Claude Code Just Patched Its Credential Leak — And Made Sessions Talk Across Machines

Claude Code v2.1.234 dropped today (August 17, 2026) with a changelog that reads like a greatest-hits album: a critical Windows security hardening, cross-machine agent messaging, GitLab merge-request awareness, and automatic session resume when your usage limit resets. If you code on Windows, run multiple Claude sessions, or use GitLab, this isn’t just another patch — it changes how you work.

The Headline: Windows NTLM Credential Leak — Fixed

The vulnerability: Windows NT-namespace paths (\\?\ and \\.\) could bypass file-access guards in auto-mode, letting a malicious prompt trick Claude into reading files that expose NTLM credential hashes. An attacker who captured those hashes could relay them to authenticate as you on other services.

The fix: v2.1.234 rejects all NT-namespace paths across the board — remote file reads, session restore, CLAUDE.md includes, workflow scripts, and file uploads. The pre-approval file-access checks now harden the remaining surface against this vector.

Why this matters: This isn’t theoretical. NTLM relay attacks are a staple of Windows penetration testing. If you run Claude Code on Windows with auto-mode enabled, updating to v2.1.234 closes a genuine credential-theft path.

What to do: Run claude update (or winget upgrade Anthropic.ClaudeCode / brew upgrade claude-code) immediately. No config changes needed — the protection is automatic.

Cross-Session Messaging: Agents That Talk to Each Other

The flagship feature in this release is SendMessage and ListAgents — your Claude Code sessions can now discover and message each other, across any of your machines (macOS and Linux today, Windows coming).

How it works

# In session A (your main machine)
> /agents
# Lists all your active sessions with names like "frontend-refactor", "api-debug"

> /send frontend-refactor "Hey, the API contract changed — user endpoint now returns { id, email, role }"

Real-world workflows this unlocks

The kicker: Messages survive session compaction. Your “frontend-refactor” agent can receive a message, compact its conversation, and still act on the context — because the message lands in the new transcript.

Limitations to know

• macOS/Linux only for now (Windows support in progress)
• Requires authenticated gh CLI for GitHub-hosted sessions
• Session names capped at 200 characters (emoji-heavy names may hit this)
• Cross-machine needs same claude.ai account on both devices

GitLab Merge Requests in Your Statusline

If your repo has a GitLab remote and you’ve authenticated glab CLI, Claude Code now shows MR badges in the footer and statusline:

!42 ✓    # Green = merged
!43 ●    # Blue = open, pipeline passing
!44 ⚠    # Yellow = draft or pipeline pending
!45 ✗    # Red = pipeline failed

No more context-switching to the browser to check MR status. The badge updates in real-time as pipelines run.

Setup: glab auth login once. Claude detects the remote automatically.

Auto-Resume When Usage Limits Reset

Ever hit your claude.ai usage limit mid-flow, walk away, come back hours later, and have to manually restart? Fixed.

Claude Code now continues your session automatically when the limit resets. You’ll see a brief “Resuming…” notice, then pick up exactly where you left off — same transcript, same permissions, same model.

Don’t want this? Toggle it off in /config → “Continue automatically at usage limit.”

Email Privacy: Your Address Stays Yours

A subtle but important change: Claude is now instructed to use your account email only to identify you — not to send it to unrelated services unless you explicitly ask. This closes a vector where model outputs could inadvertently leak your email in generated code, configs, or documentation.

Quality-of-Life Fixes You’ll Actually Notice

Mid-turn command palette

/permissions, /add-dir, /autocompact, /theme, /help, /config, /advisor — all now open while Claude is working. Changes apply to the rest of the current turn. No more waiting for the agent to finish before adjusting rules.

Transcript renders your markdown too

Your prompts now render with syntax highlighting, inline code, lists — same as replies. Makes reviewing long sessions dramatically easier.

claude-api skill: 200k → 25k context tokens

The built-in skill now loads reference docs on demand instead of stuffing 200k+ tokens into every context. Massive savings for long-running sessions.

Auto-mode fixes that stopped being annoying

• Long sessions: No more repeated re-checking/denying sandboxed command network access after compaction
• Permission answers: Session-scoped allows/denies no longer drop when background subagents prompt
• Queued shell commands: Fixed the bug where up-arrow editing a queued ! command sent it to the model as plain text
• /tui restarts: Now preserves --allowed-tools/--disallowed-tools rules (and refuses to switch if restrictions can’t carry over)

Remote Control: Cross-device sync that works

• Account switch detection: Signing into a different claude.ai account stops the session in seconds with a clear message — no more mysterious HTTP 404 hours later
• Effort sync: Effort level picked on phone/claude.ai/code now applies to terminal/Desktop/VS Code sessions
• Permission mode sync: Remote Control sessions keep all clients updated on permission mode and model changes

The Full Changelog (Condensed)

Security

• NT-namespace (\\?\) path rejection across all pre-approval file accesses
• MCP diagnostics no longer print resolved secrets (scope conflicts show ${VAR} form only)
• Credential masking on permission previews can’t hide commands/paths/destinations
• Provider API tokens mask even when followed by shell delimiters

Cross-session messaging

• SendMessage / ListAgents for inter-session communication (macOS/Linux)
• Messages survive compaction, delivered via <system-reminder> tags

GitLab integration

• MR badge in footer/statusline with draft/pending/green states
• Requires authenticated glab CLI

Auto-resume

• Automatic session continuation at usage-limit reset (configurable in /config)

Email privacy

• Model instructed to use email only for identification

Bug fixes (selected)

• Markdown rendering slowdown from unusual Unicode sequences fixed
• SendMessage recipient copy from ListAgents works at 200-char/emoji caps
• Repo detection fixed for git remotes with unusual userinfo
• strictKnownMarketplaces allowlists fixed for SCP-style git sources
• Modal text (OAuth URLs) no longer loses characters when copied in fullscreen
• Horizontal rules in markdown no longer run into following line
• Consecutive shell commands with interleaved todo updates group correctly
• Dialogs opened during ! commands no longer dismiss when command finishes
• Queued messages don’t reappear in prompt history while still queued
• Fullscreen renderer prompt no longer restarts session without permission mode/rules/model/effort
• Trust prompts include repository-wide scope warning
• IDE diff tab closing during permission re-prompt no longer answers with previous input
• Files sent during Remote Control now upload properly (open on phone/web)
• Stale-token reminder after /login no longer leaks into Claude’s turn
• Permission previews relay only to admitted channel servers
• Expired Anthropic profile credential points to /login
• API error messages now include content type, body kind, size, request ID
• Auto-generated session titles read as short names (“Login button bug” not “Fix the login button on mobile”)
• /permissions openable mid-turn; rule changes apply immediately
• /add-dir usable mid-turn
• /goal clears on unrecoverable errors (revoked auth, exhausted credits, context overflow)
• /goal check-in after 30+ min background task wait (configurable via CLAUDE_CODE_GOAL_CHECKIN_MINUTES)
• claude setup-token rejects unexpected args
• Esc in fullscreen no longer clears mouse selection
• Removed redundant “Allowed by auto mode classifier” line
• Removed “Default teammate model” setting — teammates use leader’s model
• Dimmed elapsed-time counter on running tool header
• Background task notifications between turns delivered in <system-reminder> tags
• Mantle skips admin-pin probe when main-loop model already picked
• Windows startup no longer stalls on read-only ~/.claude.json rename retries

Should You Update? Yes.

Update command:

claude update
# or
winget upgrade Anthropic.ClaudeCode
# or
brew upgrade claude-code

What’s Next: v0.21.0 Will Curate the Full Story

The release notes note: “Full curated release notes for this window will ship with v0.21.0, which will document everything from v0.20.0 onward — highlights, feature areas, and complete contributor credits.”

Translation: v2.1.234 is a stability/security patch drop. The next minor (v0.21.0) will bring the curated narrative. But the security fix alone makes today’s update non-optional for Windows users.

TL;DR

• Windows users: Update now — NTLM credential leak vector closed
• Multi-session/multi-machine folks: SendMessage + ListAgents is live (macOS/Linux)
• GitLab users: MR badges in statusline via glab auth login
• Everyone: Auto-resume at usage limit, mid-turn commands, better transcripts, 8x context savings on claude-api skill
• Update: claude update — zero config changes needed

Related articles

• Claude Code Alternatives in 2026: 12 Options Compared
• Beware: Hermes Agent Security Audit Uncovers Credential Bypass, Sandbox Escape, and Session Hijacking in 5 HIGH-Severity Findings
• Oh My Pi v17.3.3 Fixes Gemini Reasoning Loops, Hashline Edge Cases, and TUI Rendering — What Beginners Need to Know

Found this useful? Share it with your team. Running into issues with the update? Drop a comment — I’ll track follow-ups in the next post.

Updated August 18, 2026: Added clarification on Windows cross-session messaging timeline.