Claude Code 2.1.216: everything that changed since 2.1.186

Last updated: July 20, 2026

TL;DR

Claude Code 2.1.216 shipped today, and it closes out four weeks of near-daily releases. 25 public releases landed between 2.1.186 on June 23 and today. Stack them up and three shifts carry the window:

• Claude Sonnet 5 launched, and "default" depends on your plan. It arrived in 2.1.197 on June 30 with a native 1M-token context window and launch pricing of $2 per million input tokens and $10 per million output through August 31. It's the new default on Free and Pro plans – Max, Team, and Enterprise still resolve Default to Opus 4.8.
• Subagents moved to the background. As of 2.1.198, Claude keeps working while subagents run instead of stopping to wait – and background agents that finish code work in a worktree now commit, push, and open a draft PR on their own. 2.1.212 added the caps that keep all that parallelism from running away.
• The permission system got renamed, extended, and audited. The "default" mode is now called Manual (2.1.200), auto mode reached Bedrock, Vertex, and Foundry without an opt-in flag (2.1.207), and the last week of releases shipped the longest run of permission-bypass fixes this series has covered.

Underneath those three, a performance wave took a real bite out of long-session memory use and stalls. Details below, version numbers on everything.

Claude Sonnet 5, and which plans get it as default

Claude Sonnet 5 landed in Claude Code 2.1.197 on June 30. Two things make it more than a routine model launch: the 1M-token context window is native, not a beta flag, and the launch pricing – $2 per million input tokens, $10 per million output – runs through August 31. If you've been rationing context or routing long-context work to special model IDs, that workaround is over.

One thing it is not: the default for everyone. The changelog entry announces Sonnet 5 as "now the default model in Claude Code," but Anthropic's launch post scopes that claim – Sonnet 5 is the default on Free and Pro plans, while Max, Team, and Enterprise accounts keep resolving Default to Claude Opus 4.8. We verified on a Max account while writing this: claude --model default still reports claude-opus-4-8. The /model picker's Default row shows what your account actually resolves to – trust the row, not the headline.

The model layer around the picker also grew up this window:

The pattern: the default is no longer just a hardcoded value. It resolves through plan tier, org policy, provider, and your own pick, and the tooling now shows you which layer decided.

Subagents moved to the background

The single biggest workflow change since 2.1.186: as of 2.1.198, subagents run in the background by default. Claude dispatches the agent, keeps working on the rest of your request, and gets notified when the agent finishes. What used to be a gradual rollout is now how every session behaves. If your muscle memory expects Claude to block on a subagent, the rhythm is different now – in a good way.

The same release pushed background agents further toward finishing jobs without you. Background agents launched from claude agents that complete code work in a worktree now commit, push, and open a draft PR instead of stopping to ask. At WotAI, where Claude Code handles every commit, pull, and push already, this is the version where a dispatched agent takes a task from prompt to reviewable PR with nobody watching.

Two more 2.1.198 changes matter for output quality: the built-in Explore agent now inherits the main session's model (capped at Opus) instead of always running on Haiku, and subagents plus context compaction inherit the session's extended-thinking configuration. Delegated work stopped being second-class work.

All that parallelism needed brakes, and 2.1.212 added them:

2.1.212 also split one command into two honest ones: /fork now copies your conversation into a new background session – its own row in claude agents – while you keep working, and the in-session subagent it used to launch lives on as /subtask. Typing /resume in the agent view opens a picker of past sessions, including ones you deleted from the list.

The agent view itself reads differently than it did a month ago. Rows show a colored state word and a classifier-written headline instead of raw tool-call text (2.1.205), sessions that touch a PR link it right on the row, and the status column uses the full terminal width (2.1.206). The /agents wizard is gone (2.1.198) – you manage subagents by asking Claude or editing .claude/agents/ directly.

And the stability tail is long. Across the window: background sessions survive the CLI updating underneath them, workers killed by a daemon restart resume where they left off (2.1.196), agents upgrade themselves in the background right after an update instead of paying a slow stale-session penalty when you attach (2.1.206), and a genuinely nasty bug – waking a background job could permanently delete its conversation and re-run the original prompt – was fixed so the transcript is set aside, never deleted (2.1.196). If you tried background agents earlier this year and bounced off, the version you bounced off no longer exists.

Manual mode, and auto mode everywhere

Claude Code renamed its oldest permission mode. As of 2.1.200, the mode formerly known as "default" is called Manual across the CLI, --help, VS Code, and JetBrains. --permission-mode manual and "defaultMode": "manual" work alongside the old spelling, so nothing breaks – but docs, menus, and the footer now say Manual, and 2.1.203 added a grey ⏸ badge so the active mode is always visible. The same release stopped AskUserQuestion dialogs from auto-continuing when you don't answer; if you liked the idle timeout, it's an opt-in via /config now.

One change in this group will land hardest for anyone running worktrees: as of 2.1.211, "always allow" permission rules save at the repository root. Approvals you grant in one worktree persist across sessions and every other worktree of that repo. Under a worktree-heavy workflow, this ends the ritual of re-approving the same commands per worktree.

Auto mode, meanwhile, went from a first-party feature to the assumed operating mode everywhere:

• Enterprise providers get it without the flag. As of 2.1.207, auto mode works on Bedrock, Vertex AI, and Foundry with no CLAUDE_CODE_ENABLE_AUTO_MODE opt-in; disableAutoMode in settings turns it off.
• Repo-resident config can't switch it on. Also 2.1.207: auto mode no longer reads autoMode from .claude/settings.local.json in the repo – a cloned repository shouldn't decide your permission posture. It lives in ~/.claude/settings.json now.
• The guardrails got smarter. Auto mode now blocks tampering with session transcript files and asks before running rm -rf on a variable it can't resolve from context (2.1.205). Catastrophic removals hidden inside $(…), backticks, or <(…) now prompt even in auto mode and --dangerously-skip-permissions (2.1.208). A PreToolUse hook's ask decision floors the outcome at a prompt – auto mode can't override your hook (2.1.211).
• You can see and reset its decisions. Denial reasons appear in the transcript, the denial toast, and /permissions (2.1.193). claude auto-mode reset restores the default configuration (2.1.212). A new autoMode.classifyAllShell setting routes every shell command through the classifier instead of only arbitrary-code-execution patterns (2.1.193), and the classifier itself now defaults to Sonnet 5 for external sessions (2.1.210).

The quiet security wave

Read 2.1.214 and 2.1.216 back to back and they look like the output of a security audit, because the fix list is dominated by permission checks that could be slipped past. A sample of what got closed:

• Bash permission checks now fail closed on file-descriptor redirect forms that bash parses differently than the analyzer, and commands over 10,000 characters always prompt instead of running automatically (2.1.214)
• help and man invocations that could smuggle unsafe options or command substitutions are no longer auto-approved as read-only, and zsh variable subscripts inside [[ ]] comparisons now prompt (2.1.214)
• A permission-check bypass in Windows PowerShell 5.1 sessions was closed (2.1.214), PowerShell validation handles invisible Unicode characters (2.1.216), and read-only commands on Windows no longer touch network paths without a prompt (2.1.216)
• Single-segment dir/** allow rules like Edit(src/**) were auto-approving writes to any nested dir/ anywhere in the tree; they now match only <cwd>/dir (2.1.214)
• docker commands carrying daemon-redirect flags (--url, --connection, Podman remote mode) now require permission (2.1.214)
• A whole symlink class: /rewind no longer restores or deletes files through symlinks or hard links (2.1.216), workflow saves can't be redirected outside the project via a symlinked .claude (2.1.216), and worktree creation refuses a repository-committed symlink at .claude/worktrees (2.1.212)
• Worktree isolation actually isolates: subagents can no longer redirect git into the shared checkout via git -C, --git-dir, or GIT_DIR (2.1.216), or run git-mutating commands against the main checkout (2.1.210)
• Injection surface: the Agent tool is hardened against indirect prompt injection from content a subagent read (2.1.210), permission previews neutralize bidirectional-override and zero-width characters so tool inputs can't visually alter what you're approving (2.1.211), and the ultracode workflow keyword no longer fires from webhook payloads or relayed PR comments (2.1.210)
• Background task notifications explicitly state that no human input occurred, so a fabricated in-transcript "approval" can't be acted on (2.1.205)

2.1.214 also added the EndConversation tool, which lets Claude end sessions with abusive users or jailbreak attempts – the same behavior claude.ai has had since 2025.

None of these are features you'll notice on a normal Tuesday. They're the reason unattended agents – auto mode on a real repo, background sessions opening PRs overnight – keep being something you can defend running. If that's your setup, this section is the actual reason to update.

Faster, lighter, less leaky

2.1.208 is the biggest single performance release Claude Code has shipped, and 2.1.216 finished the job:

• Long-session memory leaks, fixed in a batch. MCP stdio servers could accumulate up to 64 MB of stderr each, LSP documents stayed open indefinitely, and large tool results piled up in headless sessions – all bounded now, and the file-edit cache is capped at 16 MB instead of pinning up to 1,000 full files (2.1.208)
• Session transcripts shrank up to 79x in edit-heavy sessions, with checkpoint disk usage bounded by pruning superseded file-history backups (2.1.208)
• Tool rounds run up to 7x faster in print/SDK sessions with many MCP tools, thanks to cached tool-pool assembly (2.1.208)
• The quadratic stall is gone. Message normalization cost grew quadratically with turn count, causing multi-second stalls and slow resumes in long sessions – fixed in 2.1.216
• Streaming got cheaper. Text updates coalesce to 100ms, cutting CPU during streaming by roughly 37% (2.1.191), and the terminal no longer freezes while streaming very long lists and tables (2.1.207)
• The binary lost ~7 MB and startup memory dropped ~7 MB by loading a large bundled dependency lazily (2.1.203), and auto-update downloads stream to disk instead of buffering, cutting the updater's peak memory by roughly 400 MB (2.1.205)

If you keep long-running sessions open, this cluster is the difference you feel first after updating.

Smaller changes worth knowing

• Screen reader mode shipped. claude --ax-screen-reader, CLAUDE_AX_SCREEN_READER=1, or "axScreenReader": true turns on plain-text rendering for screen reader users (2.1.208), building on earlier work that hides decorative glyphs and reads tables as Header: value lines (2.1.200)
• /rewind reaches back past /clear. You can resume a conversation from before you cleared it (2.1.191)
• /doctor became a full setup checkup that diagnoses and fixes issues, with /checkup as an alias (2.1.205) – and it now proposes trimming checked-in CLAUDE.md content that Claude could derive from the codebase itself (2.1.206)
• /verify and /code-review no longer run on their own. Claude invokes them only when you ask (2.1.215)
• /review <pr> went back to being fast. 2.1.186 pointed it at the multi-agent /code-review engine; 2.1.202 reversed that. /review is a quick single pass again, and /code-review <level> <pr#> is the deep version
• Stacked skills work. /skill-a /skill-b do the thing loads up to five leading skills instead of just the first (2.1.199)
• Vim users get jj. The vimInsertModeRemaps setting maps two-key insert-mode sequences to Escape (2.1.208)
• Sessions warn before your login expires, so overnight background runs stop dying to a stale token (2.1.203)
• Claude in Chrome is generally available (2.1.198), and a /dataviz skill for chart design shipped alongside it

Should you update?

Yes, and for once the strongest argument is the unglamorous one:

1. If you run auto mode or unattended agents, the 2.1.214/2.1.216 permission-hardening wave is the update. Fail-closed Bash analysis, the dir/** rule fix, worktree isolation that holds, and injection-resistant permission previews all land here.
2. If your sessions run long, the memory-leak batch, 79x transcript reduction, and the quadratic-stall fix change how the tool feels by day three of a session.
3. If you want Sonnet 5 and its 1M context, you need 2.1.197 or later – and the launch pricing window closes August 31.

Two behavior changes to know walking in: subagents now run in the background by default, so Claude keeps talking while delegated work runs – different rhythm, same results. And your settings may say defaultMode: "default" while every menu says Manual; both spellings work, nothing to migrate.

Frequently asked questions

What is the latest version of Claude Code? As of July 20, 2026, the latest Claude Code release is 2.1.216. It added a sandbox.filesystem.disabled setting, fixed a long-session slowdown where message normalization grew quadratically with turn count, and closed several permission-check gaps including symlink handling in /rewind and worktree git redirection.

What model does Claude Code use by default now? It depends on your plan. Since 2.1.197 on June 30, 2026, Claude Sonnet 5 is the default on Free and Pro plans. Max, Team, and Enterprise accounts still resolve Default to Claude Opus 4.8, and Bedrock, Vertex, and Claude Platform on AWS default to Opus 4.8 as of 2.1.207. Sonnet 5 ships a native 1M-token context window.

Do Claude Code subagents run in the background now? Yes. As of 2.1.198, subagents run in the background by default – Claude keeps working while they run and gets notified when they finish. Background agents that complete code work in a worktree also commit, push, and open a draft PR automatically instead of stopping to ask.

What happened to Claude Code's "default" permission mode? It was renamed Manual in 2.1.200, across the CLI, VS Code, and JetBrains. --permission-mode manual and "defaultMode": "manual" are accepted alongside the old default spelling, so existing configs keep working. A grey ⏸ footer badge (2.1.203) shows when Manual mode is active.

How do I stop Claude Code from spawning too many subagents? Since 2.1.212, sessions cap subagent spawns at 200 by default; override with CLAUDE_CODE_MAX_SUBAGENTS_PER_SESSION, and /clear resets the budget. WebSearch calls cap at 200 per session via CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION, and MCP tool calls longer than 2 minutes move to the background automatically.

What is the difference between /fork and /subtask? Since 2.1.212, /fork copies your conversation into a new background session with its own row in claude agents, while you keep working in the original. /subtask is the old /fork behavior: an in-session subagent that runs inside your current conversation.

Does auto mode work on Bedrock and Vertex now? Yes. As of 2.1.207, auto mode is available on Bedrock, Vertex AI, and Foundry without the CLAUDE_CODE_ENABLE_AUTO_MODE opt-in. Set disableAutoMode in settings to turn it off. Auto mode also stopped reading its config from repo-resident .claude/settings.local.json – use ~/.claude/settings.json.

Were Claude Code 2.1.188, 2.1.189, 2.1.192, 2.1.194, and 2.1.213 ever released? 2.1.188, 189, 192, and 194 were never published – internal builds, the same pattern as earlier skipped numbers. 2.1.213 is the odd one: it went out on npm on July 17 but has no entry in the public changelog. The changelog window from 2.1.187 to 2.1.216 contains 25 documented releases.

Why doesn't /code-review run automatically anymore? As of 2.1.215, Claude no longer invokes the /verify and /code-review skills on its own. You invoke them explicitly when you want them. Separately, 2.1.202 reverted /review <pr> to a fast single-pass review; use /code-review <level> <pr#> for the multi-agent version at a chosen effort level.

Should I update to Claude Code 2.1.216? Yes. The 2.1.214 and 2.1.216 permission-hardening fixes are the strongest reason if you run auto mode or unattended agents, and the 2.1.208 performance batch (memory leaks, 79x smaller transcripts, 7x faster tool rounds) is the difference you'll feel in long sessions. Sonnet 5 as default requires 2.1.197+.

Where to go from here

This is the latest entry in our running Claude Code release coverage: 2.1.116, 2.1.121, 2.1.126, 2.1.131, 2.1.141, 2.1.186, and now 2.1.216.

Anthropic's official changelog is the source of truth. We pull out the parts that matter and add the context you'd otherwise have to dig out yourself.

The patterns behind these features in real production work – auto mode on live repos, background agents opening draft PRs, permission rules that survive worktrees – live in WotAI Skool. 760+ builders, three live calls a week, free to jump in.