tl;dr: You cannot pin a model in Claude Code. Four independent bypass vectors, all confirmed by measurement today. Bonus: Sonnet 4.6 / Opus 4.8 were silently removed from the model menu — the server pushes Opus 5 as “Default (recommended)”. /model writes directly to settings.json via an internal API → zero hook events, nothing can stop it ~/.claude.json (clientDataCacheSlots) silently overrides settings.json → undocumented switchModelsOnFlag: true is the default → Claude can autonomously escalate to a “better” model mid-session (confirmed in official docs) Server-pushed “Default (recommended)” overrides everything → root cause Impact: security config ignored, cost control impossible (Opus 5 1M >> Sonnet 4.6), CI/pipelines silently run a different model, and prompt injection can permanently escalate you to the most expensive model. Full measurements, timestamps, repro + fix proposals: https://github.com/anthropics/claude-code/issues/83795 Related (Gen-5 quality regression / VCST): https://github.com/anthropics/claude-code/issues/83510 submitted by /u/KeilerHirsch
Originally posted by u/KeilerHirsch on r/ClaudeCode