Back to rankings

Claude Code Fixes Permission Preview Leaks That Could Hide Commands From Approvers

Claude CodeView original changelog

Claude Code patched three related weaknesses in how permission previews — the summaries relayed to a remote approver before a tool runs — are secured and displayed. Credential masking could previously over-redact and hide the actual command, path, or destination from the person approving it, meaning an approver could unknowingly greenlight an action they couldn't fully see. A separate gap let previews relay to channel servers that hadn't been vetted by the inbound trust gate, and provider API tokens weren't always masked when directly followed by shell delimiters.

Key Takeaways

  • Credential masking could previously hide entire commands, paths, or destinations from an approver — not just sensitive values — undermining informed approval.
  • Oversized private-key blocks now redact under full-strength redaction instead of partial exposure.
  • Provider API tokens weren't always masked when followed by shell delimiters, a gap that could leak live credentials into a relayed preview.
  • Permission previews now relay only to channel servers admitted by the inbound trust gate, closing a path for unvetted servers to see approval data.
  • A server's explicit opt-out of permission-capability access is now honored, rather than silently overridden.
  • All three fixes target the integrity of the Remote Control approval chain — the guarantee that what an approver sees matches what they're authorizing.

Three Fixes to the Approval Trust Chain

Claude Code's permission preview system exists so that a person approving a tool call — often from a phone or a different device via Remote Control — can see what they're about to authorize before it runs. Version 2.1.234 fixes three separate ways that system could fail in the approver's disadvantage.

Masking That Hid Too Much

The most consequential of the three: credential masking on relayed permission previews could hide commands, paths, or destinations from the approver entirely, not just the sensitive parts. An approver looking at a preview could be shown a redacted, unreadable summary and have no way to know what they were actually greenlighting. Claude Code now ensures masking only obscures genuinely sensitive content, and oversized private-key blocks are redacted under full-strength redaction rather than partially exposed.

Leaks in the Other Direction

The opposite failure mode also existed: provider API tokens that are supposed to be masked in permission previews weren't always masked when directly followed by a shell delimiter (such as a semicolon or pipe), a gap that could leak a live credential to whoever was viewing the preview.

Previews Reaching Unvetted Servers

Separately, permission previews were relaying to channel servers that hadn't been admitted by the inbound trust gate, and a server's explicit opt-out of permission-capability access wasn't always honored. Previews now relay only to servers the trust gate has actually vetted.

Why It Matters

Individually these are narrow bugs, but together they touch the core guarantee behind Remote Control approvals: that what an approver sees accurately reflects what they're authorizing, and that only trusted parties see it at all. A masking bug that hides real commands from an approver, or a credential that leaks through an unmasked shell delimiter, both undermine that guarantee in ways a crafted or coincidental input could exploit. Anthropic shipped all three fixes in the same release.