AI Coding News: August 5, 2026 — Claude Code 2.1.222 Closes a Worktree-Isolation Security Gap
Today's update is a quieter one than usual, and that's worth saying plainly rather than padding out: only two of the major AI coding agents shipped anything new since yesterday, but one of them is a real security fix worth knowing about. Claude Code 2.1.222 closes a worktree-isolation bypass that let isolated sessions run destructive git commands against the main checkout, and OpenCode v1.18.13 lands a batch of desktop bugfixes. GitHub Copilot CLI, OpenAI Codex CLI, and Gemini CLI all stayed on the versions covered previously. Here's what actually changed, sourced from each project's own changelog.
Claude Code 2.1.222: Worktree Isolation Gets Locked Down
Anthropic's Claude Code CHANGELOG lists 21 changes in version 2.1.222, landing the day after 2.1.221's Focus view and credential-masking release. The headline fix: worktree-isolated sessions and their subagents could previously run destructive git commands against the primary checkout instead of staying confined to their own worktree; isolation now extends to file edits and Bash across every session type. A related fix closes a gap where PreToolUse auto-allow hooks could bypass tool restrictions inside background agent tasks like summaries, compaction, and renames — both are meaningful for anyone running Claude Code with broad autonomy across multiple parallel worktrees.
- Auto mode is safer by default: messages sent to other agent sessions via
SendMessageare now evaluated by the permission classifier before dispatch, instead of being trusted implicitly. - The
/diffview, Remote Control workspace diffs, and file-edit diffs now render from raw git blob content, ignoring workspace-configured diff drivers so what you see always matches what's actually staged. - Remote Control auto-start can no longer be turned on by repo-local settings — it now has to be enabled at user scope via
/config, closing off a way an untrusted repo could silently flip on remote access. - Also fixed: sessions failing to link pull requests created after a branch push, the startup connectivity check hanging behind an HTTPS proxy,
/usageoverattributing token usage to MCP servers, and org-restricted model aliases dropping to the parent model instead of stepping up to the newest org-allowed one. The long-running ultraplan feature was also removed.
OpenCode v1.18.13: Localization, RTL, and a Lighter Timeline
The open-source, terminal-native agent OpenCode shipped v1.18.13 on August 4, per its GitHub releases page, one release after the Azure GPT-5.5 reasoning fix in v1.18.12. On the TUI side, GitHub pull request reviews now include the PR number and URL in context, so an agent quoting a review comment can reference exactly which PR it came from. The desktop app gets several fixes: sessions without titles fall back to a generated name instead of appearing blank, and markdown parsing has been moved off the main thread to keep the app responsive while rendering large timelines.
- Fixed several right-to-left layout issues across tabs, drawers, resizing, and titlebar interactions, plus shared RTL behavior like directional icons and drawer placement.
- Added early right-to-left layout support across the app and session views, along with locale-aware plural rules for translated counts and summaries.
- Localized more of the desktop UI, including native menus, update dialogs, and help content, and expanded the list of supported desktop languages.
Also Watching: Copilot CLI, Codex CLI, and Gemini CLI
GitHub's Copilot CLI changelog still tops out at v1.0.78 from August 3, with nothing new published since. OpenAI's Codex CLI releases page shows the 0.147.0 alpha series continuing through the night of August 4 with no stable cut yet, so the latest stable build remains 0.146.0 from July 29. Google's Gemini CLI releases page is holding at the v0.53.0 stable release from July 28, with only nightly preview builds since — nothing promoted to stable yet.
Why This Matters
The interesting fix today isn't a feature, it's a boundary getting reinforced: Claude Code's worktree isolation was supposed to keep parallel sessions from touching the main checkout, and 2.1.222 closes the gap where that guarantee didn't fully hold. If you run agents across multiple worktrees with auto-accept or auto mode enabled, this is the kind of patch worth applying promptly rather than waiting for your next scheduled upgrade. Everything else this week is incremental — a sign the fast-moving agent tools are settling into more routine release cadences between the bigger feature drops.
Sources & References
Comments
Share your thoughts and join the conversation