Claude Code Patches a Bash Permission Bypass and Adds Credential Masking

What happened

Anthropic shipped Claude Code version 2.1.221 on August 3. Two changes matter beyond the routine fixes: a permission bypass got patched, and a new way to keep secrets away from the model got added.

The bug lives in Claude Code’s Bash tool, the feature that lets Claude Code run terminal commands on your machine instead of just writing code. If you run Claude Code with zsh (a common command-line shell on macOS and Linux) as your default shell, it could run a hidden command tucked inside a [[ ]] regex conditional (a shell syntax for pattern-matching text) without showing you a permission prompt first. Claude Code normally asks before running a command that could change your system or read sensitive files. That safeguard didn’t fire for commands hidden this way. The fix makes those commands prompt for permission like everything else.

The second change is a new option called mode: "mask" for sandbox credential files, currently available on Linux and Windows Subsystem for Linux (WSL, which lets Windows run a Linux environment). Claude Code can run commands inside a sandbox, an isolated environment separate from your main system. When a sandboxed command needs a credential file, like an API key or a config file with a password in it, masking swaps in a stand-in copy instead of the real file. Claude Code’s sandbox proxy substitutes the real value only when the command actually sends data out (egress), so the model itself never sees the live secret while the command still works. On macOS, this same protection currently falls back to blocking the file outright rather than masking it.

The release also adds a Focus view in the VS Code extension: a chat toggle (Ctrl+Alt+F) that collapses the play-by-play of tool calls into an expandable summary, so you can watch a running task without scrolling through every intermediate step.

Why it matters

The permission bypass is the one worth understanding even if you never write zsh conditionals yourself. Claude Code’s permission prompts exist so you see and approve anything that touches your files or runs a command on your machine. A bypass means a command could execute without you ever seeing that prompt, on any project where Claude Code had Bash access. If you’d approved Claude Code to run terminal commands at all in a zsh-based project, this applied to you whether you noticed or not.

Credential masking targets a different risk: prompt injection, where text a model reads (a webpage, a file, a task description) tricks it into taking an action you didn’t intend, like echoing a secret it can read. If a sandboxed command has access to a real API key and Claude Code gets steered into printing or exfiltrating that file, masking means what’s actually visible to the model output is a stand-in, not your real credential. The security-sensitive value only exists at the moment the sandbox proxy sends the request out, not in anything the model can read or repeat back.

Who should care

This applies directly if you run Claude Code with Bash access on a project with zsh as your shell, which is common on default macOS setups. You didn’t have to opt into anything to be affected by the bypass; updating closes it.

Credential masking matters if you use Claude Code’s sandbox mode with real secrets present, like a .env file or a cloud credentials file, on Linux or WSL. If you’re on macOS, know that the current fallback is to block the file rather than mask it, so a masked-file workflow you read about may behave differently on your machine until Apple support lands.

What builders should do next

Update Claude Code first. Run claude update from your terminal, or if you installed it through a package manager like Homebrew or npm, use that tool’s update command instead. Confirm you’re on 2.1.221 or later by running claude --version.

If you rely on the sandbox for any task that touches a credential file, check your sandbox config for the new mask mode instead of leaving that file fully exposed to the sandboxed command’s context. Test it on one project first: run a task that needs the credential to work, and confirm the task still completes successfully while the file Claude Code can read back is the masked stand-in, not the original value.

End of article