Anthropic.com
Developers running extended agentic workflows in Claude Code had been hitting a wall they probably blamed on everything except the right cause: a normalization bug that made sessions get quadratically slower with every turn, not linearly slower. The update that landed July 20 — Claude Code v2.1.216 — fixed it. The fix matters most precisely for the users Anthropic is most trying to grow: the developers running 50- and 100-turn auto mode sessions who invest the most in the tool and were being penalized the most for it.
That bug, the release’s most practically significant fix for power users, arrived alongside a new sandbox.filesystem.disabled configuration option, a correction for OAuth token rotations that were surfacing as false permission denials, and a set of agent session-restore improvements. The release also landed in the middle of a stretch of platform disruptions — at least six separate incidents between July 16 and July 22 — that complicated its rollout and have become a recurring friction point for enterprise teams using Claude Code as daily infrastructure.
How Quadratic Cost Turned Long Sessions Into Stall Machines
Before each API call, Claude Code runs a message normalization step over the entire conversation history. The purpose of this step is to standardize message format before the request goes out. The bug was in how this step was implemented: its computational cost grew not linearly with session length, but quadratically — meaning each doubling of session length quadrupled the normalization cost, not doubled it.
The practical consequence is easier to grasp with numbers. In computer science terms, a linear algorithm (O(n)) running on a 50-turn session takes 50 units of work. The quadratic version (O(n²)) runs on the same session at 2,500 units — a 50-fold difference between what the fix costs and what the bug cost. For developers accumulating dozens of turns on large refactors or multi-file edits, the degradation was geometric and invisible: no error, no warning, just multi-second stalls before each API call that were easy to write off as network lag or system load. The fix restructures the normalization to a single linear scan, making performance independent of how many turns have accumulated.
Auto mode is the context that makes this fix disproportionately important. The feature, which became generally available to all Claude Code users on July 10, 2026, runs sessions without requiring per-step human confirmation: a background AI classifier evaluates each pending file write, shell command, or network call and decides autonomously whether to proceed. Sessions in auto mode naturally accumulate far more turns than supervised interactive sessions. The developers who invested most in this autonomous workflow — the users Anthropic is most actively trying to attract — were the ones encountering the quadratic penalty at its worst.
What sandbox.filesystem.disabled Actually Trades Away
The new sandbox.filesystem.disabled setting lets operators disable Claude Code’s filesystem isolation layer while keeping network egress controls intact, as documented in the v2.1.216 changelog. Understanding what this option does — and what it gives up — requires knowing how the isolation layer works.
Claude Code’s sandbox intercepts file operations at the system level, enforcing path allow-lists and deny-lists before any write actually reaches disk. This interception is what lets Claude Code confine its work to a project directory and refuse writes to arbitrary paths outside it. Some build toolchains conflict with this interception mechanism: they depend on specific temp directory paths, file descriptor behaviors, or symlink resolution patterns that the interceptor disrupts. For teams that hit this compatibility issue, filesystem isolation has been an obstacle rather than a protection.
sandbox.filesystem.disabled is the escape hatch. With it set, Claude Code can write to any path the current user has permission to reach, including paths outside the project directory. Network-level egress controls — implemented through a separate mechanism — remain active regardless. Anthropic’s documentation frames this as an advanced-user option, not a recommended default, and the framing is accurate: disabling filesystem isolation removes a meaningful safety layer in exchange for compatibility with constrained build environments. The right posture is to enable it deliberately, for a specific known reason, rather than as a general troubleshooting step.
OAuth Tokens Were Generating False Permission Denials
One fix in v2.1.216 that deserves specific attention for teams running long Claude Code sessions: a class of authentication failures documented in the v2.1.216 changelog that were surfacing as apparent safety decisions.
OAuth 2.0 access tokens expire and rotate during long-running sessions. When rotation happened mid-session, the outgoing API request carried a stale token and received an HTTP 401 Unauthorized response. Claude Code’s internal auto mode classifier was receiving these 401 errors and surfacing them as permission denials — making it appear that Claude had decided not to execute a command for intent or safety reasons, when the actual cause was a stale credential. The fix routes token rotation events to authentication handling rather than letting them propagate to the classifier as refusals. Developers who observed Claude Code declining commands in long sessions without a clear safety rationale may have been encountering this bug rather than a genuine permission decision.
Agent Sessions Were Resuming With the Wrong Scope
Beyond the performance and authentication fixes, v2.1.216 addressed a category of failure relevant to production multi-agent workflows: what an agent’s permission scope looks like after crossing a session boundary, as captured in the release notes.
Background agent sessions that were resumed were reverting to the default agent configuration rather than restoring the original setup — losing the custom prompts and tool restrictions that defined the agent’s intended scope. A subagent launched with a narrow role could resume as the full default agent, with a broader permission set than the original role had been granted. The fix restores the agent’s original prompt and tool restrictions on resume from the saved session state. For teams running scoped subagents in parallel — a common pattern in workflows that delegate subtasks to specialized agents — the previous behavior was a hard-to-diagnose risk: the agent appeared continuous because it retained its context, while its authorization scope had silently expanded at the lifecycle boundary.
A related hardening pass closed a similar gap in worktree isolation: subagents running in isolated worktrees could previously redirect git operations into the shared checkout by passing flags like –git-dir or setting environment variables like GIT_DIR and GIT_WORK_TREE, as detailed in the release notes. The isolation boundary now enforces against these flag-based overrides.
A Stable Release That Arrived During an Unstable Week
The technical improvements in v2.1.216 landed against a backdrop that illustrated a separate challenge: the Anthropic platform’s reliability record in July 2026.
According to incident records tracked by StatusGator and Bifrost, the week surrounding the release included at least six documented service disruptions. July 16 brought a 3-hour, 26-minute major outage affecting multiple Claude models. July 17 saw three separate incidents, the longest running approximately 75 minutes and affecting Claude Cowork, Claude API, claude.ai, and Claude Code. July 20 — the day v2.1.216 shipped — carried its own elevated-error incident affecting Opus 4.5, lasting approximately three hours. And on July 22, a multi-service disruption simultaneously hit document creation in claude.ai, Cowork Remote, Claude Code, Claude Code on the Web, Claude Tag, and Claude Design. One incident on July 20 was never officially acknowledged, according to StatusGator’s tracking.
Anthropic previously attributed outage patterns to demand outpacing available compute capacity, driven by enterprise adoption of Claude Code and a surge in consumer signups. That explanation describes a success-driven problem — more users than infrastructure — but it does not change the operational reality for engineering teams that have integrated Claude Code into daily workflows. A platform that updates frequently, which Claude Code does (v2.1.218 shipped July 22, two days after v2.1.216), carries compounding risk: each release can introduce regression, and the cumulative pace of changes — system prompts, tool behaviors, UI adjustments — can interrupt trained workflows even when individual changes improve the underlying tool.
For teams evaluating Claude Code for enterprise use, the disruption history is a planning input, not a dealbreaker. The right framing is the same one Anthropic’s own team has used when deploying agents at scale: build for failure. Monitor for stalls and errors at the session level, not just the API level, so an outage registers quickly rather than silently degrading output.
Platform Version Status and What to Update For
Claude Code v2.1.218, released July 22, 2026, is the current version as of publication. The v2.1.216 fixes described in this article are present in v2.1.218 and all subsequent releases. To update, run claude update in any terminal.
The quadratic performance fix is the most immediately valuable change for developers running extended sessions in auto mode. sandbox.filesystem.disabled is relevant for teams whose build environments have been incompatible with filesystem isolation. The OAuth token rotation fix eliminates a class of false denials that could interrupt long-running workflows without clear explanation. The agent session restore fix matters for teams using scoped subagents in multi-agent workflows, where the incorrect permission expansion at resume was an auditable gap.
The remainder of v2.1.216’s approximately 40 entries cover shell parsing edge cases, VS Code rendering improvements, Prometheus metrics compatibility (a malformed # UNIT line in the OTEL endpoint is now corrected), and several @-mention and session-picker bug fixes, as listed in the full v2.1.216 change log.
Frequently Asked QuestionsWhy did Claude Code get slower the longer my sessions ran — and is it fixed now?
The slowdown was caused by a computational complexity bug in the message normalization step that runs before each API call. The bug made the normalization cost grow quadratically with session length: a session with twice as many turns took four times as long to normalize, not twice as long. For developers running 50- or 100-turn auto mode sessions, this translated to multi-second stalls before each API call that were easy to misread as network issues. The v2.1.216 fix restructures normalization to a linear scan, so performance no longer compounds with session length. The fix is present in all releases starting with v2.1.216.
What does sandbox.filesystem.disabled actually do, and should I use it?
The setting skips Claude Code’s filesystem isolation layer — which normally restricts the agent to specific allowed paths — while keeping network egress controls active, as described in the v2.1.216 release notes. Without filesystem isolation, Claude Code can write to any path the current user has permission to reach, including paths outside the project directory. This is intended for advanced users whose build environments conflict with the interception mechanism the isolation layer uses. For the majority of developers, the default isolated configuration provides an important safety layer and should not be disabled without a specific compatibility reason.
Why was Claude Code declining commands without an obvious reason in long-running sessions?
One documented cause was an OAuth token rotation bug fixed in v2.1.216. When an access token expired or rotated mid-session, the resulting HTTP 401 Unauthorized response was being surfaced by the auto mode classifier as a permission denial rather than being routed to authentication handling. This made a stale-credential error look like Claude had decided not to proceed for safety or intent reasons. If Claude Code declined a command in a long session without a safety rationale, a token rotation event may have been the actual cause. The fix ensures 401 errors route to authentication, not the intent classifier.
Is Claude Code reliable enough for daily enterprise use, given the July 2026 outage pattern?
The disruption pattern in July 2026 — at least six documented incidents across a week — reflects Anthropic’s own explanation of compute demand outpacing supply during a period of rapid enterprise adoption. The incidents were real but generally resolved within hours, and the Anthropic status page (status.claude.com) provides near-real-time tracking. For enterprise deployments, the standard mitigation is treating Claude Code as a non-guaranteed service: build timeout handling and fallback behavior into any workflow that uses Claude Code as a dependency, and monitor at the session level so disruptions surface as observable errors rather than silent stalls.