News · 2026-07-19

Claude Code Briefly Made Silence Mean Yes, Then Reversed It

Anthropic briefly shipped a Claude Code default in which its coding agent would answer its own clarifying questions. In version 2.1.198, the AskUserQuestion dialog auto-continued after about 60 seconds of no response, letting the agent choose a path 'based on the context so far' instead of waiting. Two days later, in version 2.1.200, Anthropic reversed the default. The episode is small in code and large in principle: an agent tool designed to stop and ask for human judgment was, for a moment, wired so that a user's silence counted as consent.

Key facts

• The change: v2.1.198 (July 1, 2026) made AskUserQuestion auto-continue by default after roughly 60 seconds idle; the only override was an environment variable.
• The reversal: v2.1.200 (July 3, 2026) 'Changed AskUserQuestion dialogs to no longer auto-continue by default; opt into an idle timeout via /config.'
• Prior demand for control: GitHub issue #10253 had asked for an opt-in continuation setting, and reached 384 reactions and 143 comments.
• Primary sources: the v2.1.200 release notes, the v2.1.198 release, and the Claude Code tools reference.

Some background for readers who do not live in a terminal. Claude Code is a command-line coding agent: it reads your files, writes code, and runs commands, and when it hits genuine ambiguity it is supposed to stop and use a tool called AskUserQuestion to present a multiple-choice question. The documentation says those questions stay open until you answer them unless you explicitly configure an idle timeout. That is the contract: the tool exists precisely to hand a decision back to the human.

The 2.1.198 default quietly rewrote that contract. As reconstructed in developer Olaf Alders' widely read post 'Claude Code: Anatomy of a Misfeature', the feature was not a stray bug but a designed flow, with a countdown and a partial-answer path. The intent is easy to guess and even sympathetic: if you are running many agents in parallel, or you stepped away, a prompt that blocks forever deadlocks the whole task. The AFK-style naming suggests Anthropic was optimizing for unattended, long-running work.

Here is why developers treated it as a security problem rather than a convenience, and why it belongs in a tool-use safety discussion. In agentic setups, people grant an agent standing permission to take certain actions — an allowlisted deployment path, a pre-approved command set. AskUserQuestion is the escape hatch where a human reasserts control over the choices they did not pre-authorize. Convert 'no answer' into 'proceed on the model's best guess', and you have moved a decision the user meant to reserve for themselves into the agent's hands, at exactly the moments the tool was built to prevent that. As Alders framed the objection: do not silently convert my silence into permission. That is a classic authorization boundary, and the change eroded it by default.

The concrete anchor here is the timeline itself: a behavioral default that shipped July 1 and was pulled July 3, a 48-hour round trip that shows how fast an autonomy default can trip an entire developer community's alarms. Reception was polarized enough that, per Alders' own update, some Hacker News commenters dismissed his post as machine-written even as others treated it as a serious critique of Anthropic's release process.

Why it matters: coding agents are being handed more unattended authority across the industry, and Anthropic's own product direction leans toward longer autonomous runs with subagents and background tasks. That direction is not wrong, but this episode is a clean case study in the governance question underneath it — when an agent's default behavior changes who has to say yes before an action happens, that is a security decision, not a UX tweak, and it needs explicit consent and clear documentation. The honest caveat is that Anthropic reversed course quickly and there is no evidence anyone was harmed; the lasting lesson is about defaults, not this one dialog. It rhymes with an earlier Claude Code stumble where sessions could bleed into each other: the hard part of agent tooling is not capability, it is the boundaries.

Primary source, verified: read the paper →

Ground Truth. (2026, July 19). Claude Code Briefly Made Silence Mean Yes, Then Reversed It. Ground Truth. https://groundtruth.day/news/claude-code-turned-silence-into-consent.html

@misc{groundtruth:claude-code-turned-silence-into-consent,
  title  = {Claude Code Briefly Made Silence Mean Yes, Then Reversed It},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {jul},
  url    = {https://groundtruth.day/news/claude-code-turned-silence-into-consent.html}
}

Topics: cybersecurity · ai-security · agent-safety · claude-code · anthropic · autonomy