Vibe Coding
Pattern: Claude Code has shipped Bash permission-bypass fixes in five consecutive releases
2.1.271 carries four more deny-rule escapes: the file that `fmt`/`column` read when it follows an unrecognized option, files a wildcard expands to when the wildcard sits inside a pattern or option value (`grep -v dir/* file`), shell variable declaration flags misrepresenting the command being run, and commands with two directory changes, a subshell or a `cd`+`git` chain skipping the prompt under `permissions.blockReadsOutsideWorkingDirectories`. That follows 2.1.268 (three fixes), 2.1.269 (`tee` past `Edit()` deny rules) and 2.1.270. Treat Bash deny rules as leaky by default and put the real boundary in the sandbox, not the pattern list.
↳ Follow the thread