Anthropic shipped Claude Code 2.1.214, with seven fixes to permission checks. Seven separate bugs let commands slip past the approval prompt that’s supposed to stop Claude Code from running something you didn’t authorize. All seven are now fixed.

What changed

The fixes span different parts of the command-line app. A single-segment allow rule like Edit(src/**) was matching writes to nested src/ folders anywhere in the tree, not just the one under your current directory. Commands run in Windows PowerShell 5.1 sessions could bypass the permission check entirely. Bash commands using file-descriptor redirect forms that bash parses differently than Claude Code’s own analyzer now fail closed, meaning they prompt instead of silently running.

Three more fixes close narrower gaps: commands longer than 10,000 characters now always prompt instead of getting waved through, zsh variable subscripts and modifiers inside [[ ]] comparisons are no longer treated as harmless text, and certain help and man commands that could smuggle in unsafe options or command substitutions no longer auto-approve. A seventh fix closes a timing bug where permission prompts on remote sessions could let a command proceed before you’d actually confirmed it locally.

Alongside the security fixes, Anthropic added an EndConversation tool. Claude Code can now end a session outright when it detects highly abusive behavior or a persistent jailbreak attempt, the same capability Anthropic added to claude.ai in 2025.

Why it matters

Permission checks help keep commands within the actions you have authorized. Seven bypasses landing in a single release shows how many different ways that boundary can be tested: an obscure shell dialect, an unusual redirect syntax, a command that’s technically too long to parse the same way twice. These fixes address specific ways commands could run without the expected approval.

This is the third permission-focused patch from Anthropic in under two weeks. Claude Code closed a false context-full bug and an rm -rf loophole four days earlier, then fixed a plan mode gap that let file-changing commands run unprompted the day before this release. The sequence reflects continued permission-system hardening. Each fix matters even if the individual bug sounds minor.

Who should care

Windows users running PowerShell 5.1 and zsh users with custom permission rules were exposed to the two more direct bypasses. Anyone who’s written a custom Edit(dir/**) allow rule should recheck it: the matching scope just changed, so a rule that used to auto-approve writes anywhere in the tree now only covers the folder under your current directory. If you need the old any-depth behavior, you now have to write it explicitly as **/dir/**.

If you run Claude Code over a remote session, the fixed timing bug matters too. It closed a window where a command could start running before your local confirmation actually registered.

What builders should do next

Update to 2.1.214 or later using the method for your installation. Native installations update automatically; package-manager installations use their own update commands. Check your installed version with /status.

If you rely on dir/**-style allow rules in your permission settings, take two minutes to open them and check whether you actually need any-depth matching. If you do, switch to **/dir/** now rather than discovering the narrower scope mid-task.

End of article