Claude Code Patch Fixes Worktree Security Flaws
This episode covers critical Claude Code security fixes, including tighter isolation for worktree subagents, stricter controls on repo-local settings, and global-only activation for Remote Control. It also touches on a token tracking bug and a SendMessage crash fix for smoother multi-agent workflows.
Show Notes
- Claude Code changelog - Claude Code Docs: https://code.claude.com/docs/en/changelog
Chapter 1
Worktree Isolation Safeguards and Settings Hardening in Claude Code
Lachlan Reed
Brought to you by Jellypod AI. So James, I was running a couple of parallel background subagents in Claude Code version two point one point two hundred twenty two, released on August four, twenty twenty six. And, er, I almost had a heart attack.
James Turner
Wait, what happened? Did a subagent go rogue on your main git repository?
Lachlan Reed
That is, uh, exactly what happened. Before this two point one point two hundred twenty two patch, if you had worktree isolated sessions running background tasks, those subagents could still execute destructive git commands like git reset hard against your primary checkout.
James Turner
Are you serious? The whole point of git worktrees is isolation! You put a subagent in its own isolated worktree so it can test experimental refactoring without touching your main working directory.
Lachlan Reed
Right! But behind the scenes, those subagents were able to bleed git operations right back into the main repo checkout. In this update, the team explicitly fixed worktree isolated sessions and their subagents being able to run destructive git commands against the main checkout. Now file edits and Bash commands are strictly locked down across every single session type.
James Turner
That is a massive security fix, honestly. And speaking of security, they also locked down repo level settings files, right?
Lachlan Reed
Yeah! So before, if you cloned a random untrusted repository, it could have a local setting in dot claude slash settings dot json that automatically enabled Remote Control auto start. That meant just opening a repo could hand over control of your terminal.
James Turner
Wow, that is basically an open door for workspace hijacking. So how do we enable Remote Control now?
Lachlan Reed
It is strictly restricted to global user scope now. Repo local config files can no longer turn it on. You have to explicitly toggle Remote Control at the global user level using slash config.
James Turner
That makes complete sense. And didn't they clean up some annoying subagent bug in the slash usage command too?
Lachlan Reed
Oh mate, yeah! The token tracking was completely misattributing token usage to Model Context Protocol servers even on turns where those MCP servers were totally inactive. So your metrics looked blown out for no reason.
James Turner
I knew my token counts for MCP tools looked way too high! Plus, they fixed SendMessage so long subagent summaries get auto truncated now instead of crashing your session mid turn with a character limit error.
Lachlan Reed
Exactly. If you are running multi agent workflows or background refactoring, update to version two point one point two hundred twenty two right now. Save your git main branch before a subagent cleans it out for you.
James Turner
Yeah, grab the update folks. Catch you next time.