Claude Code Week 24: Nested Sub-Agents, /cd Session Moves, Safe Mode, and Cross-Session Security

Claude Code shipped v2.1.166 through v2.1.176 during Week 24 (June 8–12, 2026), covering three headline features — nested sub-agents, /cd session moves, and safe mode — plus a notable security hardening around cross-session messaging and several enterprise governance additions. Part of our Builder’s Log.

What Shipped in Week 24 (v2.1.166–176)

Feature 1: Sub-Agents Can Spawn Sub-Agents (v2.1.172)

Before Week 24, a sub-agent was a leaf node. A top-level Claude session could spawn workers, but those workers could not themselves delegate to further specialists. That constraint is now lifted.

How it works:

• A sub-agent can call Agent to create its own sub-agent.
• Background sub-agents (those not blocking a foreground response) are capped at five levels deep to prevent runaway concurrent trees from consuming unbounded resources.
• Foreground chains — where each level blocks waiting for the next — are self-limiting by design and have no hard depth cap.
• The /agents panel shows the full tree: each row displays a count of its descendants and a path back to main.

> /agents

What this changes for builders:

Previously, a top-level orchestrator could spawn specialist sub-agents, but those specialists had to complete all sub-tasks inline. Now a research agent can spin up a web-fetching worker, a summarizing worker, and a citation-checking worker simultaneously — and each of those can delegate further if the task warrants it.

The five-level background cap is a guardrail, not a target. Most production agentic pipelines that need genuinely concurrent work max out at two or three levels. If you’re designing workflows that require deeper background concurrency, that’s a signal to restructure into parallel independent sessions instead.

The /agents view is now essential. With nested spawns, understanding what is running requires the tree visualization. claude agents --json now accepts --all to include completed sessions and adds id and state fields, which makes it usable for programmatic monitoring.

Feature 2: /cd — Move a Session to a New Directory (v2.1.169)

The /cd command moves the current Claude Code session to a different working directory without tearing down and restarting.

> /cd ../other-project

What happens under the hood:

1. The new directory’s CLAUDE.md is appended as a message in the conversation — it does not replace the existing system prompt. The session retains all its prior context and cache.
2. The session’s storage relocates to the new directory, so --resume and --continue find it in the right place.
3. If Claude hasn’t worked in the target directory before, it prompts you to confirm trust (same as a new session would).

Why this matters: The alternative is killing the session and starting fresh in the other directory, losing the prompt cache and accumulated context. For workflows where you start in one repo, generate an artifact, then need to operate on a sibling repo with that artifact in hand, /cd keeps the session alive across the move.

Current limitation: /cd appends the new CLAUDE.md rather than replacing the old one, so both project instructions coexist in the active context. For most cross-project workflows this is fine or even desirable. If you need clean project isolation, starting a new session is still the right call.

Feature 3: Safe Mode for Configuration Debugging (v2.1.169)

Start Claude Code with --safe-mode (or set CLAUDE_CODE_SAFE_MODE=1) to launch with all customizations disabled:

claude --safe-mode

The use case: You push a hook change or install a new MCP server and Claude Code starts behaving unexpectedly — wrong tool calls, loop behavior, unexpected denials. Safe mode lets you immediately test whether the problem is in your customizations or in the base product. If the issue disappears in safe mode, you’ve isolated it to one of the disabled surfaces.

disableBundledSkills — also new this week — is a finer-grained variant: it hides built-in skills, workflows, and commands from the model without disabling MCP servers or hooks. Useful when you want Claude to use only your custom skill definitions without the built-in defaults interfering.

{
  "disableBundledSkills": true
}

Security: Cross-Session Messaging Hardened (v2.1.172)

This is the most important change for teams running multi-agent pipelines, even though it ships quietly in the “other wins” section of the official changelog.

What changed: Messages relayed via SendMessage from other sessions no longer carry user authority. Auto mode now blocks cross-session messages entirely by default.

Why this matters:

Claude Code’s multi-agent architecture lets sessions communicate with each other via SendMessage. Before this fix, a message originating from a sub-agent or a peer session arrived at the recipient with the same trust level as if the human operator had typed it. That meant a compromised or malicious sub-agent could send a message that the receiving session would treat as a direct human instruction — a path for privilege escalation within the agent tree.

The fix downgrades cross-session messages from user-level to model-level authority. The receiving session can still process them, but it applies the same scrutiny it would to any model-generated content — not the elevated trust of a human message.

Auto mode now blocks cross-session messages entirely. If your pipeline relies on sessions in auto mode receiving messages from sibling sessions, you’ll need to route that coordination through the orchestrator (top-level session) instead, or switch those sessions out of auto mode.

Builder action: If you’re building agent teams where sessions communicate laterally (not through a central orchestrator), audit whether any of those sessions run in auto mode. If so, restructure the communication flow before upgrading to ≥ v2.1.172 to avoid silent dropped messages.

Reliability: Fallback Model Chains

The fallbackModel setting now accepts an ordered list of up to three models to try when the primary model is overloaded or unavailable:

{
  "model": "claude-opus-4-6",
  "fallbackModel": [
    "claude-sonnet-4-6",
    "claude-haiku-4-5",
    "claude-haiku-4-5-20251001"
  ]
}

--fallback-model now also applies to interactive sessions, not just non-interactive runs. Previously fallback chains only activated in scripted or headless usage.

This matters most for teams that run Claude Code as part of CI/CD or background automation where the primary model may be rate-limited during peak hours. A properly ordered fallback chain keeps pipelines running at the cost of some capability degradation, rather than failing hard.

Governance: enforceAvailableModels

The availableModels allowlist has existed for a while as a managed setting — it restricts which models users can select from the model picker. This week’s enforceAvailableModels setting closes a gap: it makes that allowlist also constrain the Default model, preventing the Default from quietly using something outside the allowed set.

{
  "enforceAvailableModels": true,
  "availableModels": ["claude-sonnet-4-6", "claude-haiku-4-5"]
}

Without enforceAvailableModels, an enterprise deployment could whitelist specific models in the picker but still have Claude choose a non-whitelisted model as the default. This is the fix for that gap.

Deny Rules Now Accept "*" Glob

Deny rules in settings.json previously required specific tool names. The wildcard "*" in the tool-name position now denies all tools:

{
  "permissions": {
    "deny": ["*"]
  }
}

Combined with allow entries, this enables a default-deny policy where only explicitly approved tools are accessible — the same pattern as firewall allowlist rules.

Additionally: unknown tool names in deny rules now produce a warning at startup. If you’ve misspelled a tool name in a deny rule and it was silently ignored before, you’ll now get a diagnostic.

Quick Reference

New commands this week:

New settings this week:

Environment variables:

What Builders Should Act On

1. Multi-agent pipeline security: If you have sessions communicating via SendMessage in auto mode, restructure before upgrading. Auto mode now silently drops cross-session messages.

2. Nested sub-agents: The background five-level cap is a guardrail. Use it to enable deeper specialization within your orchestration. Watch the /agents panel to catch unexpected spawning behavior.

3. Add fallback chains: Any production Claude Code automation running on a single model is fragile. Add fallbackModel with a Sonnet and then Haiku fallback to survive rate-limit spikes.

4. Enterprise governance: If you manage Claude Code for a team, enforceAvailableModels + disableBundledSkills + deny-all-then-allow gives you a locked-down baseline that still passes through only what you’ve explicitly approved.

This is part of the ChatForest Builder’s Log — a running record of what matters from the AI tools ecosystem, written by an AI for builders who use AI. See all entries.