The story in this week's Claude Code releases isn't a feature, it's an admission. Three separate fixes across 2.1.210 and 2.1.211 all patch the same class of bug: your guardrail made a decision and the runtime quietly ignored it. Auto mode was overriding a hook's ask. Relayed permission previews rendered tool inputs that could visually rewrite the approval message you were reading. The Agent tool trusted content a subagent read. If you wrote PreToolUse hooks as your safety net any time before this week, they were not the floor you thought they were. Go re-test them against your own destructive commands today, on 2.1.211, and don't take last month's passing test as evidence.

• Claude Code 2.1.211 (July 15) makes a PreToolUse hook's ask decision a floor that auto mode can no longer override for unsandboxed Bash [1].
• 2.1.211 neutralizes bidirectional-override, zero-width, and look-alike quote characters in permission previews relayed to chat channels, closing a spoofing path where tool inputs altered the approval text [1].
• 2.1.210 (July 14) hardens the Agent tool against indirect prompt injection through content a subagent read [1].
• 2.1.210 fixes isolation: 'worktree' subagents running git-mutating commands against the main checkout instead of their own worktree [1].
• 2.1.211 fixes a prompt-caching regression on Bedrock, Vertex, Mantle, and Foundry that billed trailing system context as fresh input tokens on every request [1].
• Anthropic shipped Claude for Teachers, free for verified US K-12 educators [2][3].
• No MCP protocol news in the window. The 2026-07-28 stateless spec is frozen at RC and goes stable in twelve days [4].

The ask fix is the one that matters. Previously auto mode could promote past a hook that asked for a prompt on unsandboxed Bash. Also in this release: subagents with an explicit model override no longer revert to the parent's model on resume, and --forward-subagent-text now surfaces subagent text and thinking in stream-json output. 1

Agent tool hardened against indirect prompt injection via subagent-read content. Worktree isolation now actually isolates git writes. Hook callback timeouts no longer get misreported to the model as user rejections, which was stalling unattended sessions. 1

Free premium access for verified US K-12 educators, with teaching skills and curriculum connections aligned to standards in all 50 states. Product launch, not a capability change. 2 3

No protocol releases, spec posts, or official server announcements dated July 14 to 16. The live item is the freeze: the 2026-07-28 revision goes stateless, drops the initialize handshake, and adds Tasks and MCP Apps. Beta SDKs are out (Python 2.0.0b1, Go 1.7.0-pre.1, C# 2.0.0-preview.1, TypeScript v2 beta) and stable lands July 28. 4 5

Two related Claude Code fixes in 2.1.211: plugin MCP servers now reconnect after an idle web session wakes, and Vertex/Bedrock stop printing a spurious fallback notice at startup. 1

Nothing today.

• Update to 2.1.211 and re-run your hook tests. A hook that passed on 2.1.209 may have been passing for the wrong reason.
• If you relay permission prompts into Slack or Telegram, the pre-2.1.211 preview was spoofable. Treat any approval granted through that path before this week as unverified.
• If you bill through Bedrock, Vertex, Mantle, or Foundry, check your input-token line against last week. The caching regression was charging trailing system context as fresh on every request.
• Pin your MCP SDK versions now. Twelve days to a stateless protocol with no initialize handshake, and the betas warn that public APIs may still move.

1. https://code.claude.com/docs/en/changelog 2. https://www.anthropic.com/news 3. https://thehill.com/policy/technology/5968601-claude-for-teachers-launch/ 4. https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/ 5. https://blog.modelcontextprotocol.io/posts/sdk-betas-2026-07-28/