Anthropic shipped Claude Code 2.1.212 on July 16, and the headline fix is a real permission gap. Plan mode, the mode meant to let you review changes before anything runs, was auto-running file-modifying Bash commands like touch and rm without a permission prompt. It also skipped the canUseTool callback that lets SDK integrations block a command. That’s now fixed.

This lands three days after Claude Code closed a different destructive-command loophole in version 2.1.208, which extended warnings around rm -rf. Together, the two releases point at the same theme: Anthropic is tightening the gap between what Claude Code says it will ask permission for and what it actually asks permission for.

Why it matters

Plan mode exists so you can see a proposed change before Claude Code touches your files. If a bug lets destructive commands slip through unprompted, that’s not a minor inconvenience. It undermines the one safety net plan mode is supposed to provide, especially if you were relying on it while working in a repo you can’t easily restore from backup.

The release also adds two new limits aimed at a different failure mode: runaway agent behavior. Claude Code now caps WebSearch calls at 200 per session (tunable with the CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION environment variable) and subagent spawns at 200 per session (tunable with CLAUDE_CODE_MAX_SUBAGENTS_PER_SESSION, and reset by running /clear). Both exist to stop a session from looping endlessly on search or delegation, something that can quietly burn through your usage budget if an agent gets stuck.

A third change speeds up long-running MCP (Model Context Protocol, the standard Claude Code uses to connect to external tools) calls: any MCP tool call running past two minutes now moves to the background automatically, so a slow integration doesn’t freeze your session. That threshold is configurable via CLAUDE_CODE_MCP_AUTO_BACKGROUND_MS.

There are workflow changes too. /fork now copies your conversation into a full background session, its own row in claude agents, instead of launching an in-session subagent. If you want the old in-session behavior, that’s now /subtask. And /resume inside the agent view opens a picker that includes deleted sessions, resuming your pick as a background session.

Who should care

Anyone who leans on plan mode as a safety check before Claude Code touches files should update immediately. If you run long agent sessions with heavy web search or subagent delegation, especially in the ChatGPT-adjacent multi-agent style of workflow more coding agents are pushing toward, the new caps are worth knowing about before you hit them mid-task.

What builders should do next

Update to 2.1.212 if you haven’t already; Claude Code typically prompts you when a new version is available. If you’ve built workflows that depend on more than 200 web searches or subagent spawns in a single session, either plan around the new default or raise it with the environment variables above, for example:

export CLAUDE_CODE_MAX_SUBAGENTS_PER_SESSION=500

That raises the subagent cap for sessions where you know you need more headroom, rather than hitting the limit mid-task and losing progress. If your auto-mode settings feel off after the update, claude auto-mode reset restores the defaults, with a confirmation prompt unless you pass --yes.

End of article