Claude Code review: from task to reviewed change

Editor's note: This is a documentation-led edition. We have not yet run our own hands-on tests of Claude Code. What follows rests on official documentation, published pricing and independent studies we read in full, all accessed on 16 October 2026. A tested update will follow.

Claude Code is Anthropic's coding agent. It reads a repository, edits files, runs commands and talks to git, from a terminal, an IDE extension, a desktop app or a browser.[1] Our shortlist of AI coding assistants files it under "an agent in your terminal". This review asks a narrower question: what happens between "fix this bug" and a change a person is willing to merge?

So we follow one task through its lifecycle, from plan to human review, saying at each stage what Anthropic documents as the default and what you can change. Prices, data terms, sandboxing and prompt-injection guidance follow.

What it is, and what each plan is for

Claude Code works as a loop. Anthropic describes three phases, "gather context, take action, and verify results", repeated until the task is done, and you can interrupt at any point.[2] On Pro, Max, Team, Enterprise and the API, the default model is Claude Opus 5.5.[3]

Sources: Anthropic's pricing page and API pricing page.[4][5] Prices and plans can change.

Subscription limits reset on a rolling five-hour window, with weekly caps on paid plans, and "your work in the terminal and your chats draw from one pool".[4] Anthropic says enterprise deployments average about $13 per developer per active day, or $150 to $250 a month, with 90% of users below $30 a day.[6] That is Anthropic's figure, not an independent one. Behind some company gateways, auto mode's own safety-check requests also count toward token usage.[7]

One task, start to finish

1. The brief and the plan

Each session starts with an empty context window. Project knowledge lives in CLAUDE.md files you write, or an existing AGENTS.md, plus "auto memory" notes Claude keeps itself.[8] That is where build commands, conventions and no-go areas belong.

For anything bigger than a one-line fix, the documented starting point is plan mode. Claude reads files and runs exploratory commands, then writes a plan, "but does not edit your source"; edits stay blocked until you approve.[9] Its research subagent has Write and Edit denied.[10] Ctrl+G lets you edit the plan yourself.

Approval sets the rest of the session: "Yes, and use auto mode", "Yes, manually approve edits", or "No, keep planning".[9] Anthropic admits planning has a cost: "If you could describe the diff in one sentence, skip the plan."[11]

2. Permissions and modes

This is the decision that matters most, and the default has moved. From version 2.1.283, auto mode is the built-in starting mode for interactive terminal and VS Code sessions on every plan; before that, only on Pro, Max and Team.[9] In auto mode, "A separate classifier model reviews actions instead of you and blocks the ones it judges unsafe."[12] That matches what our research on agent permission disclosures recorded.

Source: Claude Code permission modes documentation.[9]

The classifier blocks a published list by default, including curl | bash, production deploys, force pushes, sending sensitive data out, and "Merging a pull request no human has approved, approving Claude's own pull request, or disabling CI checks".[9] Broad allow rules such as Bash(*) are dropped while auto mode is on.

Your own rules sit on top, evaluated "deny, then ask, then allow"; deny rules block even in bypassPermissions.[13][9] Writes to protected paths such as .git, .claude and .mcp.json are never auto-approved outside bypass mode. Anthropic's caveat is plain: "Auto mode reduces permission prompts but does not guarantee safety."[9]

3. The edits

Claude Code checkpoints your code before each prompt, and /rewind restores code, conversation or both.[14] But "Checkpointing does not track files modified by Bash commands", and a subagent's edits to other files are not reverted. Checkpoints are for "quick, session-level recovery", not a replacement for git.[14]

4. The tests

"Claude stops when the work looks done," the best-practices guide warns, so give it a check that returns pass or fail: tests, a build, a linter.[11] You can ask for it in the prompt, set a /goal, gate the turn with a Stop hook, or have a separate subagent try to refute the result, "so the agent doing the work isn't the one grading it."[11] Ask for the test output, not a claim of success.

5. Hooks

Hooks are your own shell commands, run at fixed points so that "certain actions always happen rather than relying on the LLM to choose to run them."[15] A PreToolUse hook that exits with code 2 blocks a tool call, such as an edit to .env. A Stop hook can refuse to let Claude finish until tests pass, up to eight consecutive continuations by default.[15][16]

They cut both ways. Hooks run outside the Bash sandbox with your full access.[17] In a non-interactive claude -p run in a folder you never trusted, the repository's own hooks are still used.[13] A cloned repository can carry code that runs on your machine.

6. Subagents

Subagents are separate workers with their own context window, tools and permissions, which return a summary instead of flooding the main conversation.[10] A custom one can be limited to read-only tools, given its own permission mode, or isolated in a temporary git worktree.[10][18] Each sends its own requests against the same usage limits.

The review use stands out. "A fresh context improves code review since Claude won't be biased toward code it just wrote," Anthropic says, suggesting separate writer and reviewer sessions.[11]

7. Git and the pull request

Asked to "create a pr", Claude Code commits, writes a description and opens the pull request with gh pr create, linking the session to it.[19] The documentation advises reviewing the generated PR and asking Claude to highlight risks.

The work can also leave your laptop. Cloud sessions, on Pro, Max, Team and eligible Enterprise seats, run in isolated Anthropic-managed virtual machines.[20] GitHub credentials "never enter the session VM", Anthropic's proxy rejects branch deletions and tag pushes, and your branch protection rules decide what a session can update.[12] The Claude Code GitHub Action lets people mention @claude in an issue or pull request to have it implement changes and push commits.[21]

8. Human review

Anthropic's managed Code Review, for Team and Enterprise, has several agents read each diff, filters false positives and posts inline comments by severity. "A review never approves or blocks the pull request, so the decision to merge stays with your team."[22] It is billed separately through usage credits, and new repositories start at "After every push", the most expensive setting.[23] On any plan, /code-review runs a review inside your own session.[24] And, Anthropic adds, "A review with no findings doesn't mean your code is error-free or secure."[22]

"You're responsible for reviewing proposed code and commands for safety before approval."

— Anthropic, Claude Code Docs: Security (2026).[12]

Sandboxing and isolation

AI Chronicle

Permission modes decide whether Claude asks; the sandbox decides what a command can reach. "The sandbox is off by default." It runs on macOS, Linux and WSL2; on native Windows, commands run unsandboxed.[17]

When on, the operating system limits shell commands' writes to the working directory and a temporary folder, and sends network traffic through an allowlist that starts empty. Two defaults deserve attention. Sandboxed commands can still read "Most of the machine, including credential files such as ~/.ssh and ~/.aws/credentials" unless you deny them. And Claude's file and web tools, hooks and local MCP servers run outside it.[17]

For more isolation, Anthropic recommends running the whole process in a container or dev container,[12] and reserves bypassPermissions for "isolated environments like containers, VMs, or dev containers without internet access".[9]

Data retention and training

What happens to your code depends on the plan you sign in with.[25]

• Free, Pro and Max: Anthropic trains on these accounts, Claude Code included, "when this setting is on". Retention is five years with it on and 30 days with it off. The pricing page labels training on these plans "Opt-out".[25][4]
• Team, Enterprise and API: no training on code or prompts under commercial terms unless the customer opts in to a programme. Standard retention is 30 days.[25]
• Zero data retention: for qualified Claude for Enterprise accounts, enabled per organisation by Anthropic; not part of the standard plan.[25]
• On your machine: Claude Code keeps "session transcripts locally in plaintext under ~/.claude/projects/ for 30 days by default".[25]
• Feedback: transcripts sent with /feedback are kept for five years.[25]

Prompt injection: what Anthropic tells you to do

Prompt injection is text in a file, web page, issue or tool output that tries to steer the agent. Anthropic documents these defences:

• The classifier sees no tool output. "Tool results are stripped from those requests, so hostile content in a file or web page can't manipulate the classifier directly."[9]
• Network commands are not auto-approved. curl and wget prompt in Manual mode.[12]
• Web pages are summarised first by a separate model call, so Claude does not receive most raw pages.[12]
• New folders need trust, though a -p session "shows neither prompt".[12]

Its advice: review commands before approving, avoid piping untrusted content straight to Claude, check changes to critical files, and use virtual machines for scripts that touch external web services.[12] Anthropic reviews directory connectors "but does not security-audit or manage any MCP server".[12] An optional security-guidance plugin has Claude check its own changes for flaws such as injection.[26] Anthropic's summary: "no system is completely immune to all attacks".[12]

What independent evidence says

We found no independent controlled study of Claude Code itself. METR's 2025 trial found experienced developers took 19% longer with AI, mainly using Cursor Pro with Claude 3.5/3.7 Sonnet; METR now marks the results out of date.[27] Its February 2026 update, noting wider use of agentic tools such as Claude Code, called its new data "an unreliable signal", and said developers found time hard to record because they worked on other tasks while agents ran.[28] Our guide to measuring AI productivity without hiding review work shows how to count that.

Documented limits and risks

• The default hands approval to a model, which Anthropic says "does not guarantee safety".[9]
• The sandbox must be switched on, and does not exist on native Windows.[17]
• Rewind is partial for Bash-made and some subagent edits.[14]
• Repository content can run code in an untrusted -p run.[13]
• Consumer plans train unless you opt out, with five-year retention when on.[25]
• Costs vary, across shared usage pools, subagents and per-push Code Review.[4][10][23]
• Accountability does not move. Anthropic puts review on the user, in line with our analysis of who is accountable when an AI agent acts.[12]

Who it suits, and who should skip it

These are reasoned from the documentation, not from our use.

It suits developers who live in a terminal and git; teams that can write rules down as CLAUDE.md conventions, deny rules, hooks and managed settings; organisations that need commercial data terms; and teams automating issue-to-PR work with branch protection in place.

Skip it, or wait, if you want an editor-first tool (our Claude Code vs. Cursor comparison weighs the two), if you need a sandbox on native Windows without WSL2, if you would run client code on a personal Pro or Max account without checking the training setting, or if nobody has time to review diffs.

How to test it yourself

1. Check the starting mode in the status bar, and choose Manual or auto before the first task.
2. Set rules first: deny Read(./.env), and make Bash(git push *) an ask rule.
3. Turn on the sandbox with /sandbox (macOS, Linux or WSL2) and note what it blocks.
4. Pick a task with a failing test, start in plan mode and edit the plan before approving.
5. Add a Stop hook that runs the tests, and count the turns until they pass.
6. Plant a harmless instruction in a README and see whether it is followed, blocked or flagged.
7. Review the diff in a fresh session with /code-review, and compare with your own review.
8. Record usage from /usage for each task.

A worked example (hypothetical)

This scenario is invented to show how the documented features fit together. No tool was run, and no outputs are reported.

Tomás maintains the scheduling service for a small delivery firm. After the clocks change, customers in one time zone see delivery windows an hour late.

Set-up. The firm is on Team, so commercial terms apply. CLAUDE.md lists the test command; managed settings deny reads of .env and start sessions in Manual mode.

Plan, edit, test. Tomás starts in plan mode and asks for a failing test first. He narrows the plan to one module and approves with manual edits. A Stop hook runs the time-zone tests, so the turn cannot end on "looks done".

Review. A read-only subagent re-reads the diff in a fresh context. Claude opens a pull request; Code Review comments, but the merge waits for a colleague under branch protection.

His rule: if he cannot explain the diff to that colleague, it does not merge.

Questions readers commonly ask

Is Claude Code free?

No. It comes with Pro ($20 a month, or $17 billed annually), Max, Team and Enterprise, or per-token API billing. Free does not include it.[4]

Does Claude Code train on my code?

On Free, Pro and Max, when the model-improvement setting is on; the pricing page labels it "Opt-out". On Team, Enterprise and the API, not by default.[25][4]

Can Claude Code merge its own pull requests?

In auto mode, its classifier blocks merging an unapproved pull request and approving its own.[9] Code Review never approves.[22] Your strongest control is GitHub branch protection, which also applies to cloud sessions unless the access you connected can bypass it.[12]

How is it different from Claude in the chat app?

Same account and usage pool, but Claude Code acts on your files and shell. Our Claude review covers the chat side for research and writing.

The next step

Deciding between a terminal agent and an agent-first editor? Read Claude Code vs. Cursor: choosing a coding workflow next.

Sources and evidence note

Product behaviour, defaults, plans and data terms come from Anthropic's Claude Code documentation, pricing pages and API pricing documentation. They describe intended behaviour in the current release, not tested performance; several defaults depend on version, surface and organisation settings. Prices are US list prices before tax as displayed on 16 October 2026. Independent evidence comes from METR's two published study pages, read in full. The worked example is invented. All pages were accessed on 16 October 2026.

Related reading

• Cursor review: coding workflow and review effort
• GitHub Copilot review: coding tasks and limitations