, the Sonnet 5 launch 2026-07-01 — 2.1.198 released — the version the reporter pins the regression to. No public commit shows the change; the only public trace of this release is the bot commit publishing its notes ( 75709ea ), which touches nothing but CHANGELOG.md and feed.xml 2026-07-02 02:54 UTC — issue #73125 filed by Aleksey Nogin 2026-07-02 03:45 UTC — a commenter surfaces the escape hatch : CLAUDE_AFK_TIMEOUT_MS . Traded peer-to-peer in the thread, not pointed to from any release note 2026-07-02 — 2.1.199 ships 24 entries while the issue is open. Still no mention. 2026-07-03 — 2.1.200 reverses the behaviour; again the only public trace is the notes commit ( 1322e9b ) 2026-07-04 18:04 UTC — issue closed Reaction/scale on the issue: 384 👍 , 143 comments — not a niche complaint Reporter’s environment: 2.1.198 , “last working 2.1.196 (guessing)”, Opus, AWS Bedrock, VS Code terminal git clone https://github.com/anthropics/claude-code.git cd claude-code # When did the fix land, and in which version? git log -1 --format = '%h %ai' -S 'no longer auto-continue by default' -- CHANGELOG.md # 1322e9ba 2026-07-03 16:52:26 +0000 # When did the version that shipped the bug land? git log -1 --format = '%h %ai' -S '## 2.1.198' -- CHANGELOG.md # 75709eac 2026-07-01 20:45:29 +0000 # The misfeature AskUserQuestion is the tool Claude Code uses to stop and ask the human a question mid-task New behaviour: after 60 seconds of inactivity , the tool auto-returns a “proceed anyway” result instead of blocking The message handed back to the model — this is the template, rendered here at the 60-second default: // v2.1.198, verbatim. `Thl` is the minifier's name; the prose is the binary's own. // Note "60s" is interpolated, not a literal in the file: function Thl ( e ){ return `No response after ${ Math . round ( e / 1000 ) } s — the user may be away from keyboard. Proceed using your best judgment based on the context so far; you can re-ask this question later if it's still relevant.` } The “re-ask later” escape hatch is circular: the re-asked question hits the same timeout. Aleksey Nogin made this point in the issue thread within minutes of filing it The transcript line has two variants — the binary picks between them on whether you’d started answering: // v2.1.198, verbatim. `a` is the minifier's name for "some answers exist" // (`s=Object.entries(r)` over the answers, `a=s.length>0`); both string values // are the binary's own. let d = a ? "continued with the answers selected so far" : "continued without an answer" So a half-answered dialog does not discard the partial input — it submits it . Answer question one of three, step away, and the timeout commits your one answer plus whatever the model picks for the other two Both strings are absent from 2.1.197 and present in 2.1.198 In fairness: it was not silent on screen. The dialog rendered a live countdown, and a keypress restarted the timer. Assembled at runtime rather than stored as one string, so this is the rendered form, not a literal grep hit: // v2.1.198, verbatim — the pieces. `s` is the remaining-seconds value. children : [ "auto-continue in " , s , "s \xB7 any key to stay" ] // renders as: auto-continue in 12s · any key to stay Which cuts less far than it looks. The countdown only reaches someone watching the screen, and the premise of the feature is that you aren’t: the internal name is AFK ; the message says “the user may be away from keyboard” running several agents at once, “watching the screen” is not one place — the countdown you needed was on another tab And the countdown is late. The threshol