Claude Code Patches Four Auto Mode and Bash Permission Gaps
Claude CodeAcross versions 2.1.236 and 2.1.238, Anthropic closed four separate gaps in Claude Code's Auto Mode and Bash tool permission checks: Monitor commands skipping classifier review, a weaker classifier on Bedrock/Vertex/Foundry deployments, a git status-spoofing trick, and a zsh-specific syntax gap in the Bash permission checker. None is a dramatic standalone exploit, but together they follow the same "small cracks in the approval layer" pattern as Anthropic's earlier batch of ten permission and sandbox fixes. The timing matters: Auto Mode became the default permission mode for Pro, Max, and Team plans on August 14, 2026, just days before these fixes shipped.
Key Takeaways
- Four separate permission-check gaps were closed across versions 2.1.236 and 2.1.238, all in Claude Code's Auto Mode and Bash tool.
- Monitor commands now get the same scrutiny as Bash commands while Auto Mode is active; previously a Monitor allow rule could skip classifier review entirely.
- Bedrock, Vertex AI, and Foundry deployments now use the same classifier defaults as the Claude API, including severity-scored classification they previously lacked.
- A
git statusspoofing trick is closed: repos withstatus.showUntrackedFiles=nocould no longer fake a clean tree to Auto Mode's safety check. - A zsh-specific syntax gap in the Bash permission checker was patched, closing a way commands could dodge the same review plain Bash syntax would trigger.
- The fixes land days after Auto Mode became the default for Pro, Max, and Team plans on August 14, 2026, raising the stakes for any gap in its classifier.
Sources & Mentions
3 external resources covering this update
Four Small Gaps, One Pattern
Across two releases in as many days, Anthropic patched four separate ways a command or classifier decision inside Claude Code's Auto Mode and Bash permission system could end up more permissive than intended. None of the four is a dramatic sandbox escape on its own, but together they follow the same pattern as the earlier batch of "ten permission and sandbox weaknesses" Anthropic shipped in August: small cracks in the layer that decides what runs without asking.
Monitor Commands Were Skipping Review
Before version 2.1.236, a Monitor allow rule stayed active even while Auto Mode was running, so a Monitor command matching that rule could execute without going through the same classifier review that Bash commands get under Auto Mode. Claude Code now sets Monitor allow rules aside while Auto Mode is active, so Monitor and Bash commands are reviewed on equal footing.
Non-Claude-API Deployments Had a Weaker Classifier
Sessions running on Bedrock, Vertex AI, Foundry, or with telemetry disabled were using a different, less strict set of Auto Mode classifier defaults than sessions on the Claude API, including missing severity-scored classification. Version 2.1.236 brings those deployments up to the same defaults as the Claude API, so the platform a team happens to run on no longer changes how cautious Auto Mode is.
Git Status Could Be Spoofed
Auto Mode partly leans on git status to judge whether a repository is clean before treating certain actions as lower-risk. A repository configured with status.showUntrackedFiles=no could make a dirty tree report as clean, fooling that check. It no longer can.
A Zsh-Specific Bash Bypass
Separately, in version 2.1.238, Anthropic fixed a gap in how the Bash tool's permission checker parsed zsh-specific syntax inside shell conditionals, closing a path where a command written with that syntax could avoid getting flagged the way an equivalent command in standard shell syntax would.
Why It Matters
Auto Mode became the default permission mode for Pro, Max, and Team plans on August 14, so its classifier is now the thing standing between an unattended session and running something a user didn't approve, for a much larger slice of Claude Code's user base than before. Each of these four fixes narrows a specific way that boundary could have been thinner than documented.