A two-part episode for people running Claude Code unattended. **News.** Anthropic shelved the planned Agent SDK and `claude -p` billing split on June 15, the day it was due to land, telling customers "nothing changes for now" and promising a reworked plan with advance notice ([The New Stack](https://thenewstack.io/anthropic-pauses-claude-agent-sdk-subscription-change/), [digitalapplied](https://www.digitalapplied.com/blog/anthropic-claude-credit-overhaul-june-15-2026), [the-decoder](https://the-decoder.com/anthropic-backs-off-unpopular-billing-overhaul-as-price-war-with-openai-looms/)). Headless and SDK usage keep drawing from your subscription pool, so don't migrate automation to API keys for this reason. **v2.1.178** adds `Tool(param:value)` permission rules (e.g. `Agent(model:opus)`), nested `.claude/skills` auto-load, and runs subagent spawns through the auto-mode classifier ([changelog](https://code.claude.com/docs/en/changelog), [release](https://github.com/anthropics/claude-code/releases)). **v2.1.179** is fixes only: mid-stream drop recovery, WSL2 scroll restore, and a sandbox glob fix on Linux. Backdrop: short outages and elevated Opus 4.8 errors ([StatusGator](https://statusgator.com/services/anthropic/claude-code), [TechTimes](https://www.techtimes.com/articles/318514/20260616/claude-outage-tenth-disruption-12-days-exposes-anthropic-infrastructure-strain.htm)). **Tutorial: blast-radius engineering.** The prior episode built layers that *prevent* a bad action. This one assumes prevention fails and bounds the *damage*. Defense in depth across five layers: - **Claude-side:** [permission](https://code.claude.com/docs/en/permissions) deny/ask/allow ordering, `defaultMode dontAsk`, the [sandbox](https://code.claude.com/docs/en/sandboxing) (`failIfUnavailable`, `allowUnsandboxedCommands false`, `denyRead` on credentials), PreToolUse hooks, `--bare`, `--max-turns`. Plus [CVE-2026-25725](https://advisories.gitlab.com/npm/@anthropic-ai/claude-code/CVE-2026-25725/) ([SecurityWeek](https://www.securityweek.com/anthropic-silently-patches-claude-code-sandbox-bypass/)): why you bound damage outside the tool. - **AWS:** [least-privilege IAM](https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazon-s3-policy-keys.html), [permissions boundaries](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html), [Access Analyzer policy generation](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-policy-generation.html), [STS short-lived creds](https://docs.aws.amazon.com/cli/latest/reference/sts/assume-role.html), [SCPs](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples.html), [egress control](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html), and Budgets actions. - **GitHub:** [scoped GITHUB_TOKEN](https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication), [OIDC to AWS](https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services), [branch protection](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches), and [environment reviewers](https://docs.github.com/en/actions/reference/workflows-and-actions/deployments-and-environments). **The pitfall:** "it only opens a PR" ignores `pull_request_target`, which runs fork code with base-repo secrets ([2i2c](https://2i2c.org/blog/github-action-secrets-forked-repositories/), [OpenSSF](https://openssf.org/blog/2024/08/12/mitigating-attack-vectors-in-github-workflows/)). See the [spotipy](https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-h25v-8c87-rvm8) and [openlit](https://github.com/openlit/openlit/security/advisories/GHSA-9jgv-x8cq-296q) advisories.