Claude Code 2.1.223: Context Limits and Security Fixes
We unpack the latest Claude Code update, from automatic compaction for 1M-context models and clearer startup warnings to new safeguards for background agents and custom model gateways.
The episode also covers a critical security fix for hidden Unicode Bash prompt attacks, plus workflow polish like a permanent slash review alias and persistent effort settings.
Show Notes
- Claude Code changelog - Claude Code Docs: https://code.claude.com/docs/en/changelog
Chapter 1
Context Caps and Security in Claude Code 2.1.223
Lachlan Reed
So I, I was updating my dev CLI tools this morning and saw Claude Code version 2.1.223 dropped on August 6, 2026. The biggest change is how the environment variable CLAUDE_CODE_DISABLE_1M_CONTEXT works. It used to be just a hardcoded list, but now it will hold every Claude model with a native 1M window to 200K via auto-compaction, not just a fixed list. Even something massive like Claude Opus 5 gets auto compacted down to 200K tokens now.
James Turner
Wait, why would you ever want to squeeze a 1M context window down to 200K? If I am feeding a massive monorepo into the terminal, I want every single token of that 800K history available. Forcing auto-compaction at 200K is going to chop out subtle cross file edge cases!
Lachlan Reed
Mate, because without it, your API bill gets flattened! When your terminal session reaches 800K tokens, every single prompt turn costs five times as much and adds multi second latency just waiting for prompt processing. If you export CLAUDE_CODE_DISABLE_1M_CONTEXT=1 in your shell profile, you keep things snappy. Plus, in version 2.1.223, if compaction fails to bring it under 200K, you get a clear terminal startup warning right away.
James Turner
Okay, fair point on prompt latency and cost, but what happens when a tool call dumps a huge payload? Say a single tool call outputs a 50 megabyte log file into context?
Lachlan Reed
That 50 megabyte log file is precisely what triggers that new v2.1.223 startup compaction warning! If you run budget background agents, passing CLAUDE_CODE_DISABLE_1M_CONTEXT=1 claude directly stops them from blowing through your credit limit. And if you are using custom LLM gateways with custom model names, you can pair it with CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1 so it does not choke on unrecognized IDs.
James Turner
Huh, alright, that makes a lot of sense for background runs. Speaking of workflow polish, I am glad they made slash review a permanent alias for slash code review. And it remembers effort state now! If you run slash code review high, that effort memory stays persistent across your sessions.
Lachlan Reed
That persistent effort setting is huge! But honestly, James, the security patches in 2.1.223 are what really caught my eye. They fixed an exploit where attackers used invisible Unicode characters and tab character padding to obscure malicious arguments inside Bash command permission prompts.
James Turner
Wait, so a terminal prompt could look completely harmless on screen, but execute something totally destructive underneath?
Lachlan Reed
Spot on. They wiped that right out. And for team setups, strictKnownMarketplaces now supports owner wildcard patterns like owner slash star. So instead of listing every single repository for GitHub org wide plugins, you just whitelist the organization owner and you are done.
James Turner
Fast context compaction and patching sneaky terminal obfuscation in one go. That is a tight update.
Lachlan Reed
Too right. Time to go tweak your dotfiles, mate!