Claude Code shipped 2.1.219 on July 24, and two of its lines change how an unattended run behaves more than any model swap this month. The default subagent nesting depth went from 1 to 3 — subagents can now spawn their own subagents, two levels down, with no configuration. The same release added sandbox.network.strictAllowlist, which denies any non-allowlisted host for sandboxed commands without prompting (changelog). One widens what a single run can do; the other bounds where it can reach. They belong together, and the order you turn them on matters.

What actually changed#

Before 2.1.219, a subagent you spawned was a leaf: it could not spawn subagents of its own. Now the default lets it spawn a subagent that spawns a subagent — a three-level tree from one command, no flags required. If you want the old behavior back, set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH=1.

On the network side, the old sandbox asked you to approve each new host a sandboxed command tried to reach. That is a fine model when you are watching the terminal and a useless one when you are not — the prompt just blocks forever. strictAllowlist replaces ask-on-each-host with deny-by-default: enumerate the hosts a run legitimately needs, and everything else is refused silently. It is built for the unattended and CI case, which is exactly the case that deeper nesting makes riskier.

Nesting depth is a blast-radius multiplier. The allowlist is the containment. Set the boundary before you widen the tree.

Why the pairing is the story#

Depth-3 nesting means one command can fan out into a tree of subagents, each running tools and spending tokens on branches your root conversation never displays. That is the same dynamic we flagged when nesting first arrived — the depth cap was never the real limit; the token bill at unread branches was. Raising the default to 3 puts that behavior in front of people who never opted into it.

Now add network reach. A tree of subagents that can each hit arbitrary hosts is a much larger surface than a single agent you are watching. If one branch runs a tool that fetches a URL from untrusted content, deep nesting is how that reaches three levels away from anything you approved. strictAllowlist is the setting that says: it doesn't matter how deep the tree goes, it can only talk to hosts you named. That is why the correct sequence is allowlist first, depth second — decide the network boundary, then decide how wide to let the tree grow inside it.

The founder move#

  1. Enumerate and allowlist your hosts, then turn strictAllowlist on for any run you don't babysit — CI, scheduled jobs, background agents. Deny-by-default is the only egress policy that survives an unattended run, and this is why your container alone was never the sandbox.
  2. Then decide on depth-3 nesting on your own workload. Keep it if nested branches do work the parent consumes — real parallel decomposition across independent files or checks. Cap it with CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH=1 if a test run shows the deep branches burned tokens without changing the answer. The who-stops-a-runaway-subagent question got one notch harder this week; the answer is still: measure the branch, then cap it.
  3. Re-price before you widen. The same 2.1.219 made claude-opus-5 the default Opus (1M context, fast mode at $10/$50 per Mtok). Deeper nesting on a differently-priced default means your old cost-per-task math is stale — re-benchmark before you turn concurrency up.

The through-line: this release handed you more reach and, in the same build, the switch to contain it. Flip the containment first.