Update: Claude Code 2.1.222 patches agent permission-bypass holes
Sandboxed sessions could run destructive git on your main checkout; background agents could skip tool limits. The fix also hardens multi-agent auto mode.
Copy markdown
Worktree agents could touch your main checkout
Worktree-isolated sessions and subagents could run destructive git commands against the main checkout instead of their sandboxed copy. If you fan out parallel agents in git worktrees, 2.1.222 is a required update.
Background agents could skip tool limits
PreToolUse auto-allow hooks were bypassing tool restrictions inside background agent tasks, so a hook meant to green-light safe calls could approve tools you had explicitly gated. Patched in 2.1.222.
Auto mode hardens against agent-to-agent injection
Messages sent to other agent sessions now pass through the permission classifier, closing a prompt-injection path in multi-agent runs. The experimental ultraplan mode was also removed.
Reliability fixes you will feel
Startup no longer hangs behind HTTPS proxies, the stream idle timeout stops firing on custom gateways that send keep-alive pings, and /usage-credits no longer blocks new requests after you dismiss an earlier prompt.