Six Claude Code changelog entries, most of them about what an agent may do to your machine

The changelog section spanning versions 2.1.215 to 2.1.220 focused largely on containment. The costliest single line is in 2.1.219: Claude Opus 5 became the default Opus model, with a 1M context window and fast mode at $10 and $50 per million tokens. Two new settings appeared: sandbox.network.strictAllowlist to refuse non-allowlisted hosts without prompting, and sandbox.filesystem.disabled to drop filesystem isolation while keeping network egress control. Three entries addressed agents escaping their own boundaries: worktree-isolated subagents redirecting git into the shared checkout via git -C or GIT_DIR, background sessions not canonicalizing symlinked working directories "which could let sessions escape their workspace folder," and scheduled-task writes following a symlink at .claude to land outside the project. The entries also described a cap of 20 concurrent subagents and a fix for --max-budget-usd not stopping background subagents. Version 2.1.217 stopped subagents spawning nested subagents by default, while 2.1.219 set the default depth to 3.

Correction, August 3: our July 30 edition had already recorded version 2.1.220 with a July 25 date, so these were not six releases in roughly 36 hours. This item is a feature summary of entries observed in Anthropic's mutable documentation changelog, not a reliable release timeline. The GitHub changelog has since been rewritten and no longer preserves the same sequence.

Why it matters: The observed changelog said --max-budget-usd had not bounded background subagents before the fix. If you did not pin CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH, the documented fan-out default changed across two entries. The broader lesson survives the chronology correction: write your limits down rather than silently inheriting mutable defaults.