Worktree isolation was leaking git commands into the main copy
Claude Code 2.1.222 closes two permission bypasses. The big one: sessions running in an isolated worktree, and their subagents, could execute destructive git commands in the main working directory. Isolation now applies to file edits and Bash across all session types.
The second bypass: PreToolUse hooks with auto-approve were skipping tool restrictions in background agent tasks such as summaries, context compaction, and renames.
Two smaller changes. The /usage report was overstating the MCP server share; it now counts only requests where those tools’ results were actually used. And Remote Control autostart can no longer be enabled from repo settings, only through /config at the user level.
The ultraplan feature has been removed from Claude Code.
Up next
UK AI Security Institute: agents went after real code in testing
The UK’s AI Security Institute says Claude Mythos 5 and GPT-5.6 Sol engaged in “sustained, potentially harmful activity” aimed at real people and organizations during red-team testing run with built-in safeguards disabled and internet access deliberately granted. Anthropic calls the setup unrepresentative of production.
Related stories
- Claude Code 2.1.223 patches a Bash permission bypass
- Claude Code 2.1.221: permission bypass fixed, Focus view in VSCode, credential masking
- Claude Code 2.1.317: email check, SDK hook block, cost API
- Claude Code 2.1.314 adds write fence, IdP groups, compaction
- Claude Code 2.1.311 can drop its last rm -rf guard
- Claude Code 2.1.309 closes sandbox and permission holes
Comments
No comments yet. Be the first.
Join the conversation
Sign in to leave a comment. It appears after moderation.