Anthropic shipped Claude Code 2.1.319 on November 6, 2026, and it is the kind of release that matters most to the people who never see it: developers who leave coding agents running overnight. The update’s headline feature is a single setting, permissions.denyInsteadOfPrompting, that stops an unattended run from dying at a permission prompt. Alongside it come background MCP tasks, a stricter auto mode, and several security fixes. The full release notes are on GitHub: the official Claude Code 2.1.319 release notes.
What shipped in Claude Code 2.1.319
Version 2.1.319 is a broad maintenance-style release with three changes that affect everyday use. First, MCP tool calls that run as tasks now move to the background in the terminal instead of blocking the session. Second, the new deny-instead-of-prompting setting gives unattended sessions a way to keep going when a tool call would otherwise wait for a human. Third, auto mode no longer falls back to the built-in permission classifier when telemetry or feature flags are off. The release also adds a /claude-api latency-optimize command, changes background subagents to move long shell commands to the background after three minutes, and fixes a bug where a long-running MCP tool call on a claude.ai connector sometimes never reported its result after –resume. It arrives the same week Anthropic has been in the news for its IPO – see Anthropic’s IPO filing.
Deny instead of prompting: the headline setting
Until now, the only way to stop Claude Code from stalling on a permission prompt was claude -p –permission-prompts none, which covers print mode only. The new setting works everywhere. Put “denyInsteadOfPrompting”: true under permissions in ~/.claude/settings.json and any tool call that would wait for you is refused, Claude is told, and the turn carries on. It applies in terminal sessions, subagents, and agent teams. A detailed walkthrough of the new setting confirms it is read from user settings, –settings, and managed settings, while project and local settings are ignored.
Two caveats matter. First, the setting only ever denies — it allows nothing, so your allow rules, permission mode, and hooks still decide first. Second, a streak of consecutive denials ends the turn rather than letting Claude loop on refused calls, and the turn does not label that ending clearly — so a denied call is not the same as a completed one. An independent explainer of the new behaviour puts it plainly: deny-instead-of-prompt removes the stall, but it does not tell you a deny happened. Try it on a non-critical job first, and check the transcript for denials before trusting it on anything that must finish.
MCP tasks now run in the background
The second big change is about waiting. When an MCP server runs a tool call as a task — a slow database query, a long build check — Claude Code now moves that call to the background right away and tells Claude the result when it finishes. The session no longer blocks on a job that might run for twenty minutes. If you prefer the old behaviour, the release ships an off-switch: set CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND and Claude Code waits for the task inside its tool call instead. The same release changes background subagents on all providers to move a shell command to the background after three minutes, so the prompt cache does not expire while a long command runs. For teams already supervising agents from their phones — the pattern behind DigitalOcean Cuttlefish, which puts agent supervision on your iPhone — backgrounding is the same idea applied inside the terminal: the agent keeps working while slow work finishes elsewhere. The same logic is showing up across the agent ecosystem, from Kimi’s hosted agent runtime to the broader shift toward agents that run for hours, covered in our practical guide to AI agents.
Auto mode gets stricter — and what that means behind a gateway
The change with the widest reach is quieter. In auto mode with telemetry or feature flags off — including behind an LLM gateway — calls the server cannot check are now asked about or denied, with no fallback to the built-in classifier. Set CLAUDE_CODE_AUTO_MODE_SERVER=0 to keep using the old classifier. The hosted Bedrock, Vertex, and Foundry routes are unchanged. Two small knock-ons: claude -p now exits 1 instead of 0 when an auto-mode action is refused, so scripts can detect the refusal, and the self-paced /loop command now stops when a turn finishes. If you run Claude Code behind a gateway, check your setup before updating — a run that used to sail through on the local classifier may now pause or deny calls instead.
Security fixes worth noting
The release also closes several permission-check bypasses, including a crafted environment prefix in Bash and a sandbox escape during worktree creation. And deniedMcpServers URL entries now also block Anthropic-provided servers whose upstream URL matches, plus connectors in cloud sessions and on self-hosted runners. The timing is apt: only last week, a tampered Claude Code extension in Cursor — the fake Claude Code extension incident in Cursor — planted an SSH backdoor on developer machines, a reminder that the tooling around AI coding agents is now part of the software supply chain. Keep your extension sources verified and your Claude Code install updated.
Should you update now?
If you run Claude Code unattended — scheduled jobs, background agents, agent teams — yes, and enable denyInsteadOfPrompting on a non-critical job first to see how your workflows react to denials. If you run behind an LLM gateway, read the auto-mode change first and decide whether you need CLAUDE_CODE_AUTO_MODE_SERVER=0. For everyone else, 2.1.319 is a straightforward update: faster background work, fewer stalls, and tighter security. Update with your package manager of choice and check the release notes linked above for the full changelog.
