Claude Code made forked subagents the default, and it changed both your bill and your isolation model

Claude Code 2.1.232 shipped August 13 with a default flipped underneath everyone. Subagent forking is now on: a spawned subagent inherits the full parent conversation and shares its prompt-cache prefix instead of starting cold. Nested spawn depth defaults to 3. Practitioner writeups put the input-token saving for children 2..N at up to roughly 90%, because they hit the cached prefix rather than paying to rebuild context from scratch. Source: the Claude Code changelog.

Two consequences, pointing opposite directions.

The economics one is good. Fan-out patterns you rejected as too expensive are worth re-testing. Spawning eight review agents against a diff used to mean paying eight times to load the same repo context. Now child 2 through child 8 hit cache. If you built a serialized pipeline specifically to avoid duplicate context costs, that constraint may have just evaporated. I'm re-running the numbers on my own research fan-out this week.

The isolation one is quieter and worse. Forked children can now see everything the parent saw. If you were spawning subagents partly for context hygiene, to keep a credential-handling agent from reading the conversation where you pasted a secret, or to keep an untrusted-input agent from seeing your architecture discussion, that boundary moved without asking you. Opt out with CLAUDE_CODE_FORK_SUBAGENT=0 or cap depth with CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH=1.

The same release fixed three trust-boundary bugs, per claudeupdates.dev, which tracked 49 changes total. A PowerShell permission bypass where variable-writing parameters could silently overwrite $PSDefaultParameterValues. A Git Bash symlink on Windows bypassing path validation. And nested Git repositories inheriting trust from their parent directory, which means a vendored submodule you never explicitly trusted was being treated as trusted. If you run agents over monorepos, upgrade rather than wait.

Also in 2.1.232: cross-session @ mentions. You can type @ to mention another live Claude session by name and reach it via SendMessage. A bare name matching exactly one live session delivers without a confirmation ref. Sessions on one machine stay uniquely named, with collisions getting a name-word-word variant, and /config now has rows for "Dialog expiry" and whether inbound cross-session messages are accepted, held or refused. Multiple terminal tabs are now an addressable agent mesh with no external message bus.

And GitLab shops got parity: secret redaction for glrt-, gloas-, glptt-, glagent-, glimt- and glsoat- token families, full redaction of routable tokens, glab CLI config store protection matching what gh already had, and plugin marketplaces hostable on GitLab. If you were self-hosting a marketplace mirror as a workaround, drop it.

One line of config is the whole action item here. Set the fork env var explicitly, in whichever direction you want, so the next default flip doesn't decide for you.