v2.1.218

Source: Anthropic Claude Code Date: 2026-07-22 URL: https://github.com/anthropics/claude-code/releases/tag/v2.1.218

Summary

Claude Code v2.1.218 pushes background-by-default further (/code-review now runs as a background subagent; context: fork skills default to background) and extends the untrusted-config threat model to agent frontmatter: hooks defined in agent markdown files now require the agent file’s own folder to have accepted workspace trust before they run. Also moves several permission decisions — dangerous rm, background &, suspicious Windows paths, plan-mode Bash — from static-rule permission dialogs to the auto-mode classifier, and fixes a batch of reliability bugs (session resume crashes on malformed history, fork-lineage loss after compaction, MCP server error visibility).

Implications

Untrusted-config/distrust-descends-the-stack thread: the agent-frontmatter-hooks fix is the third instance this week of the same principle applied at a new layer — a config file (here, an agent’s own frontmatter) is treated as an untrusted input surface unless its containing folder has been explicitly trusted, matching the same-week pattern in mise’s inert-reader mode. Agent-runtime-hardening thread: shifting rm/background/Windows-path decisions from enumerated deny-rules to a learned classifier is a bet that judgment scales better than a rule list — worth watching whether this widens (fewer prompts, more autonomy) or gets walked back after a false negative. Coding-agent competitive landscape: background-by-default for review and forked skills is Claude Code normalizing the fleet-of-subagents execution model as the default shape of a coding session, not an opt-in mode.