Claude Code v2.1.222 closes two security holes in a single release. Isolated sessions on separate worktrees and their subagents could execute destructive git commands against the main checkout: now isolation applies to file modifications and Bash commands in every type of session. The second fix blocks PreToolUse hooks in auto-allow that were bypassing tool restrictions in background tasks.

Why it matters to you. If you run multiple agents in parallel on the same repo, worktree isolation was a promise the software didn’t guarantee. A subagent in a side session could touch the main branch with destructive git commands or modify files outside its space. The fix makes the boundary real: file modifications and Bash respect isolation everywhere, not just in some paths. For those using Claude Code daily, it’s the difference between «works if you’re careful» and «works because the boundary is in the code».

The release also closes a week of steady updates, from v2.1.216 to v2.1.222, each with concrete fixes on stability, permissions, and MCP. The pace suggests the tool is moving past continuous beta, as the v2.1.221 from yesterday already indicated.

If you want to try it. The update is in the standard channel. To verify isolation, launch two sessions on separate worktrees and check that one session’s changes don’t touch the other’s files.

In detail

The worktree isolation fix closes an open thread from July. On July 5th we reported a possible session leak between workspaces in Claude Code: parallel sessions weren’t completely separate, and one agent could see or touch files belonging to another session. Since then, each release has added a piece to the boundary. v2.1.216 introduced granular filesystem sandbox. v2.1.222 completes the work: isolation now applies to file modifications and Bash commands in every type of session, including subagents spawned from an isolated session.

What it means in practice. Imagine launching three agents in parallel on three different worktrees of the same repo. Each should only work in its own branch. Before this fix, a subagent launched from one of these sessions could execute a git reset --hard or git clean against the main checkout, erasing the work of the other two. The bug was that isolation applied to the parent session but didn’t fully propagate to subagents. Now the boundary is in the software, not in the agent’s good faith.

The second fix concerns PreToolUse hooks. Claude Code allows configuring hooks that activate before each tool call: they serve those who want to approve or block certain actions automatically. The bug made it so that hooks configured in auto-allow would bypass restrictions imposed on tools when running in the background, for example during context compaction or summary generation. In practice, a tool that shouldn’t run in those contexts would run anyway, because the hook gave clearance without respecting the limits.

The signal beyond the fix. A week of steady releases, from v2.1.216 to v2.1.222, with cumulative fixes on permissions, MCP, filesystem stability, and proxy. The pace is that of a tool that stops adding features in rotation and starts settling its open accounts. For those deciding whether to use Claude Code in production, the question changes: it moves from «interesting enough to be worth trying» to «stable enough to rely on».

It remains true that security of parallel agents is an open problem at the industry level. On August first we reported how agents from OpenAI and Anthropic escaped the sandbox and touched real systems. Claude Code’s fix is a step in the right direction, but the baseline of trust remains low: zero-trust automation, with independent verification of what each agent does, remains the mature approach.