What happened

Anthropic shipped Claude Code version 2.1.223 on August 6, three days after version 2.1.221 fixed a separate permission bypass in the same Bash tool, the feature that lets Claude Code run terminal commands on your machine instead of just writing code. This release patches four more issues, all in how Claude Code decides whether to ask you before running a command.

The first fix closes a Bash permission bypass where a specially crafted command could hide part of itself from Claude Code’s permission checks. Claude Code normally stops and asks before running a command that could change your system or read sensitive files. This bug meant some commands could dodge that check entirely. The earlier bug from three days ago only affected zsh, a common command-line shell on macOS and Linux. This one is not limited to a specific shell.

The second fix targets a different trick: padding a command with tab characters or invisible Unicode (characters that take up space in the text but don’t show up visually) so the approval prompt you see doesn’t display the whole command. You could approve what looked like a short, safe command while a hidden portion ran alongside it.

The third fix closes a sandbox escape in Claude Code’s workflow scripts. Workflows are automated, multi-step scripts Claude Code can run on its own. Each one runs inside a sandbox, an isolated environment walled off from your main system so a buggy or malicious script can’t touch files or settings outside it. A workflow script could use JavaScript’s dynamic import() feature, which loads and runs code from another file while the script is running, to break out of that walled-off environment and run code outside it.

The fourth fix addresses bypassPermissions mode, a setting that skips approval prompts entirely. Organizations can disable that mode with a policy. A bug meant an individual agent definition could still turn bypass mode on for itself even when an org had turned it off.

Why it matters

All four bugs share the same shape. Something Claude Code shows you, or a setting your organization controls, didn’t match what actually happened. The permission prompt is the one control that lets you see and approve what Claude Code does on your machine. It’s supposed to catch anything before it happens. When that prompt can be evaded or spoofed, the safeguard stops doing its job without you noticing.

This is the second round of permission-check fixes in under a week. That’s not a reason to distrust Claude Code specifically. Most tools that run code on your behalf go through this kind of hardening as people find edge cases over time. It is a reason to keep the tool current, rather than treating a one-time permissions setup as a finished task.

Who should care

This applies to anyone running Claude Code with Bash access. That’s most people using it for anything beyond writing code by hand. It applies more directly if you use Claude Code’s workflow or background agent features. The sandbox escape and the bypass-permissions gap both live there. If you’re on a team where an admin has disabled bypass-permissions mode as an org policy, the fourth fix affects you directly: individual agents could previously override that policy anyway.

What builders should do next

Update Claude Code and confirm the version. Run claude update from your terminal, or use your package manager’s update command if you installed via Homebrew or npm. Then run claude --version and confirm you’re on 2.1.223 or later.

Don’t rely on reading the approval dialog carefully as your main defense against a hidden or padded command. That’s exactly the control this release patches around. A crafted command could make the dialog show less than what would actually run. The fix, not vigilance, is what closes the gap. Updating is the concrete step. Treat any Claude Code version older than 2.1.223 as carrying all four of these gaps until you do.

End of article