Anthropic shipped Claude Code v2.1.224 on August 7, 2026 — the first release built on top of last week’s v2.1.223 permission-bypass fixes. If v2.1.219 was the model update (Opus 5 as default) and v2.1.223 was the security hardening, v2.1.224 is the one that changes where Claude Code runs and who it can talk to: you can now run sessions on your own machines, let sessions message each other across your fleet, and keep JWT and AWS credentials out of your logs while sandboxed commands still work.
It also quietly fixes a sandbox escape that security researchers had been warning about. Here is what changed, in plain language.
Run Claude Code on machines you control
The headline feature is claude self-hosted-runner. Up to now, Claude Code web, mobile, and desktop sessions mostly ran on Anthropic’s infrastructure — you interacted through their cloud sandboxes. v2.1.224 (Team and Enterprise plans) lets you turn your own machines or containers into runners where those sessions execute.
Think of a runner as a worker that says “I’m available — send sessions here.” You point it at hardware you own (a beefy dev box, a VM in your VPC, a CI runner), and Claude Code web, mobile, and desktop sessions run there instead of in someone else’s cloud. Your code, your credentials, and your network stay inside your boundary.
For a beginner the mental model is simple: the conversation UI is separate from the machine doing the work. This is the same pattern as self-hosted GitHub Actions runners or self-hosted VS Code — and it is the pattern enterprises need before they will let an agent near production code.
Sessions that message each other (safely)
The second big feature is cross-session SendMessage. Claude Code sessions can now send messages to other Claude Code sessions — on any of your machines — and discover them with ListAgents (macOS and Linux for now).
Why would you want that? A few realistic patterns:
- A long-running session on your server finishes a build and messages your laptop session with the result.
- An orchestrator session delegates a task to a worker session on another machine and collects the answer.
- A review session asks a coding session “did you touch
auth.ts?” before approving.
Anthropic built a guardrail into the messaging, and beginners should know it: messages sent to a session that is running with bypassed permissions are held for your approval instead of being delivered silently. That’s the crossSessionInbound and dialogExpiry settings — the defaults mean a remote agent cannot quietly execute something on an unlocked session. You review, then it lands.
Install plugins from a plain zip
Plugins in Claude Code used to come from git repos or npm packages. v2.1.224 adds an archive plugin source: you can install a plugin from a zip file served over HTTPS, no git or npm involved.
For teams that want to hand out internal tools without a package registry, this is the fast path. The important part for safety: you can pin the zip by SHA-256 hash, so Claude Code verifies the file it downloads is exactly the file you approved — a supply-chain guard that matters more every quarter. If you are just starting out, prefer plugins with a pinned hash; it is a two-line setting and it removes an entire class of “the download was swapped” attacks.
Secrets stay out of your logs
Sandboxed commands get a serious credential-masking upgrade:
- JWT-aware masking — with
decode: "jwt"andmaskClaims, Claude Code recognizes JWT-shaped secrets in output and masks the claims you choose, instead of blurring the whole token. - AWS SigV4 re-signing — with
awsPairs/sigv4, requests are re-signed so real AWS credentials never appear in plaintext in the sandbox. - Structured env extraction —
extract/onExtractNoMatchlet you pull credentials out of structured values (JSON configs, env files) and mask them too.
Why beginners should care: the classic failure mode is an agent that prints AWS_SECRET_ACCESS_KEY=... into a log or a transcript, and now that secret is out in the world. These options (which require network.tlsTerminate and are honored only from user, managed, or --settings settings — so a project file cannot sneak them in) make “the agent saw my keys” much less likely to become “the agent leaked my keys.”
Fixes worth knowing about
Two fixes deserve attention beyond the features:
- Sandbox deny bypass closed. Filesystem deny entries written with a trailing slash — like
denyRead: "~/.aws/"— could be silently bypassed on Linux and macOS. That is exactly the kind of bug where you think a folder is blocked and it is not. v2.1.224 fixes the bypass so a deny with a trailing slash actually denies. If you run Claude Code with a sandbox config, re-test your deny rules after updating — this is the fix that makes the rules real. - Project-path collision fixed. Project paths longer than 200 characters could resolve to another project’s session directory when they shared a sanitized prefix. Sessions, renames, forks, deletes, and
/resumeno longer cross project boundaries — important if you work in deep monorepos with long paths.
Also fixed: sandbox violation details now actually appear in Bash tool results (so you can see why a command was blocked), MCP tools that connect mid-turn are announced to the model instead of silently deferred, and plugin install records no longer get corrupted when the same plugin is installed in multiple projects.
For AWS users, ANTHROPIC_BEDROCK_REGION_PREFIX lets you prefer a specific cross-region inference profile instead of whatever AWS_REGION implies.
What landed a day later: v2.1.225 and v2.1.226
Anthropic followed v2.1.224 within 24 hours with v2.1.225 (August 8) and then v2.1.226 (bug fixes and reliability improvements). The follow-ups don’t add headline features, but they fix the sharp edges of the new release — and two of them change how the previous sections behave in practice.
Gateway spend limits now show up in Claude Code’s usage warnings. If you run Claude Code through the agent gateway, the “limit reached” message now names the actual cap, when it resets, and any message your operator attached. For teams, this turns an anonymous “you’re out” into actionable info. (The gateway itself needs to be on 2.1.225 for this to work.)
claude agents now asks before trusting an untrusted directory. Previously the workspace trust prompt applied to claude but not to claude agents; v2.1.225 makes the behavior match. If you spin up agents in downloaded or cloned directories, you’ll see the same “trust this folder?” gate as a normal session.
Two OAuth fixes matter for automation. A transient 401 could replace your long-lived CLAUDE_CODE_OAUTH_TOKEN with a short-lived token from a stored login — silently breaking headless sessions until restart. That’s fixed. And MCP OAuth servers on macOS would intermittently burst 401s, “as if never authenticated,” after a keychain read timed out — also fixed. If your CI or background sessions used to die mysteriously, update and re-test.
Auto mode stops counting its own permission refusals. v2.1.224’s auto mode counted a safety-filter refusal of its own permission check toward the consecutive-block limit — the action was still denied, but the model was told to retry instead of move on. v2.1.225 fixes the accounting so a denied action ends the loop cleanly.
Cross-session messaging gets the polish it needed. Messages sent to headless sessions (or during startup) no longer sit parked without a notice or expiry, and SendMessage can now start a conversation with your Remote Control sessions on other machines by name instead of only replying after they message you first. There’s also a guard so a Remote Control recipient you already confirmed is never silently swapped for a same-named session on the current machine.
Self-hosted runner failure mode fixed. If claude self-hosted-runner couldn’t create or write its --base-dir, it used to register and then fail every session. It now exits at startup with a clear error — annoying, but diagnosable.
Other fixes worth knowing: conversation history no longer breaks on Remote Control session resume after very large conversations were compacted; hovering a session in another project no longer changes the directory the next agent starts in; web sessions are no longer misreported as stuck (which re-sent a growing event backlog on every reconnect); and in VS Code, the Focus view no longer folds away the latest to-do list or a pending question’s context.
The practical takeaway: if you adopted v2.1.224 for self-hosted runners or cross-session messaging, update to v2.1.225 before relying on it in CI — the OAuth, headless-message, and runner --base-dir fixes are exactly the kind of bugs that only show up in automation. And if your gateway enforces spend limits, the new warning text tells you the cap, reset time, and who to ask.
What landed August 10–11: v2.1.227 and v2.1.228
Anthropic shipped v2.1.227 on August 10 and v2.1.228 on August 11. v2.1.227 is mostly reliability fixes — the notable one being that every Bash command failing under claude-code-action with allowed_non_write_users on GitHub-hosted runners is now fixed, so CI workflows that use GitHub Actions should work again.
v2.1.228 is the security story. Here is what changed and why it matters:
Skills from claude.ai can no longer hijack your session
If you use the Claude Code marketplace (claude.ai skill sync), this is the single most important change: synced skills now cannot shadow your local commands or MCP prompts. Before v2.1.228, a skill installed from the marketplace could define a command with the same name as one of your local commands or MCP tools — and silently override it. Your agent would run the marketplace version instead of yours, without warning.
That is a supply-chain attack vector: a malicious or compromised skill could define a build or deploy command that does something different from what you expect. v2.1.228 closes the door:
- No more shadowing. Marketplace skills cannot define commands or MCP prompts that have the same name as local ones.
- Descriptions are sanitized. Skill descriptions are cleaned and labeled so they cannot mislead the model about what a tool does.
- Bodies are restricted. Synced skill bodies are no longer allowed to run
!(shell) commands or expand@(file) references on your machine.
For a beginner: imagine installing a plugin from an app store, and that plugin quietly replacing your local npm test with its own version. That was possible before v2.1.228. It is not anymore.
Write tool changes: newer models overwrite without reading first
The Write tool now lets newer models overwrite an existing file they haven’t read during the current session — the same permission the Edit tool has always had. Older models still require a read first. This is a quality-of-life change that speeds up batch file operations: the agent no longer needs to read a file just to overwrite it entirely.
If you rely on the safety net of “the agent must read before writing” to catch bad overwrites, be aware that this net is now thinner for newer models. Your sandbox deny rules still apply.
Other fixes worth noting
- Windows Git Bash detection fixed. Claude Code launched from a parent folder of the git installation now finds
gitcorrectly. If you are on Windows and Claude Code used to claim git was not installed when it was, this is the fix. - Session cleanup no longer nukes your project memory. A bug caused cleanup to delete contents inside a project’s
.claude/memory/folder. That is now fixed. - Vertex AI credentials fail fast. Expired or missing Google Cloud credentials now produce an immediate error instead of retrying for minutes. Saves time and avoids confusing timeout messages.
- Cross-session messages display inline. Instead of a collapsed one-liner, you now see the sender and body directly in the conversation — and Remote Control sessions on other machines show the session name as the sender.
- Compaction is less opaque. The retry countdown and stall hint now appear during compaction instead of only a progress bar, so you know whether it is working or stuck.
Getting started
Update and check your version:
npm update -g @anthropic-ai/claude-code
claude --version # should report 2.1.228 or laterThen try the new pieces in order:
# 1. See what self-hosted runners involve (Team/Enterprise)
claude self-hosted-runner --help
# 2. Install a plugin from a zip with a pinned hash
claude plugin install https://example.com/plugin.zip --source archive --sha256 <hash>
# 3. Check cross-session messaging is available on your platform
claude --help | grep -i sendmessageIf you use sandbox deny rules, this is the release to re-test them on — the trailing-slash fix changes behavior you may have been relying on (or wrongly trusting).
The bottom line
v2.1.224 is a “where does the work happen” release: self-hosted runners for the enterprise, cross-session messaging for multi-agent workflows, zip plugins for distribution, and a real security pass on credentials and sandbox denies. v2.1.225–226 polished the rough edges. And v2.1.228 closes a supply-chain gap that let marketplace skills shadow your local commands — if you use skill sync, update today. For a beginner, the two things to remember are the approval gate on cross-session messages (remote agents cannot run wild on unlocked sessions), the skill shadowing fix (marketplace skills can no longer override your local commands), and re-validating your deny rules after updating.
Looking to compare AI models without switching tabs? aiFiesta gives you GPT, Claude, Gemini, Grok, DeepSeek, and Perplexity in one place for $12/mo.