Claude Code 2.1.217: Subagents No Longer Chain Automatically, and a Workspace Escape Is Patched

Claude Code 2.1.217 shipped on July 21. About twenty fixes, plus two behavior changes that hit multi-agent workflows directly. Here’s what matters.

Subagents stop chaining automatically

The most structural change in this release, and it breaks an existing habit if you build multi-agent workflows.

Two new guardrails:

• A concurrency cap on subagents: 20 by default, adjustable via CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS. A single message can no longer fan out an unbounded number of background agents.
• No nesting by default: a subagent can no longer spawn subagents of its own. To get the old behavior back, raise CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH.

If your workflows rely on agents delegating to other agents several layers deep (nested pipelines, cascading orchestration), they’ll now stop dead at the first level until you raise that variable. Check your scripts before updating anything running in production.

Related fix: --max-budget-usd now actually halts background subagents once the cap is hit. Before, going over budget didn’t stop agents already running.

The security fix you shouldn’t skim

Two holes closed:

• Working-directory escape via symlink. Background session isolation wasn’t canonicalizing symlinked working directories, which could let a session escape its own workspace folder.
• Startup hang from a booby-trapped frontmatter. A paths field in CLAUDE.md or SKILL.md with many brace groups could OOM-kill or stall the CLI at startup. Brace expansion is now budget-bounded.

The second one is the kind of trap that could sit quietly in a public repo to mess with anyone who clones it and runs Claude Code inside. If you open CLAUDE.md or SKILL.md files from outside sources, this version closes that door.

What actually changes your day-to-day

• MCP memory leak fixed: truncated MCP tool outputs were still keeping the full, untruncated result in memory for the rest of the session. On a long session with chatty MCP tools, that added up. Fixed.
• Auto-compact fixed for Opus 4.8 on Bedrock: it never triggered, and /compact failed once you were over the limit. If you run Opus 4.8 on Bedrock, this was a real blocker.
• Corporate settings finally respected in Claude Desktop: mTLS, TLS verification, OAuth scopes, and proxy settings were being ignored on Desktop. Fixed.
• Windows: failed auto-updates no longer wipe out claude.exe. The preserved executable is now restored automatically when an update fails.
• Background shells no longer get stuck after backgrounding a session (/background or left arrow) or on exit, especially on a heavily loaded Windows machine.

The rest, briefly

• Emoji shortcode autocomplete in the prompt: type :heart: to insert ❤️, or :hea for suggestions. Turn it off with emojiCompletionEnabled if it gets in the way while typing code or paths.
• A warning now shows up when transcript writes fail (disk full) or session saving is off due to an inherited environment variable, instead of silently losing transcripts.
• /resume and --resume/--continue no longer throw a TypeError on a malformed attachment entry.
• Remote Control sessions now show a pending permission prompt to viewers who connect after it appears.
• Screen reader mode: the startup announcement no longer gets cut off by the first prompt render.
• The login-expiry warning now appears 3 days before expiry instead of 5.

Should you update

Yes, but test first: if you have workflows with nested subagents (multi-level delegation), run them again after updating. Nesting is off by default, and it’s easy to forget to raise the environment variable back up.

Beyond that, the symlink-based workspace escape and the startup hang risk from crafted frontmatter are reason enough not to wait.

Source: official Claude Code changelog.