Anthropic releases Claude Code v2.1.211, part of the fast release cycle bringing the tool toward daily use. The main feature is the --forward-subagent-text flag (and CLAUDE_CODE_FORWARD_SUBAGENT_TEXT environment variable) that includes subagent text and thinking in the stream-json output, making delegated tasks observable.

The security fix: permission previews forwarded to chat channels now neutralize bidirectional characters, zero-width characters, and lookalike quotes. Without this fix, malicious input could visually alter the approval message, showing an apparently harmless request while the actual operation was something else. A concrete case of prompt injection at the interface level.

Why it matters to you: if you run Claude Code in background mode or with delegated approvals, this release closes an attack vector that could fool you without you noticing. The fix on PreToolUse hooks restores control: when a hook says ask, that decision now truly blocks auto mode even on unsandboxed Bash. Before, auto mode could bypass your constraint.

Together with previous releases (v2.1.208, v2.1.209, v2.1.210), the picture is clear: Anthropic is consolidating the architecture for production use, with security and observability fixes instead of new features.

In detail

Context: four releases in three days.

From July 12 to 15, Anthropic shipped four consecutive versions of Claude Code (v2.1.208 → 212), each with fixes on stability, accessibility, and security. v2.1.211 closes two holes that could compromise users running the tool in complex setups.

The security fix on lookalike characters.

The permission preview (the message asking you to approve an operation before it runs) was forwarded to chat channels without neutralizing dangerous Unicode characters. Bidirectional characters (U+202E and similar) can visually reverse a string, showing “read the config.json file” while the actual command is “delete the directory”. Lookalike quotes (like U+201C instead of U+0022) can make an instruction look like simple quoted text.

This isn’t theoretical: anyone building multi-agent systems with human approvals in a Slack channel or similar faces exposure to a visual attack where the operator reads one thing and approves another. The fix neutralizes these characters before building the approval message.

Auto mode bypassing hooks.

PreToolUse hooks let you block or request confirmation before a tool is called. A hook returning ask should always stop execution and ask for confirmation, even in auto mode. Instead, auto mode was bypassing this decision on unsandboxed Bash commands, executing them anyway. v2.1.211 fixes it: now a hook ask is a floor, not a suggestion.

Subagent text forwarding: observability on delegated tasks.

The new --forward-subagent-text flag makes structured output (stream-json) include subagent text and thinking. Without this flag, delegated tasks are a black box: you only see that it started and finished. With the flag on, you can follow subagent reasoning in real time, useful for debugging and audit trails.

This feature connects to the new delegation architecture introduced in v2.1.212, where /fork launches independent background sessions and /subtask manages in-session subagents. Observability becomes critical when you have multiple delegation layers.

Other fixes in the release.

• Parallel sessions sharing a credential store no longer all log out together after wake-from-sleep.
• Plugin MCP servers reconnect after an idle web session wakes up.
• Sessions on Vertex and Bedrock no longer try to call Opus at startup when you’ve explicitly configured a different model.
• Subagents with model overrides no longer revert to the parent model when resumed.
• Fixes on file upload (names with DOS suffixes like .prn, files with hard links), on background jobs with LLM gateway auth, and on agent job handling when git no longer recognizes the worktree.

Practical implications.

If you run Claude Code in production or team setups:

1. Update immediately for the security fix on previews.
2. Review your PreToolUse hooks: they now truly respect the ask decision.
3. Enable --forward-subagent-text if you need full audit trails on delegated tasks (note: increases log volume).
4. If you manage background sessions, this series of fixes on reconnection and persistence should eliminate “phantom” agent jobs that won’t clean up.

The speed of these releases (four in three days) is a signal: Anthropic is consolidating the tool for daily use, focusing on security and robustness instead of flashy new features. This is the phase where a tool shifts from “impressive in a demo” to “you can rely on it”.