Claude Code Flips Subagents From Isolation to Inheritance

Anthropic's Claude Code version 2.1.232 now enables subagent forking by default, allowing forked subagents to inherit the full conversation and prompt cache, reversing the previous isolation model. The change reduces token costs by leveraging prompt caching, but removes input isolation, so sensitive data in the main session flows into forks. The update also makes non-teammate agent spawns run in the background by default and patches three trust-boundary bugs.

AI https://sourcefeed.dev/c/ai Article Claude Code Flips Subagents From Isolation to Inheritance Version 2.1.232 makes forked subagents share your full conversation and prompt cache by default, and patches three trust-boundary bugs. Mariana Souza https://sourcefeed.dev/u/mariana souza When Anthropic first shipped subagents in Claude Code https://claude.com/claude-code , the pitch was isolation: spawn a worker with a fresh context window, let it grind through a search or a refactor, and only its final report lands back in your conversation. Your main context stays clean; the subagent stays ignorant of everything you didn't explicitly tell it. Version 2.1.232 quietly inverts that. Subagent forking is now on by default — a forked subagent inherits your entire conversation, plus your prompt cache, and runs in the background. Non-teammate agent spawns in interactive sessions go to the background by default too. It reads like a patch note. It's actually a philosophical reversal, and if you've built workflows on the old assumptions, some of them just changed underneath you. Why isolation lost The original subagent contract had a hidden cost that got worse as the product matured: re-briefing. A fresh-context subagent knows nothing — not the bug you've been chasing for an hour, not the constraints you established six messages ago, not the file you just read. So either the orchestrating agent writes a long, lossy prompt re-explaining everything, or the subagent burns tool calls rediscovering it. Both waste tokens and, worse, both lose fidelity. Prompt caching flipped the economics the rest of the way. Per Anthropic's subagent docs https://code.claude.com/docs/en/sub-agents , a fork's system prompt and tool definitions are byte-identical to the parent's, so its first request reuses the parent's cache. Cache reads bill at roughly a tenth of normal input pricing, which means a fork that nominally carries a 200k-token conversation costs closer to a 20k-token request on its first turn. A clean-room subagent, by contrast, starts a separate cache cold and pays full freight to be told less. Once you see that math, inheritance-by-default is the obvious call: the "expensive" option carrying everything is actually the cheap one, and the "lean" option fresh context is the one that costs you. Anthropic isn't alone in landing here. The multi-agent frameworks that work in practice — as opposed to the ones that demo well — keep converging on cheap context sharing over elaborate message-passing protocols. Forking a cached conversation is about the least ceremonious version of that idea. What actually changes in your workflow If you're on 2.1.232 or later, three behavioral shifts matter: Forks see everything. A fork gets the same system prompt, tools, model, and full message history as your main session. That's the feature — you can hand off a side task without re-explaining anything, or launch several forks to try competing approaches from the same starting point. It's also the caveat: anything sitting in your conversation — a pasted .env you shouldn't have pasted, client data, that half-finished rant in a comment — flows into every fork. The old subagent model gave you input isolation for free. Forks deliberately drop it. Named subagents defined in .claude/agents/ still start fresh from their own definition files, so if you built a subagent specifically as a clean-room reviewer that shouldn't be biased by your conversation, verify you're invoking it as a typed subagent and not getting a fork. Note the model pinning differs too: a fork always runs the parent's model, so "cheap Haiku worker" setups only work through named subagents. Background is the new foreground. Interactive spawns of non-teammate agents now run in the background by default, and Claude can't ask for the foreground. Tool calls stay out of your transcript and only the final result comes back — good for context hygiene, but permission prompts from background agents surface in your main session, and workflows that assumed a subagent blocks the conversation until it finishes no longer behave that way. If your muscle memory is "spawn agent, watch it work," retrain it to "spawn agent, keep working, get notified." Session routing got real names. You can now @ -mention another live Claude session by name, and SendMessage delivers to a bare name when exactly one live session matches; interactive sessions keep unique name-word-word variants to avoid collisions. Combined with default forking, Claude Code is now less a CLI tool with a helper feature and more a small multi-agent runtime — sessions that spawn, message, and background each other. That's clearly where this is heading. The security fixes deserve more attention than the forking Buried under the headline feature, 2.1.232 closes three genuine trust-boundary holes, per the official changelog https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md : a PowerShell permission bypass via variable-writing parameters, a Windows bypass where Git Bash followed Cygwin-style symlinks around path restrictions, and — the one that bites cross-platform — nested git repositories no longer inherit trust from their parent directory. That last one means trusting ~/work no longer implicitly trusts a repo you cloned into ~/work/vendor/something-sketchy . If your team vendors third-party repos inside trusted workspaces, you'll see new trust prompts after upgrading. Answer them deliberately; that prompt is the fix working. The Windows hardening continued in 2.1.233, which patched NT device paths bypassing UNC validation — an NTLM credential leak. Windows-heavy teams should not linger on old versions. Two reliability fixes round it out: MCP connections no longer hang when a protocol-version probe fails, and Remote Control sessions no longer appear unreachable while idle. Neither is glamorous; both were the kind of intermittent failure that erodes trust in agent infrastructure faster than any missing feature. The verdict This is a real shift, not changelog noise — but it's a shift in defaults , and defaults are where production agent workflows quietly break. The upgrade itself is worth taking: the fork economics are strictly better for the common case, and the security fixes are non-optional. The work is in re-verifying assumptions. Spend twenty minutes after upgrading: spawn a fork and confirm what context it actually holds, check that your named subagents still start clean, re-answer the nested-repo trust prompts on purpose, and if anything sensitive lives in a long-running session's history, remember that every fork of that session inherits it. Isolation used to be the default you got for free. Now it's a choice you have to make. Sources & further reading - Claude Code Changelog v2.1.232 https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md — github.com - Create custom subagents - Claude Code Docs https://code.claude.com/docs/en/sub-agents — code.claude.com - Claude Code 2.1.232: Six Regression Checks That Matter https://dev.to/yan gao 3ad90a90b26925538/claude-code-21232-six-regression-checks-that-matter-4bna — dev.to Mariana Souza https://sourcefeed.dev/u/mariana souza · Senior Editor Mariana covers the fast-moving world of machine learning and generative AI, with a particular focus on how these technologies are reshaping development workflows. When she isn't stress-testing the latest foundation models, she's usually at a local hackathon. Discussion 0 No comments yet Be the first to weigh in.