AI Coding News: July 16, 2026 — Claude Code v2.1.211 Closes a Permission-Spoofing Gap, OpenCode Caps Nested Subagents
Today's changelogs from Anthropic, OpenCode, and OpenAI share a common thread: guardrails, not headline features. Claude Code v2.1.211 closes a subtle spoofing gap in its permission-preview UI, OpenCode v1.18.2 stops subagents from recursively spawning more subagents, and Codex CLI v0.144.5 widens its net for dangerous shell commands. None of it is glamorous, but it's exactly the kind of hardening that matters once agentic coding tools are running with real shell and file-system access.
Claude Code v2.1.211: Fixing a Permission-Preview Spoofing Bug
The standout fix in today's build closes a real security gap: permission previews relayed to chat channels (such as Slack integrations) previously failed to neutralize bidirectional-override, zero-width, and look-alike quote characters. That meant a crafted tool input could visually alter what a reviewer sees in the approval message before they click allow — a classic spoofing vector for anyone reviewing agent actions remotely. Version 2.1.211 also fixes auto mode overriding a PreToolUse hook's "ask" decision for unsandboxed Bash commands, so a hook that says "ask the user first" can no longer be silently skipped by auto mode; the decision now correctly floors at a prompt.
The release also adds a new --forward-subagent-text flag (and matching CLAUDE_CODE_FORWARD_SUBAGENT_TEXT environment variable) to include subagent text and thinking in stream-json output, useful for anyone building custom observability on top of Claude Code's agent sessions. Beyond that, it's a large housekeeping release: a prompt-caching billing regression on Bedrock, Vertex, Mantle, and Foundry that charged fresh input-token rates for the trailing system context block on every request is fixed, along with credential-store logout races after wake-from-sleep, MCP servers failing to reconnect after an idle web session wakes, and background agents that were killed by the user auto-respawning and re-running stale prompts.
Fixed nested .claude/rules/*.md files loading even when setting sources exclude project settings.
Fixed subagents spawned with an explicit model override reverting to the parent's model on resume or follow-up.
Changed "always allow" permission rules to save at the repository root, so approvals persist across worktrees and sessions.
Improved background agent result reporting — Claude now waits for real completion instead of fabricating a status for still-running agents.
OpenCode v1.18.2: Subagents Stop Spawning Subagents by Default
OpenCode's latest point release addresses a growing risk in multi-agent workflows: by default, subagents can no longer launch their own nested subagents, closing off a path to uncontrolled recursive fan-out that could balloon token spend or spiral a task out of scope. Teams that need deeper delegation chains can re-enable it with a configurable subagent_depth limit. The release also folds in a batch of Desktop v2 polish carried over from this week's redesign: Meta models get an improved default reasoning depth, Mod+N is now a shortcut for opening a new tab, the Help button is back in release builds, sessions with null archive times stay visible on the home list instead of silently disappearing, and the drawer close button is hidden on Windows where it conflicted with native window chrome.
Codex CLI v0.144.5: Wider Net for Dangerous rm Commands
OpenAI shipped Codex CLI v0.144.5 today, expanding the dangerous-command classifier to catch more forced-deletion forms of rm beyond the obvious rm -rf, and giving users clearer, more specific reasons when a command gets rejected instead of a generic denial. It's a narrow release, but it follows the same pattern as the rest of today's changelog: agentic tools that can execute real shell commands are getting sharper at recognizing the commands that shouldn't run unattended, and better at explaining why when they block one.
Why It Matters
As agentic coding tools move deeper into unattended and background workflows, the risk surface shifts from "did the model write good code" to "can a human trust what the tool is telling them about what it's about to do." Today's three releases all sit on that second question: Claude Code closes a way for tool output to visually spoof an approval prompt and fixes a hook bypass that could let auto mode skip a required confirmation, OpenCode caps runaway subagent recursion before it becomes a cost or scope problem, and Codex CLI tightens its safety net around destructive shell commands. If you review agent permission requests over chat integrations or run unsandboxed Bash through hooks, update to Claude Code v2.1.211 today. OpenCode users on multi-agent setups should grab v1.18.2, and anyone running Codex CLI in automated pipelines should update to v0.144.5 for the improved rm detection.
Sources & Further Reading
Comments
Share your thoughts and join the conversation
Leave a Comment
Keep reading.
Daily Dev Stack Release Audit — July 28, 2026: Redis, MongoDB, and Nuxt Rush Out Critical Security Patches
AI Coding News: July 28, 2026 — Model Context Protocol Ships Its Final 2026-07-28 Spec
