v2.1.210

Source: Anthropic Claude Code Date: 2026-07-14 URL: https://github.com/anthropics/claude-code/releases/tag/v2.1.210

Summary

Claude Code v2.1.210 changelog. Two security-relevant fixes headline: the ultracode effort keyword no longer fires on non-human-originated input (webhook payloads, relayed PR comments), closing an injection vector where attacker-controlled text could self-escalate agent effort; and isolation: 'worktree' subagents can no longer run git-mutating commands against the main repo checkout instead of their own isolated worktree. Also hardens the Agent tool against indirect prompt injection via content a subagent reads, and pins auto mode’s permission classifier to Sonnet 5 for external sessions.

Implications

• Feeds the coding-agents thread’s consent-provenance arc: this release is one step in Claude Code’s ongoing narrowing of “who can trigger elevated agent behavior” — pairs with the ${user_config.*} injection fix and the non-interactive-consent hardening from the 196→207 line. The pattern holds: a trigger is valid only if its source is user-controlled, not merely present in the input stream.
• The worktree-isolation escape fix is directly relevant to this project’s own use of isolation: "worktree" for OpenSpec-style agent dispatch — confirms the isolation boundary was previously leaky for git-mutating commands specifically.
• Indirect-prompt-injection hardening on the Agent tool is a continuing signal for the “agent reads untrusted content, then acts” class of vulnerability across the whole agentic-coding category, not just Claude Code.