Claude Code Code Mode: Parallel Tool Calls, With a Security Catch

Anthropic shipped Claude Code v2.1.323 on November 12, and buried in a very long changelog is one line that changes how the agent works. Claude Code Code Mode is an experimental opt-in where Claude stops calling tools one at a time. It writes a small JavaScript program that makes the calls itself.

That sounds like a speed tweak. It's more than that. Code Mode also changes what your permission rules and auto mode's safety check can actually see.

A quick note on method: this breakdown comes from Anthropic's Code Mode docs and the release notes, read line by line. We haven't benchmarked it yet, and we couldn't find any public benchmarks, which matters later.

How Claude Code Code Mode works

Here's code mode vs tool calling in practice. Normally Claude calls Bash, Read or Edit, waits for the result, reads it, then decides the next step. Every step is a round trip through the model.

With Code Mode on, Claude writes a piece of code and Claude Code runs it in your session. One script can make parallel tool calls, pass one result into the next call, and hand back only the slice of output Claude needs to read. Anthropic's docs show it with a task like raise a retry limit:

const files = await $`rg -l "function retryPolicy" src`.text();
const target = files.trim().split("\n")[0];
await edit(target, "maxAttempts: 3", "maxAttempts: 5");
({ edited: target, tests: $`npm test -- retryPolicy`.nothrow() });

Search, edit and test happen in one step. You still see the individual tool calls (an edit's diff, for example) in the conversation, but not the code. Press Ctrl+O to open the transcript, where each script appears as a collapsed Code row.

Anthropic says it fits three kinds of work:

the same change repeated across many files
a search whose results need filtering before Claude reads them
several independent commands that can run at once

Key features and setup

Turning it on takes two steps.

Update to v2.1.323 or later (claude update). If you're on the stable channel, wait or switch to latest.
Set CLAUDE_CODE_EXPERIMENTAL_CODE_MODE=1, either inline or under env in ~/.claude/settings.json. On first launch you confirm with Yes, turn on Code Mode.

Claude Code ignores this variable in a project's settings file, so a cloned repo can't switch Code Mode on behind your back. Admins can force it off for the whole org by setting it to "0" in managed settings. They can't force it on.

Time limits are tight. Code Claude waits on stops after ten minutes, and that clock includes time you spend at permission prompts. Background code can run for up to two hours, but only in auto or bypassPermissions mode.

Who can't use Code Mode yet

The requirements list is long, and it rules out a lot of teams. You need:

a Claude subscription or Console account on Anthropic's own API
Opus 5.5, Sonnet 5.5, Haiku 5.5 or Fable 5.2
an interactive claude session in a terminal, on the native build
Git for Windows, if you're on Windows

It doesn't work through gateways, Amazon Bedrock, Claude Platform on AWS, Google Cloud's Agent Platform or Microsoft Foundry. It's off for orgs on the HIPAA configuration or zero data retention. It's also unavailable in -p mode, the Agent SDK, the VS Code panel, the Desktop app and cloud sessions.

Less obvious: it won't start with an API key helper, agent teams, OpenTelemetry export or DISABLE_TELEMETRY turned on. If your company ships Claude Code with OTel telemetry for cost tracking, Code Mode is off the table for now. /status tells you which rule is blocking you.

The security trade-off in Code Mode

This is the part to read twice.

Every tool call Claude's code makes still goes through your deny and ask rules and your PreToolUse hooks. But in auto mode, the safety classifier reviews each script before it runs, not each tool call inside it. The docs say plainly that it doesn't see values computed at run time.

Think about what that means. A script can build a file path or a shell command from the output of an earlier step, and the classifier never sees the final string. Anthropic's own advice is to keep rules or hooks for any call you must control.

The docs add a second warning: Bash rules match command text, so a denied command can run in a form the rule doesn't match. The docs note that's true with or without Code Mode. Anthropic points to sandboxing for limits that don't rely on command text.

If you want to see exactly what Claude is about to run, write a PreToolUse hook that matches REPL and read tool_input.code. A minimal logger in ~/.claude/settings.json looks like this:

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "REPL",
        "hooks": [
          { "type": "command", "command": "jq -r '.tool_input.code' >> ~/.claude/code-mode.log", "onFailure": "continue" }
        ]
      }
    ]
  }
}

Keep that hook fast and reliable. In Code Mode, a hook that can't start, crashes or times out refuses the call unless you set "onFailure": "continue", so a flaky logger can block Claude's tool calls. The example above sets it for that reason.

Real-world use cases

Where it should help:

Repo-wide renames and config bumps. One script finds every match, edits each file and runs the tests, instead of dozens of separate model turns.
Noisy searches. Grep a monorepo, filter the hits in code, and give Claude only the ten lines that matter. Less junk lands in context.
Link and file audits. Anthropic's sample prompt is Read every Markdown file in this project and list the links that point to local files that don't exist. That's a loop, and loops are what code is for.
Parallel checks. Run lint, type-check and a test subset at the same time, then decide.

Where I'd skip it: anything in a regulated repo, any session where you rely on auto mode as your main guardrail, and short tasks where Claude only needs a couple of tool calls anyway.

Hard limitations and flaws

No published numbers. Anthropic gives no token, latency or cost savings figures. The 68% fewer tokens style stats floating around come from third-party tests of Cloudflare's separate Code Mode idea, not Claude Code. Measure it on your own repo before believing anyone.
Experimental means experimental. The docs say it may change or be removed in any release.
Resume lock-in. A Code Mode session can only be resumed in the terminal with Code Mode on. Resume it without the variable and Claude Code refuses. You also can't move it to Desktop or turn it into a background session.
Less visibility by default. You see the tool calls, not the script, unless you open the transcript or add a hook.
No Remote Control, Claude in Chrome or computer use while Code Mode is on.
The ten-minute ceiling counts time spent at permission prompts. Step away for coffee and a long script can die.

One more change in v2.1.323 matters even if you skip Code Mode: Claude Code now assumes a 1M-token context window for any model ID it doesn't recognize, up from 200K. If you point it at another vendor's model with a smaller window, sessions can fail every turn once full until you /clear. Set CLAUDE_CODE_DISABLE_1M_CONTEXT=1 before that happens.

Verdict: a developer action plan

Code Mode is the right idea. Batching tool calls into code is how agents should handle repetitive, multi-file work, and the opt-in design (no project-level switch-on, org kill switch) is sensible.

But it's not a free upgrade. Here's what I'd do this week:

Try it on a throwaway branch with a task that touches 10+ files. Compare the turn count and time against a normal session yourself.
Don't run it in auto mode on anything sensitive. The classifier sees the script, not the values it computes.
Add a PreToolUse hook on REPL that logs tool_input.code, so you can read what ran.
Turn on sandboxing if you rely on Bash deny rules.
Admins: decide now whether to set it to "0" in managed settings, before people start flipping it on.

If you're on Bedrock, Google Cloud's Agent Platform, Foundry, a gateway or a ZDR plan, you can't use it yet. Watch the changelog.

Claude Code Code Mode: Parallel Tool Calls, With a Security Catch