Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-08-06 · source-backed
The changelog for Aug 4–6 is an unusually dense run: a crafted Bash command could hide parts of itself from permission checks, tab padding and invisible Unicode could hide text from the approval dialog, workflow scripts escaped their sandbox via dynamic import(), and agent definitions with bypassPermissions ignored the org-level disable policy. 2.1.222 fixed worktree-isolated sessions running destructive git commands against the main checkout. These are approval-surface bugs: the dialog was showing operators something different from what would execute.
Each link below shares sources, entities, or timing with this story.
v2.1.218 took dangerous-rm, background-&, and suspicious-Windows-path checks out of permission dialogs, and stopped prompting in plan mode for Bash the static analyzer can't prove read-only. /deep-research also now starts only when you invoke it. Fewer interrupts, but a model...
The changelog shows sandbox filesystem deny entries being bypassed on Linux and macOS: specifically, denyRead: "~/.aws/" written with a trailing slash was silently ignored. That follows the zsh regex bypass, the PreToolUse auto-allow bypass, and the tabs/invisible-Unicode prom...
One Claude Code release fixed two independent permission-check bypasses on the same day. That's the story. Version 2.1.221, shipped August 4, patches a Bash tool bypass where zsh could execute hidden commands embedded inside [[ ]] regex conditionals. The approval prompt never...
The headline feature: /loop 5m check the deploy schedules a recurring prompt that fires every 5 minutes in the background. Boris Cherny demoed: "/loop babysit all my PRs -- auto-fix build issues and when comments come in, use a worktree agent to fix them." Tasks auto-delete af...
This is the single highest-leverage spend cut I've found for daily Claude Code users, and it's one command. Run rtk init --global (or rtk init -g) and it installs a PreToolUse hook in Claude Code that transparently rewrites your Bash calls to their rtk equivalents at the proxy...
Two days from now, on August 14, auto mode becomes the default permission mode for new Pro, Max, and Team sessions (Claude Code Docs, Week 32). Not opt-in. Default. Every new session you start after Thursday has a different permission posture than the ones you started this wee...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.