Resume It and It Forgets Its Orders, Reverting to a "Default Stranger"—How Claude Code v2.1.216 Plugged the Handoff Leaks

On July 20, Anthropic released v2.1.216 of Claude Code. There's no headline feature to speak of. But line up the changes and a single theme emerges: "Once you let go of an agent, does it come back with the constraints you intended?" This release plugs, all at once, the leaks that had been cropping up during "handoffs"—resuming, backgrounding, and worktree isolation.

The moment you resumed, it forgot its instructions and reverted to "default"

This release includes several fixes for bugs where a delegated agent turns into something else across a handoff. These matter most in unattended, parallel operation.

• Persona reverting on resume: Resuming the session of an agent parked in the background would lose the agent definition you had specified and fall back to the default agent. This is fixed so that the prompt and tool restrictions are restored.
• Reaching outside the worktree: A subagent isolated in a worktree could use git -C, --git-dir, or environment variables to operate on Git outside its isolation boundary—that path has been closed off.
• Sessions you can't stop or delete: Cleanup bugs were also fixed, such as background sessions in a directory with no Git repository being impossible to delete, and sessions parked with ← or /background living on indefinitely.

All of these are about "safely letting go and wrapping up" rather than "getting things running." Precisely because it has become normal to run many agents side by side and keep them going while you step away, the boundaries of the handoff are where things start to unravel.

What that "few seconds of silence" in long sessions really is

The performance fix is the one that pays off steadily in real use. The longer a conversation ran, the more the cost of formatting messages grew—as the square of the turn count—inserting a pause of several seconds before responses. v2.1.216 resolves this.

The more long-running work you hand to an autonomous agent, the more turns pile up. Even at a few seconds each, in unattended operation that time was quietly accumulating as wait. It isn't flashy, but it's a fix that changes how long-running jobs feel.

What it means to add a switch that "deliberately turns off" isolation

The new setting sandbox.filesystem.disabled turns off only the filesystem isolation of the sandbox while keeping the outbound network (egress) controls in place. The two layers of defense can now be enabled selectively, one at a time, depending on your use case.

It's handy when local file restrictions get in your way. But flip it around, and with file isolation off, egress control is the only wall left. Since this is a setting where you yourself remove the layer that narrows the range of files an agent can read and write, you could argue it's risky unless you keep its use to a limited scope and maintain a strict egress allowlist. When you strip away a defensive layer for the sake of convenience, this is a setting where you want to be conscious of what you're leaving as the last line of defense.

The backdrop to these accumulating small permission fixes

Beyond these, there's a lineup of small permission-related fixes: permission checks for Bash commands involving compound commands and redirects, reads to Windows network paths, and the auto-mode behavior of wrongly treating an HTTP 401 after an auth token expires as a command denial. These are a continuation of the work carried over from the surrounding versions—making auto mode's "checkpoint" effective without gaps.

On their own they're a collection of unremarkable fixes, but the direction is consistent. The more you widen the scope of what you delegate to an agent, the more whether that delegate keeps acting within the intended constraints becomes the condition for trust. v2.1.216 isn't a new feature; it's a release that re-tightens the foundation that supports that trust.

References: Claude Code changelog (official) / Releasebot: Claude Code updates / Claude Code Docs: Sandboxing / Being Shivam: Claude Code 2.1.216 analysis