Claude Code v2.1.305 adds an opt-in sandbox.allowNestedUserNamespaces setting, a usage-limit recheck for unattended retry mode, and a change to how allowedMcpServers treats managed stdio servers. v2.1.306 is two fixes. Changelog-only analysis: I did not run either release.
Claude Code v2.1.304 adds /auto-mode-setup (now on Bedrock, Vertex and Foundry), lets a mod’s tool.check demand a human decision with decider: “person”, warns before resuming an old conversation eats your 5-hour limit, and ships a long list of fixes, including a worktree exit that could lose commits.
Claude Code v2.1.301 (Oct 15) and v2.1.302 (Oct 16) cap how long unattended retries wait on a usage limit, let you choose the client-side auto mode classifier’s model, turn fork subagents on by default outside the terminal, and limit concurrent prompt/agent hooks to 12 per event.
Claude Code v2.1.296 lets a subagent auto-compact earlier than the main session and pins every workflow agent to one model; v2.1.300 splits OpenTelemetry cache writes into 5-minute and 1-hour buckets. Together they are the first real cost-control surface for multi-agent runs. Based on the changelog only; I have not tested these.
Claude Code v2.1.299 (Oct 14) narrows MCP allow rules to the exact named server, makes plugin hooks that can’t answer refuse the action, stops following redirects on connector proxies, and compacts idle 200K+ token sessions before the one-hour cache expires.
Since Claude Code v2.1.292 (Oct 6) local stdio MCP servers negotiate protocol 2026-07-28 by default, and v2.1.295 (Oct 8) does the same for claude.ai connectors. Servers that ignore the check get remembered for 7 days and connected the old way; MCP_PROTOCOL_NEGOTIATION=legacy opts out.
An unverified Reddit report — the original post has since been deleted — claims a Claude Code agent wiped 48,218 files and a project’s Git history in 103 seconds via a Windows directory-junction bug. The incident can’t be confirmed. The underlying technical failure mode and Claude Code’s own documented checkpoint limitations are real and worth understanding regardless.
Claude Code v2.1.277 added AGENTS.md as a fallback when CLAUDE.md is missing — but the loader is gated behind a remote Statsig flag that silently no-ops if telemetry is disabled or the flag can’t be fetched, with zero warning. Still open as of v2.1.281 (Sept 23).
Claude Code v2.1.277 (September 18) added AGENTS.md as a fallback instructions file when no CLAUDE.md is present — a small changelog line that closes an interoperability gap Anthropic has had the standing to close since co-founding the Agentic AI Foundation last December. It also quietly doubles the blast radius of a supply-chain problem this blog has been tracking since April.
A new Theori study built 28 apps with five frontier AI models and confirmed 434 exploitable vulnerabilities after deduplication and PoC testing. SQL injection and XSS were nearly absent — but resource-exhaustion bugs, hardcoded secrets, and authorization gaps that double in larger codebases (11% to 28%) are the new failure modes agentic coding tools haven’t solved.