Claude Code Adds Spend-Limit Warnings and a Trust Prompt for Autonomous Agents

Anthropic pushed Claude Code v2.1.225 this week, one release after the self-hosted-runner and cross-session-messaging update I wrote about yesterday. This one is smaller, but it closes two gaps that matter the moment you stop running Claude Code as a single interactive session and start running it as infrastructure: nobody could see a spend cap coming until they hit it, and claude agents would happily start working in a directory nobody had vetted.

Neither change is a headline model release. Both are the kind of unglamorous plumbing that decides whether an engineering org actually lets agents run unattended, or keeps a human parked in front of every session just in case.

What actually shipped#

Gateway spend-limit warnings. If your organization routes Claude Code through a gateway with a spend cap, sessions now surface a usage warning that names the cap itself, when it resets, and whatever message your platform team configured for the limit. Before this, a session hitting a spend ceiling looked like an opaque failure: requests just stopped working, and whoever was debugging it had no way to tell a quota problem from an outage. Now the warning is explicit and shows up before the hard stop, which is the difference between an agent finishing its current step gracefully and one that dies mid-tool-call with no explanation.

Workspace trust for claude agents. The plain claude CLI has prompted for workspace trust in unfamiliar directories for a while. claude agents — the surface used for background and fleet-style agent runs — did not, until now. It matches claude’s behavior and prompts before an agent starts operating in a directory nobody has explicitly trusted. That gap mattered more for claude agents than for the interactive CLI, precisely because the whole point of that surface is running without a human watching every action.

Read together, both changes are about making an unattended agent’s blast radius visible before the fact rather than explainable after it. A spend limit you can see coming is a limit you can plan around. A directory you have to explicitly trust is one where a config file you have never opened cannot quietly redirect an agent’s first move.

Try the spend-limit warning yourself#

Below is a minimal simulation of what the new gateway warning looks like when a session approaches its cap. It does not call a real gateway; everything runs in your browser.

Where this leaves teams running agent fleets#

If you are operating Claude Code behind a metered gateway, this release means the first sign of a budget problem is no longer a support ticket, it is a warning your agent (and whoever is watching its transcript) can actually read and react to. And if you are running claude agents against directories you did not create yourself, such as a freshly cloned dependency, a contractor’s repo, or a folder synced in by some other automation, that agent now stops and asks before it starts trusting whatever is sitting in there. Neither change requires you to do anything to benefit from it beyond updating; the more relevant next step is on the platform side, making sure your gateway’s operatorMessage field actually says something a mid-task agent, and not just a human, can act on.