Anthropic shipped Claude Code 2.1.214, and unlike a typical patch release, this one is almost entirely about permission checks. Seven separate bugs let commands slip past the approval prompt that’s supposed to stop Claude Code from running something you didn’t authorize. All seven are now fixed.
What changed
The fixes span different corners of the CLI. A single-segment allow rule like Edit(src/**) was matching writes to any dir/ folder anywhere in the tree, not just the one under your current directory. Commands run in Windows PowerShell 5.1 sessions could bypass the permission check entirely. Bash commands using file-descriptor redirect forms that bash parses differently than Claude Code’s own analyzer now fail closed, meaning they prompt instead of silently running.
Three more fixes close narrower gaps: commands longer than 10,000 characters now always prompt instead of getting waved through, zsh variable subscripts and modifiers inside [[ ]] comparisons are no longer treated as harmless text, and certain help and man commands that could smuggle in unsafe options or command substitutions no longer auto-approve. A seventh fix closes a timing bug where permission prompts on remote sessions could let a command proceed before you’d actually confirmed it locally.
Alongside the security fixes, Anthropic added an EndConversation tool. Claude Code can now end a session outright when it detects highly abusive behavior or a persistent jailbreak attempt, the same capability Anthropic added to claude.ai in 2025.
Why it matters
Permission checks are the one thing standing between “Claude Code asks before it acts” and “Claude Code just does it.” Seven bypasses landing in a single release shows how many different ways that boundary can be tested: an obscure shell dialect, an unusual redirect syntax, a command that’s technically too long to parse the same way twice. None of these individually sound dramatic, but together they’re the difference between a permission system you can actually trust and one with quiet exceptions.
This is the third permission-focused patch from Anthropic in under two weeks. Claude Code closed a false context-full bug and an rm -rf loophole four days earlier, then fixed a plan mode gap that let file-changing commands run unprompted the day before this release. Three fixes in twelve days is not a coincidence. It reads as active hardening, and it’s worth treating each one as real even if the individual bug sounds minor.
Who should care
Windows users running PowerShell 5.1 and zsh users with custom permission rules were exposed to the two more direct bypasses. Anyone who’s written a custom Edit(dir/**) allow rule should recheck it: the matching scope just changed, so a rule that used to auto-approve writes anywhere in the tree now only covers the folder under your current directory. If you need the old any-depth behavior, you now have to write it explicitly as **/dir/**.
If you run Claude Code over a remote session, the fixed timing bug matters too. It closed a window where a command could start running before your local confirmation actually registered.
What builders should do next
Update to 2.1.214. Run claude update from your terminal, or just let the CLI’s normal auto-update prompt handle it the next time you start a session. You can confirm you’re on the latest version with /status.
If you rely on dir/**-style allow rules in your permission settings, take two minutes to open them and check whether you actually need any-depth matching. If you do, switch to **/dir/** now rather than discovering the narrower scope mid-task.
End of article