QWE AI Academy Picture this: you kick off Claude Code, ask it to plan a database migration, then walk to the kitchen to make coffee. You come back four minutes later. The agent has already picked staging, then production, and is halfway through a schema change you never approved. No error. No prompt. Just a line in the transcript that reads “No response after 60s – continued without an answer.”
That’s the Claude Code misfeature that blew up across Hacker News, Bluesky, and the anthropics/claude-code issue tracker in early July 2026. It’s already been reversed, but the story matters – and more importantly, your config might still be exposed. This tutorial walks you through auditing your install, understanding what actually changed, and locking down the settings that ship with more surprises than the docs admit.
What actually shipped in Claude Code 2.1.198
On Canada Day, Olaf Alders traced the release and confirmed 2.1.198 was published to npm at 2026-07-01T16:50:16Z. Nothing in the changelog mentioned a new timeout. Nothing in the docs did either. But an unanswered AskUserQuestion dialog now auto-answered after 60 seconds – with a 20-second on-screen countdown – and told the model to proceed on its best judgment.
The exact string returned to the model, per the reporter of GitHub issue #73125:
"No response after 60s - the user may be away from keyboard.
Proceed using your best judgment based on the context so far;
you can re-ask this question later if it's still relevant."AskUserQuestion is the tool Claude uses to ask you multiple-choice things like “staging or production?” or “delete these 160 rows or just archive them?”. It’s the human-in-the-loop gate. And for two days in July, that gate silently rewrote itself into a soft suggestion.
The apology, and why the fix isn’t the whole story
The reaction was loud. The Claude Code team member Thariq, who maintains AskUserQuestion, replied publicly on Hacker News to apologize and agree the change “did not meet our bar” and does not represent how they plan to ship. Two days later, v2.1.200 changed AskUserQuestion dialogs to no longer auto-continue by default, letting you opt into an idle timeout via /config.
The fix reversed the default, not the mechanism. The 60-second timer, the 20-second countdown, and the env-var override are all still in the binary. If your shell exports
CLAUDE_AFK_TIMEOUT_MSfrom an old dotfile, you’re back to the July 1 behavior – and you won’t see a warning.
Here’s a detail almost every writeup got wrong: on timeout, the option adopted is not the one Claude labeled “Recommended”. Per the DevelopersIO post-fix analysis, the option selected is whichever option you currently have highlighted – or no selection if nothing has been chosen. If you happened to have your cursor on “production” while getting coffee, that’s the answer the model got.
How to audit your install in five minutes
Do this whether or not you think you were on 2.1.198. It’s fast, and it’ll teach you where the real levers live.
- Check your version. Run
claude --version. Anything from 2.1.200 or later has the safe default. But keep reading – the default can still be overridden. - Grep old transcripts for the synthetic response. If you ran 2.1.198 or 2.1.199 against anything irreversible, scan for that exact string:
grep -r "No response after 60s" ~/.claude/projects/If you find hits, review what the agent did after each one.
- Check your shell for the override.
env | grep CLAUDE_AFK. Empty is what you want. IfCLAUDE_AFK_TIMEOUT_MSis set – even to a large number – you’re running with the timer active, just delayed. - Open
/configinside Claude Code and confirm “Question auto-continue timeout” is set tonever. The accepted values (as of v2.1.200) are60s,5m,10m, ornever– you opt in explicitly under theaskUserQuestionTimeoutsetting.
One gotcha the docs bury: askUserQuestionTimeout only reads from the user-level ~/.claude/settings.json. Writing it in project settings (.claude/settings.json) or local settings (.claude/settings.local.json) will not be read – it’s positioned as a per-user preference, not a team-repo setting. So you cannot commit “never” to your team’s repo and expect it to hold. Every developer has to set it in their own ~/.claude/settings.json.
The exemption trap most tutorials miss
You’ll read a lot of “but permission prompts still gated destructive actions, so the blast radius was small” takes. That’s only half true.
AskUserQuestion isn’t a permission tool. It’s a choice tool. Permissions ask “can I run this?” – AskUserQuestion asks “which of these should I do?”. If you’ve already granted permission for a class of actions, the choice is the last gate.
And here’s the fine print: 2.1.198 ships bypassPermissions, acceptEdits, allowedTools, --dangerously-skip-permissions, and PreToolUse hooks. Anyone running agents against deployments has plausibly allowlisted the deploy command or turned prompts off – that is what automating it means. For those users, the permission layer never fires. The AskUserQuestion timer was the only thing between “which environment?” and a live push. This isn’t hypothetical: GitHub issue #30740 (March 2026) documented a case where the agent treated a timed-out empty response as a valid selection and 160 items were auto-processed without user consent.
Lock down your update channel while you’re at it
The deeper lesson from the misfeature isn’t the timer. It’s that Claude Code auto-updates aggressively, without a diff step, and features can appear or default-flip between two claude invocations. If you care about reproducibility, pin the channel.
| Setting / env var | What it does | Where it lives |
|---|---|---|
DISABLE_AUTOUPDATER=1 |
Stops background update check; claude update still works |
env block in settings.json |
DISABLE_UPDATES=1 |
Blocks all updates including manual | env |
autoUpdatesChannel: "stable" |
Pins to a channel ~1 week behind latest, skips releases with major regressions |
settings.json |
autoUpdaterStatus: "disabled" |
Documented in older guides – ignored in practice | Don’t rely on it |
The env vars above are the current working knobs per The AI Architects’ update reference. As for the last row: the autoUpdaterStatus setting has been silently ignored since at least December 2025 (per GitHub issue #13213) – Claude Code continues to auto-update despite this setting being configured. It’s still in old tutorials. It has not worked for months.
What this actually means for how you should use Claude Code
Three concrete habits, if you take nothing else from this:
- Treat every AskUserQuestion as the last gate. Move your cursor to the safe option before you look away, not to “Recommended”. Because the highlighted option is what gets picked if a future default flip catches you.
- Pin
autoUpdatesChannel: "stable". You give up nothing important. You skip the 48-hour window where a misfeature is onlatestand not yet rolled back. - Audit your env after major updates. Run
env | grep CLAUDEand cross-reference against the current settings reference. As of v2.1.210, Claude Code exposes 80+ settings and 200+ environment variables – that’s a large surface area for undocumented defaults to hide in, and the AFK feature was discovered precisely because a researcher ranstringsover the local binary and spotted env-var names that weren’t in any changelog.
A footnote worth sitting with: the next misfeature won’t announce itself either. It’ll be a default that flips quietly, in a version you auto-updated to overnight, doing something plausible enough that you only notice it three agent runs later. That’s not a prediction – it’s just what happens when a tool with 200+ env vars ships without a built-in diff step.
FAQ
Am I safe if I’m on 2.1.200 or later?
By default, yes. But run env | grep CLAUDE_AFK to confirm no environment variable is overriding the setting, and open /config to verify “Question auto-continue timeout” reads never.
Can I enforce the safe timeout across my whole team via the repo config?
No, and this is the trap. The askUserQuestionTimeout key is only read from each user’s own ~/.claude/settings.json – committing it to .claude/settings.json in the repo does nothing. The workable path is a shared onboarding script that writes to the user-level config, plus a doc note explaining why it can’t live in the repo.
If Anthropic already reversed the default, why should I still care?
Because old dotfiles, CI jobs, and Docker images can re-enable the timer silently – as covered in the blockquote above. And separately: the way this shipped (no changelog entry, no doc update, no opt-in prompt) tells you something about how the next surprise will arrive. The mechanism being intact is the smaller concern. The process that let it ship undocumented is the larger one.
Next step: Open a terminal, run claude --version, then env | grep CLAUDE_AFK, then /config inside Claude Code. Three commands, two minutes. Do it before your next agent run.