Agents stop acting on their own

Agents stop running skills without asking

The week's biggest story is Claude Code shifting from autonomous to explicit. With v2.1.215, the /verify and /code-review skills no longer run automatically — Claude will wait for you to invoke them with /verify or /code-review. This is a meaningful change in the agent's default posture: instead of deciding when to test or review code, it now waits for a direct command. The rationale is clear — these skills can be expensive in both time and tokens, and developers wanted control over when they run.

The theme of explicit permission continued across the week's releases. v2.1.214 fixed a permission-check bypass in Windows PowerShell 5.1 sessions, plus a fail-open issue in Bash where file-descriptor redirect forms could circumvent the permission analyzer. That same release also added permission prompts for docker daemon-redirect flags, tightened dir/** allow rules, and fixed an unbounded memory growth issue with oversized settings files.

Forks, worktrees, and screen reader support

v2.1.212 redesigned /fork — it now copies your conversation into a new background session (its own row in claude agents) while you keep working in the original. The old in-session subagent has been renamed to /subtask. The release also added claude auto-mode reset to restore default auto-mode configuration, and fixed a concerning issue where plan mode could auto-run file-modifying Bash commands without a permission prompt or SDK callback.

Security work continued with v2.1.210, which fixed worktree isolation: isolation: 'worktree' subagents could run git-mutating commands against the main repo checkout instead of their own isolated worktree. That's a real isolation failure that could corrupt the primary branch. The same release also fixed the ultracode keyword firing on non-human input.

For accessibility, v2.1.208 added an opt-in screen reader mode (claude --ax-screen-reader) that renders output as plain text. It also fixed multiple memory leaks — MCP stdio server stderr could accumulate up to 64 MB per server, and LSP documents stayed open indefinitely. Earlier in the week, v2.1.211 fixed permission previews that could be visually altered by bidirectional-override and look-alike quote characters, plus parallel sessions all logging out after wake-from-sleep and plugin MCP servers not reconnecting after idle.

Slack plans, ACU-based sizing, and Codex tweaks

Cursor in Slack now shares a plan before starting work, runs in multi-repo environments, and can work across channels and threads. In-message buttons have been replaced by compact footer links. This makes Cursor's Slack integration feel more like a proper collaborator — you see the plan, redirect early, and follow progress as steps update.

Devin moved session t-shirt sizes (XS–XL) to be ACU-only, no longer factoring in user message count. The release also added text quoting (select text from files, worklog, or Devin's messages and quote it in your next message) and session filtering by skill. Admins can now promote playbooks from a single organization to the entire enterprise.

On the Codex side, v0.144.6 refreshed bundled instructions for GPT-5.6 Sol, Terra, and Luna, and fixed their context windows to 272,000 tokens. v0.144.5 expanded dangerous-command detection with more forced rm forms and clearer rejection reasons.