v2.1.222

Source: Anthropic Claude Code Date: 2026-08-04 URL: https://github.com/anthropics/claude-code/releases/tag/v2.1.222

Summary

Claude Code v2.1.222 is a security and trust-hardening batch: worktree isolation now covers file edits and Bash commands in every session type (not just some), a PreToolUse auto-allow hook bypass in background tasks was fixed, SendMessage now runs through the standard permission classifier, repo-local settings can disable but not enable Remote Control, and the ultraplan mode was removed.

Implications

• A direct continuation of the trust-boundary hardening cadence tracked since late July — sandboxing, permission classification, and least-privilege defaults tightening release over release rather than in one dramatic jump.
• The “repo-local settings can disable but not enable” pattern for Remote Control is another instance of the “hold less” instinct: a project can narrow its own capability surface but can’t widen what the operator already restricted, closing an escalation path.
• Closing the auto-allow hook bypass for background tasks matters specifically because background/async agent execution is the newer, less-scrutinized surface — consistent with security attention following capability into whatever mode is currently least mature.