Claude Code patched three agent-isolation escapes: worktree subagents redirecting git at the shared checkout, and .claude symlinks redirecting writes outside the project

anthropics/claude-code·high signal

Claude Code 2.1.216 fixed worktree-isolated subagents escaping their worktree by passing git -C, --git-dir, or GIT_DIR/GIT_WORK_TREE to reach the shared checkout, and fixed workflow saves and scheduled-task writes following a symlink at .claude to land outside the project. 2.1.217 additionally fixed background session isolation not canonicalizing symlinked working directories, which let sessions escape their workspace folder. If you run parallel agents in worktrees on the assumption that isolation is a hard boundary, it wasn't until these releases — the symlink pattern is the same class as the trust-boundary flaws disclosed across six coding assistants earlier this month.