The Agent Permission Layer Is the Attack Surface Now, and It's Made of String Parsing

One Claude Code release fixed two independent permission-check bypasses on the same day. That's the story.

Version 2.1.221, shipped August 4, patches a Bash tool bypass where zsh could execute hidden commands embedded inside [[ ]] regex conditionals. The approval prompt never fired for the smuggled command. A companion fix covers PowerShell permission checks mishandling paths containing quote characters on Windows. Both now prompt. (Claude Code Changelog)

Read those as one bug class, not two bugs. Any permission layer that parses a shell command string, rather than intercepting execution, inherits the full grammar ambiguity of that shell. Shells are hostile to parsing. That's not a Claude Code problem, it's a category problem, and if you've written your own allowlists or PreToolUse hooks around agent shell access, assume string-level parsing is bypassable.

The surrounding ecosystem numbers are worse. Over 30 MCP CVEs in a single 60-day window, roughly 43% of them command injection, with 82% of 2,614 surveyed MCP implementations using file operations vulnerable to path traversal. (Practical DevSecOps) The vulnerabilities have moved out of the models and into the argument parsers.

The Claude Agent SDK shipped a textbook instance the same day. Version 0.2.129 patches a flaw where skill names passed via ClaudeAgentOptions(skills=[...]) went unchecked into the CLI's --allowedTools value, which splits on commas and spaces. A skill name carrying those delimiters could inject additional permission rules into the agent's own sandbox policy. The transport now raises ValueError at connect time for parentheses, commas, control characters, wildcards, leading slashes, surrounding whitespace, and surrogate code points. It's a breaking change: skills=["*"] becomes skills="all". Worse, names with leading whitespace previously built rules that could never match, silently disabling the skill instead of failing loudly. (GitHub)

Uber's response is the most serious thing in this category. They open-sourced ADR (Agentic AI Detection and Response), a production-deployed system monitoring the agents their employees actually run: Cursor, Claude Code, customer-support agents. It ships a sensor normalizing telemetry across macOS/Linux/Windows, ADR-Bench with 303 tasks spanning 133 MCP servers and 17 documented attack techniques, and a dual-agent detector pairing high-recall triage with reasoning-based analysis. Paper accepted to MLSys 2026, repo at 519 stars with +140 today. (GitHub)

The same release with the bypasses also shipped the mitigation I'd actually adopt: mode: "mask" for sandbox credential files on Linux and WSL. Sandboxed commands read a sentinel copy of the file, either whole or only the spans captured by an extract regex, and the sandbox proxy substitutes the real value at egress. The model never holds the live secret in context, but the outbound request still authenticates. On macOS, masking falls back to deny rather than degrading silently, which you need to know before assuming parity across machines.

Do two things today. Pin your CLI to a patched version. Turn on credential masking if you're on Linux. And stop trusting allowlists you wrote yourself.