Skip to main content
← All news
AI Agents

Claude Code 2.1.232 makes forked subagents the default

By AgentRiot Editorial

The August 13 cut also closes PowerShell, Git Bash, and shared `/tmp` holes. Version 2.1.233, a day later, had to walk two of the Bash permission changes back.

Claude Code 2.1.232 forking default
claude-codeanthropicagentssandboxsubagents

Claude Code did not ship a new model this week. It changed how the agent splits work, and it spent most of the changelog on people who already had a way around the sandbox.

v2.1.232 landed 13 August 2026. v2.1.233 followed on 14 August. Both are stable GitHub releases, not pre-releases. There is no matching Anthropic newsroom post. The source of truth is the release body.

Forking is no longer an opt-in trick

The first line of 2.1.232 is the product change: subagent_type: "fork" is now the default. A forked subagent inherits the full conversation and the prompt cache. In interactive sessions, non-teammate agent spawns also run in the background by default.

That is cheaper than starting a cold agent, and it is a different trust boundary. The child sees what the parent saw. If you were using isolated subagents as a way to keep a messy exploration out of the main thread, that isolation is gone unless you set it back.

The same release adds @ mentions so one Claude session can SendMessage another session by name. Live sessions on one machine now refuse duplicate names and mint a name-word-word variant instead. /config gained rows for dialog expiry and whether inbound messages from your other sessions are accepted, held, or refused.

That is a small multi-agent runtime, not a coding-quality bump.

The rest of 2.1.232 is a permission week

The notes close a stack of ways the sandbox was not the sandbox:

  • PowerShell parameters that write variables could overwrite $PSDefaultParameterValues and redirect later file access without a prompt.
  • On Windows, Git Bash followed Cygwin-style symlinks that path validation treated as regular files.
  • Nested git repos inherited trust from the parent directory. Each repo now needs its own confirmation.
  • The auto-generated cross-session messaging socket directory on shared /tmp would follow a pre-planted symlink or another user’s directory. It now refuses both.
  • Linux protected-path bypass in the filesystem sandbox.
  • Project settings can no longer override sandbox.ripgrep. Only user, managed, and --settings sources can.
  • Bash input redirections (< file) started getting the same permission check as the argument form.

GitLab caught up with GitHub on the credential side. Token families (glrt-, gloas-, glpat-, and the rest listed in the note) are redacted. The glab config store gets the same sandbox and credential-path protection as gh. Marketplace clones now accept bare gitlab.com URLs, including nested subgroups.

Gateway boot is stricter too. Empty match.groups / admin_groups and malformed email_domain values fail at startup instead of matching nobody or granting admin. The desktop: overlay accepts every released Desktop setting and validates them against Desktop’s own schema.

Those are operator fixes. They are also an admission that the previous defaults were leaky.

2.1.233 is the morning-after release

The next day’s note is shorter and more revealing.

MCP v2 connections no longer reopen the subscriptions/listen stream forever against servers that kill long-held streams on a timer. That is the serverless-host case. Windows paths with the NT \??\ device prefix no longer skip UNC validation, which the note calls an NTLM credential-leak vector. Linux Bash commands can take an opt-in memory cgroup via CLAUDE_CODE_TOOL_MEMORY_LIMIT. Idle sandboxed sessions no longer pin a CPU core at 100 percent.

Then the revert: 2.1.233 undoes the 2.1.232 Bash permission changes for Cygwin-style symlinks on Windows and for < file redirections. “A narrower version will return in a later release.” A separate 2.1.232 regression that stopped ordinary cd <dir> && <command> > file chains in auto mode is also fixed.

So the week is not “sandbox finished.” It is “sandbox tightened, then two of the tightest checks proved too broad overnight.”

One more behavior change in 233: todo/task-tracking tools are off for Opus 4.8, Sonnet 5, Fable 5, Mythos 5, and newer models unless you set CLAUDE_CODE_ENABLE_TODO_TOOLS=1. That is a model-harness split, not a bugfix.

What this is not

It is not a Claude model launch. It is not a rewrite of Cowork or Desktop. It is not independent proof that the remaining sandbox is complete. The release notes are Anthropic’s own list of what they closed and what they had to undo.

If you run Claude Code on a shared box, or you let it talk to GitLab, or you spawn subagents all day, 2.1.232 plus 2.1.233 is the pair to install. Read the fork default before you assume a child agent cannot see the parent thread. And do not treat the 232 Bash permission lines as still live on Windows. 233 already took two of them back.

Sources