Claude Code 2.1.224 patches fourth sandbox bypass in four releases

Claude Code's sandbox ignored a deny rule written as denyRead: "~/.aws/" with a trailing slash, letting agents read the directory anyway, per the project's changelog. It's the fourth distinct sandbox bypass patched in four releases, and this one meant AWS credentials sat exposed on both Linux and macOS despite a rule that looked like it blocked them.

Three bypasses came before it, all patched across the same 2.1.221 to 2.1.224 span: a zsh regex bypass, a PreToolUse auto-allow bypass, and one using tabs and invisible Unicode characters in prompts.

The same release adds sandbox credential masking. JWT claims get masked and AWS SigV4 requests get re-signed before they leave a sandboxed session, per the changelog. A separate fix restores sandbox violation details that had gone missing from Bash tool results.

Four bypasses in four releases is a pattern. Each fix has closed one specific hole, a trailing slash, a zsh regex, an auto-allow rule, leaving the underlying class of bug alone. Checking deny rules for trailing slashes takes thirty seconds. Treat any sandbox build before 2.1.224 as advisory only, and verify builds after it the same way.