Claude Code v2.1.210: Hardening the worktree isolation gap and prompt injection defenses!

Hey, it's Shiichan! I checked out the newest Claude Code release today, and it includes a few security-related fixes, so let me walk through it with a bit of extra care.

Claude Code Release github.com

What was announced?

According to the Claude Code Release notes, v2.1.210 just shipped. Alongside a few security-related fixes, this release brings small UI improvements and a broad batch of over 30 bug fixes.

The story so far

Two issues stood out to me in particular:

• Subagents configured with isolation: 'worktree' were supposed to work only inside their own isolated worktree, but they could actually run git-mutating commands against the main repo checkout instead
• The ultracode keyword opt-in could fire on input that wasn't written directly by a human, such as webhook payloads or relayed PR comments

There were other rough edges too: long-running tool calls could look frozen since there was no elapsed-time indicator, permission rules like Write(path), NotebookEdit(path), and Glob(path) could silently not behave as expected, and claude attach could fail mid-session-transition with errors like "job not found."

What changes

First, both security issues are properly fixed:

• isolation: 'worktree' subagents now run git commands only inside their own isolated worktree, not the main repo checkout
• The ultracode opt-in no longer fires on non-human-originated input like webhook payloads or relayed PR comments

On top of that, the Agent tool has been hardened against indirect prompt injection coming from content a subagent reads.

On the UI side, the collapsed tool summary line now shows a live elapsed-time counter for long-running tool calls, so they visibly tick instead of looking stuck. There's also a new startup warning if you have Write(path), NotebookEdit(path), or Glob(path) permission rules configured, suggesting Edit(path) or Read(path) instead.

There are a few more fixes worth noting: claude attach now waits for the daemon to settle, making errors like "job not found" or "agent is still starting" less likely, and paste markers no longer leak into external editors as stray È/É characters.

Dive Deep

This release has a lot of fixes, so here are a few more that caught my eye:

• Fixed a session crash when a tool's result renderer returned a numeric bigint value or plain text instead of a UI element
• Fixed a hook callback timeout being misreported as a user rejection, which made unattended sessions stop and wait
• Fixed Claude assuming a cd took effect after its command was moved to the background (the tool result now states the working directory is unchanged)
• Fixed plugin-provided MCP servers being torn down when MCP servers are re-synced mid-session
• Fixed plan approvals without edits being labeled "(edited by user)" and overwriting the plan file with a stale snapshot
• Fixed /doctor still proposing the auto-mode opt-in on Bedrock, Vertex, and Foundry, where it's no longer needed
• Fixed Grep's content mode incorrectly showing "No matches found" when paginating past the end of results
• Fixed unmatched $1/$2 positional placeholders in skills and commands being silently stripped (they're now preserved verbatim)
• Fixed claude agents --effort ultracode being silently dropped instead of reaching the dispatched session
• Fixed killed background sessions leaving a permanent git worktree lock behind (a periodic sweep now releases locks whose owning process is gone)

Beyond these, there are fixes for plugin cache writes leaving temp files behind on failure, and background workers crash-looping when a client resets its connection.

There are quality-of-life improvements too: the Bash/PowerShell timeout message now better distinguishes a hang from an explicit background request, the auto mode permission classifier defaults to Sonnet 5 for external sessions, and memory writes that push MEMORY.md over its read limit now produce an explicit error instead of silently truncating. Screen reader mode also announces permission mode changes when cycling with Shift+Tab.

Wrap-up

• Fixed isolation: 'worktree' subagents being able to run git commands against the main repo
• Fixed the ultracode opt-in firing on non-human input (webhooks, relayed PR comments), and hardened the Agent tool against indirect prompt injection
• Added a live elapsed-time counter for long-running tool calls and a startup warning for risky permission rules
• Fixed many smaller bugs too, including claude attach failures, garbled paste markers, and session crashes
• Also ships performance, memory, and screen reader improvements

Since this release includes real security fixes, if you run Claude Code on a team or use isolation: 'worktree' subagents, it's worth updating sooner rather than later!