Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-17 · high
Below that version, file-modifying Bash commands could run during plan mode without waiting for approval, per the changelog.
Why now: The changelog entry for 2.1.212 pairs this fix with one for orphaned SIGTERM process trees in the same update.
Claude Code 2.1.212 fixes a bug where plan mode didn't actually block file-modifying Bash commands from running, per the Claude Code changelog. Plan mode exists so you can review a proposed set of changes before anything touches disk. If a Bash command could mutate files during that review step, the core guarantee of the mode was broken.
The practical risk is narrow but real. Anyone running a version before 2.1.212 who trusted plan mode as a safe preview could have had files altered mid-plan. They wouldn't have seen the permission prompt they expected first. If you script around Claude Code or run it unattended, that's the difference between nothing happening until you say so, and something already happening.
The same release also fixes a separate bug. SIGTERM could orphan process trees in print and SDK mode, leaving child processes running after a kill. Different bug, same theme: the tool doing something after you told it to stop, or before you told it to go.
Upgrade to 2.1.212 if you use plan mode as a gate before approving changes, especially in automated or unattended setups. The changelog doesn't say how long the bug existed before this fix. It also doesn't say how many commands were affected, so there's no way to know if past plan-mode sessions were exposed.
Earlier entries in the same changelog hardened other parts of the permission surface. Version 2.1.210 tightened the Agent tool against indirect prompt injection and, separately, stopped worktree-isolated subagents from running git-mutating commands against the main repo. Permission and isolation bugs are the pattern this cycle, not new features.
Each link below shares sources, entities, or timing with this story.
The default is 200 search calls and 200 subagent spawns per session, adjustable through an environment variable when you hit it.
The August 20 update also lets plugin marketplaces mint short-lived headers instead of storing static tokens in config.
v2.1.211 stops Bedrock, Vertex, Mantle, and Foundry from rebilling cached system context as full-price input tokens.
A hook could exit code 2, report failure, and still let the tool run if its JSON failed schema validation, per Claude Code's changelog.
Your own default mode persists unless you accept a one-time switch prompt, and scripts can now enable it directly in settings.json.
Auto mode also becomes the default permission setting for new accounts starting August 14, and its checks stop counting against usage limits.
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.