What happened
Anthropic shipped Claude Code version 2.1.223 on August 6, three days after version 2.1.221 fixed a separate permission bypass in the same Bash tool, the feature that lets Claude Code run terminal commands on your machine instead of just writing code. This release patches four more issues, all in how Claude Code decides whether to ask you before running a command.
The first fix closes a Bash permission bypass where a specially crafted command could hide part of itself from Claude Code’s permission checks. Claude Code’s permission settings determine which commands require approval. This bug meant some commands could dodge that check entirely. The earlier bug from three days ago only affected zsh, a common command-line shell on macOS and Linux. The new fix concerns crafted Bash-tool commands.
The second fix targets a different trick: padding a command with tab characters or invisible Unicode (characters that take up space in the text but don’t show up visually) so the approval prompt you see doesn’t display the whole command. You could approve what looked like a short, safe command while a hidden portion ran alongside it.
The third fix closes a sandbox escape in Claude Code’s workflow scripts. Workflows are automated, multi-step scripts Claude Code can run on its own. Each one runs inside a sandbox, an environment intended to restrict the script’s access to the rest of your system. A workflow script could use JavaScript’s dynamic import() feature, which loads and runs code from another file while the script is running, to break out of that walled-off environment and run code outside it.
The fourth fix addresses bypassPermissions mode, a setting that skips approval prompts entirely. Organizations can disable that mode with a policy. A bug meant an individual agent definition could still turn bypass mode on for itself even when an org had turned it off.
Why it matters
All four bugs share the same shape. Something Claude Code shows you, or a setting your organization controls, didn’t match what actually happened. Permission prompts let you review actions that require approval under your settings. When that prompt can be evaded or spoofed, the safeguard stops doing its job without you noticing.
This is the second round of permission-check fixes in under a week. That’s not a reason to distrust Claude Code specifically. These fixes address specific weaknesses found in the permission system. It is a reason to keep the tool current, rather than treating a one-time permissions setup as a finished task.
Who should care
This applies to anyone running Claude Code with Bash access. That’s most people using it for anything beyond writing code by hand. It applies more directly if you use Claude Code’s workflow or background agent features. The sandbox escape and the bypass-permissions gap both live there. If you’re on a team where an admin has disabled bypass-permissions mode as an org policy, the fourth fix affects you directly: individual agents could previously override that policy anyway.
What builders should do next
Update Claude Code and confirm the version. Run claude update from your terminal, or use your package manager’s update command if you installed via Homebrew or npm. Then run claude --version and confirm you’re on 2.1.223 or later.
Don’t rely on reading the approval dialog carefully as your main defense against a hidden or padded command. That’s exactly the control this release patches around. A crafted command could make the dialog show less than what would actually run.
The fix, not vigilance, is what closes the gap. Updating is the concrete step. Use 2.1.223 or later to get these four fixes.
End of article