Two Holes in the "Unattended Agent" — How Claude Code v2.1.223 Plugged Workflow Sandbox Escapes and Long-Session Memory Leaks
Claude Code v2.1.223 (August 6) fixes, in one release, a hole that let workflows escape the sandbox via dynamic import() and the memory leaks that had been accumulating in long-running, unattended sessions. Here's a rundown of an update that matters most to anyone running automation.
On August 6, Anthropic released Claude Code version 2.1.223. Alongside a fix that closes a permission-check loophole (part of a broader response we cover separately), this release includes two fixes that matter most when you run agents for long stretches, unattended. One addresses a problem where "a workflow could climb out of its own execution boundary (the sandbox)," and the other where "memory kept ballooning during long-running sessions." Neither is a flashy new feature, but both are especially relevant to anyone running automation via cron or similar.
A workflow could climb out of its own sandbox
Claude Code workflows (dynamic workflows), a mechanism introduced in July, run JavaScript scripts that drive multiple subagents through a defined sequence. By design, these scripts run inside a limited-privilege "sandbox" and cannot reach out to external code or files on their own.
What got closed this time is a loophole where such a script could use import() (dynamic import) to load and execute code living outside the sandbox. Even if the workflow itself runs under restrictions, being able to step outside them via dynamic import hollows out the whole point of the enclosure. In workflows where you run scripts handed to you by others, or ones shared externally, as-is, having that boundary misaligned is itself a risk. v2.1.223 closes this path so scripts stay inside the sandbox.
There are no reported cases of actual exploitation; this is strictly a fix for the fact that "the boundary could be crossed." That said, as running scripts automatically via agents becomes more widespread, this kind of execution-boundary gap is increasingly flagged as "a risk easily overlooked behind the convenience," so closing it early carries real weight.
Memory that grew the longer you ran
The other pillar is a batch of fixes for a bug where memory wasn't released and kept piling up during long-running sessions. Now that keeping an agent running for hours, or operating it headless (no screen) as automation, has become routine, these "memory leaks" had turned into a practical problem you can't ignore. Here are the main spots fixed in v2.1.223.
| What was fixed | What was happening |
|---|---|
| Truncation of MCP tool output | Even when truncated in the display, the full original was kept until the session ended |
| MCP stdio server stderr | Up to 64MB of error output was buffered per server |
| LSP documents | Left open and never freed, growing without limit (changed to a 50-entry LRU scheme) |
| Async hook output | Kept even after being moved to the background |
| Headless / SDK sessions | Memory grew without a ceiling on large tool results |
| Pasted images in the agent screen | Held for as long as the screen stayed alive, even after sending |
Looking down the list — MCP, LSP, hooks, headless — every one of them bites when you run "long, automated, with many tools connected." The headless / SDK session fix in particular directly concerns anything running Claude Code behind the scenes, including unattended auto-posting pipelines like this site.
Operational controls and usability that came along for the ride
Beyond security and memory, the release bundles small improvements aimed at administration and operations.
- Bulk marketplace specification: Added an
owner/*wildcard to admin settings so you can allow/block repositories under a GitHub organization all at once. - Warning on subagent model restrictions: When a model requested by a workflow, a forked skill, or the like is restricted and falls back to running on the parent model, it now warns you accordingly.
- /teleport hint: In cloud sessions, it guides you on using
claude --teleport <session id>to pick up the work locally. - Also fixed: gateway model-detection misses (prefixed IDs such as
vertex_ai/claude-*), sandbox startup failures on Linux, and a bug where forked background agents would "hang mid-resume."
What to do now
The practical guidance from the community boils down to three points (no need for undue alarm — working through them in order is plenty).
- Update every Claude Code entry point that can execute commands to v2.1.223.
- Restart any already long-running sessions once to pick up the fixes.
- Pause unattended workflows until a harmless regression test passes.
Note that 2.1.223 being "the verified minimal fix release" does not mean every prior version was exploitable under every configuration. Calmly updating to match your own operating conditions is enough.
The more autonomy you add, the more boundaries and hygiene matter
Different in nature though they are, these two fixes share the same root. The more you use an agent as "a tool that runs long and unattended" rather than for "short one-off exchanges," the more the boundary that encloses execution (the sandbox) and the hygiene that keeps it running (memory management) become the very foundation of stable operation. They may lack the flash of new features, but on the ground where automation is the premise, it's exactly this kind of update that pays off.
References: Claude Code changelog (official) / Releasebot: Claude Code updates / Claude Code Changelog (August 2026) / Claude Code 2.1.223 regression checklist (DEV Community)
