Claude Code Patches Ten Permission and Sandbox Weaknesses in a Week

A Cluster of Permission and Sandbox Fixes

Over three consecutive releases (2.1.221, 2.1.222, and 2.1.223, shipped between August 3 and August 5, 2026), Anthropic patched ten distinct ways that Claude Code's permission prompts, sandbox, or session isolation could be bypassed or weakened. Individually, each fix reads like a narrow bug report. Together, they describe a coordinated hardening pass on the trust boundary that decides what an agent is allowed to do without asking first.

Permission-Prompt Bypasses

Several of the fixes closed gaps where a command could hide what it was actually going to do from the approval dialog a user sees before Claude runs something risky. In 2.1.221, zsh regex conditionals inside [[ ]] blocks could execute hidden commands without triggering a permission prompt, and PowerShell permission checks mishandled file paths containing quote characters, letting such paths slip past approval. In 2.1.223, Anthropic fixed a related class of bug where a crafted Bash command could hide parts of itself from permission checks entirely, and where commands padded with tabs or invisible Unicode characters could hide part of the command from the approval dialog a user actually sees.

Sandbox and Isolation Escapes

2.1.223 also fixed workflow scripts that could use dynamic import() calls to run code outside the workflow sandbox, and closed a gap where an agent definition's bypassPermissions mode ignored an organization's policy disabling bypass permissions entirely — meaning a permissive agent config could override an admin's explicit restriction.

2.1.222 addressed a more serious isolation failure: worktree-isolated sessions, and their subagents, could run destructive git commands against the main checkout instead of staying confined to their own isolated worktree. Isolation now applies consistently to file edits and Bash execution across every session type. The same release fixed PreToolUse auto-allow hooks bypassing tool restrictions specifically inside background agent tasks such as summaries, compaction, and renames — a gap that let automated background work slip past restrictions meant to apply to it.

Hardening Beyond Bug Fixes

Alongside the fixes, Anthropic tightened two related defaults. Auto mode now runs messages sent to other agent sessions via SendMessage through the permission classifier before dispatch, closing a path where agent-to-agent messages weren't being evaluated like other actions. And Remote Control's auto-start setting can no longer be turned on by repo-local settings files (.claude/settings.json or .claude/settings.local.json) — only turned off — so a malicious or careless repository can no longer silently enable remote access; it must be enabled at user scope via /config.

Why This Cluster Matters

None of these bugs required an unusual setup to exploit — quoting a path oddly, padding a command with invisible characters, or forking a session were all things a normal workflow (or a prompt-injected one) could trigger. For a tool designed to run shell commands and edit files autonomously, gaps in the layer that decides "does this need to ask first" are the highest-stakes category of bug it can ship, because they mean the agent could act outside what the user explicitly authorized. Shipping ten related fixes in three releases across one week suggests Anthropic ran a deliberate audit of this layer rather than reacting to isolated reports.