What happened

Anthropic shipped Claude Code version 2.1.221 on August 3. Two changes matter beyond the routine fixes: a permission bypass got patched, and a new way to keep secrets away from the model got added.

The bug lives in Claude Code’s Bash tool, the feature that lets Claude Code run terminal commands on your machine instead of just writing code. The release note describes zsh, a command-line shell, executing hidden commands inside [[ ]] regex conditionals, syntax used to match text patterns. Affected commands could bypass the permission check.

Whether Claude Code prompts depends on your permission settings. That safeguard didn’t fire for commands hidden this way. The fix makes the affected commands prompt for permission.

The second change is a new option called mode: "mask" for sandbox credential files, currently available on Linux and Windows Subsystem for Linux (WSL, which lets Windows run a Linux environment). Claude Code can run commands inside a sandbox, an environment with restricted file and network access. When a sandboxed command needs a credential file, like an API key or a config file with a password in it, masking swaps in a stand-in copy instead of the real file. Claude Code’s sandbox proxy substitutes the real value only when the command actually sends data out (egress), so the configured file or extracted spans are hidden from the command output while the proxy can still authenticate requests. On macOS, this same protection currently falls back to blocking the file outright rather than masking it.

The release also adds a Focus view in the VS Code extension: a chat toggle (Ctrl+Alt+F) that collapses the play-by-play of tool calls into an expandable summary, so you can watch a running task without scrolling through every intermediate step.

Why it matters

The permission bypass is the one worth understanding even if you never write zsh conditionals yourself. Claude Code’s permission checks govern which commands need approval. A bypass means a command could execute without you ever seeing that prompt, when the affected zsh syntax was used through the Bash tool. Check how your workflows invoke zsh through the Bash tool, even if another shell is your default.

Credential masking targets a different risk: prompt injection, where text a model reads (a webpage, a file, a task description) tricks it into taking an action you didn’t intend, like echoing a secret it can read. If a sandboxed command has access to a real API key and Claude Code gets steered into printing or exfiltrating that file, masking means what’s actually visible to the model output is a stand-in, not your real credential. This protection applies to credential files or spans configured for masking. It does not hide every secret stored elsewhere in the project.

Who should care

Update if you allow Claude Code to run terminal commands. Version 2.1.221 fixes the reported zsh permission-check bypass; your broader permission settings still matter.

Credential masking matters if you use Claude Code’s sandbox mode with real secrets present, like a .env file or a cloud credentials file, on Linux or WSL. If you’re on macOS, know that the current fallback is to block the file rather than mask it, so a masked-file workflow you read about may behave differently on your machine when using this release.

What builders should do next

Update Claude Code first. Run claude update from your terminal, or if you installed it through a package manager like Homebrew or npm, use that tool’s update command instead. Confirm you’re on 2.1.221 or later by running claude --version.

If you rely on the sandbox for any task that touches a credential file, check your sandbox config for the new mask mode instead of leaving that file fully exposed to the sandboxed command’s context. Start with a disposable project and a dummy credential file. Confirm the configured file or spans appear as masked stand-ins. Test authentication only against a service and account intended for testing.

End of article