The classifier is off the bill

Auto mode’s safety tax just moved. For some of you it disappeared. For others it stayed, with a notice that names your gateway.

Claude Code 2.1.278, shipped September 19, 2026, changes how auto mode runs its pre-action safety classifier. Where server-side checks are available, Claude Code asks the server to perform those checks as part of the session’s own model requests and does not charge for them. Where the server cannot reach the session, Claude Code falls back to its own classifier requests, billed as before, and shows an eligibility notice. Anthropic’s primary doc (“Auto mode classifier request charges”) and the CHANGELOG entry agree on the shape. AI/TLDR and Agenccy both dated the release September 19 and restated the same mechanics without inventing a blanket price cut.

This is a product review of that change, not a hands-on theater piece. Primary sources are enough. The operator question is simple: if you left auto mode off because classifier overhead was real, who can turn it on this week, and who is still paying because a proxy ate the handshake?

What it is

Auto mode lets Claude Code take actions (shell commands, network requests, and similar tool calls) without stopping for a permission prompt on every step. A classifier runs safety checks before those actions execute. Until 2.1.278, those checks were separate model requests that showed up as ordinary token usage. There was no clean line item labeled “safety.” Enterprises eating that cost had a quiet reason to keep auto mode off or tightly scoped.

2.1.278 does not remove the classifier. It relocates it. Eligible sessions send a safeguards field with the work the session was already doing. The reply carries safeguard_results. The check rides along. Anthropic does not charge for that server-performed path. /status gains an “Auto mode server” row that reads Enabled or Disabled so you can see which path a live session is on (CHANGELOG 2.1.278; docs).

Eligible by default, subject to platform rollout: Enterprise plans, accounts using the Claude API, Claude Platform on AWS, Amazon Bedrock, Google Cloud’s Agent Platform, and Microsoft Foundry. Pro, Max, and Team plans never see the eligibility notice. On Bedrock, Agent Platform, Foundry, and signed-in Claude apps gateway sessions, auto mode itself is limited to Claude Sonnet 5, Opus 4.7 or later, and the Fable models (docs).

Adjacent release, same week: 2.1.277 adds AGENTS.md support. In a project with no CLAUDE.md, Claude Code reads AGENTS.md instead, configurable under Project instructions in /config. Not yet on Bedrock, Vertex, or Foundry. Useful for teams standardizing on AGENTS.md across tools. Not the billing story. Do not merge the two in a leadership brief.

What changed

Three moves, one consequence.

Move one: default path flips to server-side where supported. CHANGELOG 2.1.278: auto mode for Claude API and Enterprise users, and on Bedrock, Vertex, Foundry and gateways, defaults to the server-side classifier, which does not charge for classifier overhead. CLAUDE_CODE_AUTO_MODE_SERVER=0 opts out on Bedrock, Vertex, Foundry and gateways. Direct Anthropic API connections do not read that variable the same way; the docs say it is not read on a direct connection to the Anthropic API.

Move two: fallback is explicit and interruptive once. If server checks stop reaching the session, Claude Code holds the next action it would check and shows: “We’re changing auto mode to no longer charge for classifier requests in Claude Code. However, this session isn’t eligible.” Enter continues on the billed local classifier. Esc or Ctrl+C cancels the held action. In -p / non-interactive mode the text goes to stderr; in stream-json it emits a system warning. VS Code shows a conversation notice. Gateway acknowledgment can suppress reappearance on that machine for 24 hours when a gateway was named (docs).

Move three: gateway compatibility becomes a billing dependency. The common failure mode is an LLM gateway or proxy that strips unknown headers, drops unrecognized body fields (including safeguards), or edits responses (dropping safeguard_results, rewriting tool-use IDs). The server never gets the request, or Claude Code never gets the results. Agenccy’s September 19 write-up is sharp on the inversion circulating in secondary coverage: this is not “server-side classifier billing.” The server-side path is the unbilled one. Enterprises behind rewriting gateways are the population most likely to keep paying.

Platform and region rollout still matters. Docs are clear: whether a platform or region performs server-side checks depends on that platform’s rollout. A session can be “the right plan” and still land Disabled in /status until the platform catches up.

What works

For teams on a direct Claude API or Enterprise path with no rewriting proxy, the win is structural. Auto mode’s safety layer stops being a second meter. You can turn auto mode on for agentic coding sessions without budgeting a shadow classifier tax you could not previously name. AI/TLDR’s plain-English summary matches the docs: checks fold into session requests; Pro/Max/Team unaffected; opt-out exists for gateway contexts.

/status visibility is the operational win. Enabled means the server is deciding checked actions for that session. Disabled means you fell back. That is better than discovering classifier spend in a monthly invoice reconciliation.

The notice design is adult. It pauses once, explains eligibility, and lets you continue billed or cancel. Nothing silently breaks auto mode. Agenccy quotes the continuity: auto mode keeps working; billing continues as before on the local path.

Gateway operators who already pass unrecognized fields through get a free upgrade for their customers. Anthropic’s docs point at the gateway compatibility guide: forward headers and body fields as they are, including safeguards; return streaming events without dropping safeguard_results or rewriting tool-use IDs. That is a one-time infra fix with ongoing feature compatibility value.

What breaks (or still costs)

Gateways that sanitize aggressively. If your corporate LLM gateway was built to strip unknown keys “for safety,” you are exactly the customer who keeps the billed classifier and sees the notice. The fix is not a Claude Code setting. It is asking the gateway team to pass the new fields. Setting CLAUDE_CODE_AUTO_MODE_SERVER=0 only silences the ask and locks you on the billed path. Docs call that variable temporary and removable in a later release.

Rollout lag on Bedrock / Agent Platform / Foundry. Defaulting to ask for server-side checks is not the same as every region performing them. Expect Disabled rows and notices while platforms land. Do not promise finance “classifier is free everywhere” on day one.

Model gates on some platforms. Auto mode support constraints on Bedrock, Agent Platform, Foundry, and Claude apps gateway sessions (Sonnet 5, Opus 4.7+, Fable) mean older model pins may not be in auto mode at all. Billing change is irrelevant if auto mode is unavailable.

Misread changelogs. Aggregators that labeled this “server-side classifier billing” will confuse your security review. Stick to Anthropic’s doc URL in the ticket. Agenccy called that inversion out on September 19 for a reason.

AGENTS.md confusion. 2.1.277’s AGENTS.md fallback is real and useful, but not on Bedrock/Vertex/Foundry yet. Teams that delete CLAUDE.md expecting AGENTS.md to save them on those platforms will get a silent miss. Keep CLAUDE.md there until Anthropic extends support.

Who it is for

Primary: Enterprise and Claude API teams running Claude Code in auto mode (or who refused auto mode because classifier tokens were real), especially on direct Anthropic connections or gateways that already pass unknown fields.

Secondary: Platform admins on Bedrock, Google Cloud Agent Platform, and Microsoft Foundry who need to confirm region rollout and /status behavior before telling engineering “it’s free now.”

Not the buyer: Pro, Max, and Team seat users hunting a price cut. They never saw this notice path. Different SKU economics.

Not a substitute for: permission mode discipline, sandbox policy, or deny rules. Removing classifier overhead does not make reckless auto mode wise. It makes a safety feature cheaper where the plumbing cooperates.

Pricing and limits

There is no new SKU. The change is the absence of a charge on the server-performed classifier path. Anthropic has not published how large the prior classifier overhead was as a percentage of auto-mode spend. Agenccy’s read is fair: removing the charge discloses that the overhead existed as ordinary usage without ever sizing it publicly.

Limits that still bind:

– Server-side path requires eligibility (plan + platform rollout + intact request/response fields).
– Fallback path bills classifier requests as before.
– CLAUDE_CODE_AUTO_MODE_SERVER=0 forces billed local classifier on supported opt-out surfaces; temporary.
– CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS=1 with the server variable unset also turns server checks off (docs).
– Auto mode model constraints on certain platforms remain.
– AGENTS.md is a separate 2.1.277 feature with its own platform gap.

What operators get wrong

Treating this as a company-wide free safety layer before checking /status. Turning auto mode on across a gateway fleet without a compatibility ticket. Telling Pro users they got a discount. Collapsing 2.1.277 AGENTS.md into the billing story. Assuming Bedrock parity on day one. Using the opt-out env var as a “fix” when the real fix is gateway passthrough.

Second-order effects

Agent platform procurement just gained a line-item argument. “Auto mode safety used to cost unknown tokens; on eligible paths it does not” is a cleaner security conversation than “please approve bypass mode.” Security teams that blocked auto mode on cost can reopen on policy.

Gateway vendors become part of your Claude Code TCO. A proxy that rewrites IDs for “observability” now has a direct customer cost. Expect enterprise tickets titled exactly like Anthropic’s notice.

Internal chargeback models change. If you allocated a fudge factor for agent safety tokens, rebuild it with Enabled vs Disabled session telemetry, not a flat tax.

Competitive framing stays narrow. This is not “Anthropic made agents free.” It is “Anthropic stopped billing a specific safety-check path when their servers perform it.” Keep the sentence honest in vendor comparisons.

What to do this week

• Upgrade to 2.1.278 (or later) on a pilot machine. Confirm the Auto mode server row appears in /status during an auto-mode session (CHANGELOG; docs).

• Classify your paths. Direct Anthropic API / Enterprise, Bedrock, Agent Platform, Foundry, Claude apps gateway, third-party LLM gateway. For each, record Enabled vs Disabled on a real auto-mode task. Screenshot or log the eligibility notice if it appears.

• Open one gateway ticket if Disabled and a proxy is in path. Ask for passthrough of safeguards request fields and safeguard_results (and no tool-use ID rewriting), per Anthropic’s gateway compatibility guidance linked from the billing doc. Do not “fix” with CLAUDE_CODE_AUTO_MODE_SERVER=0 unless you intentionally want billed local forever for now.

• Revisit auto-mode policy for teams that opted out on cost. If Enabled is stable on your primary path, turn auto mode on for a bounded pilot (one repo, one on-call rotation) with existing sandbox and permission rules intact. Measure whether session cost drops without measuring “feels faster.”

• Separate the AGENTS.md workstream. If you want AGENTS.md as project instructions fallback, test 2.1.277+ on Anthropic-hosted paths first. Keep CLAUDE.md on Bedrock/Vertex/Foundry until support lands (CHANGELOG 2.1.277).

• Update the internal FAQ. One paragraph: who is unbilled, who still pays, how to read /status, what the notice means, Pro/Max/Team unaffected. Link the official doc, not a paraphrasing aggregator.

Sharp close

The classifier did not leave. It left the invoice when Anthropic’s servers can see your session. That is a real unlock for Enterprise and API teams who treated auto mode as a luxury tax. It is also a mirror: if your gateway strips the handshake, you are still buying safety the old way, and Claude Code will tell you so before the next checked action. Read /status. Fix the pipe or accept the bill. Then decide whether auto mode belongs on for the work, not for the myth that safety checks were ever free by default.