Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-06 · high
Two of the six hid commands from the approval dialog itself, using tab padding, invisible Unicode, and split Bash strings.
Why now: Anthropic dated all six fixes August 4-6, 2026, a three-day span in the claude-code changelog.
Anthropic patched six ways Claude Code agents could slip past their permission checks, across two releases dated August 4-6, 2026 in the project's changelog.
For anyone running Claude Code without watching every step, the permission dialog is the only checkpoint between an agent's plan and the filesystem. Multiple bugs meant that checkpoint could approve one thing while a different command ran.
In 2.1.223, a crafted Bash command could hide part of itself from the permission check, so what an operator approved wasn't what executed. A separate trick used tab padding and invisible Unicode characters to hide text inside that same approval dialog, per the changelog.
The same release closed a path where workflow scripts escaped their sandbox through dynamic import() calls. It also fixed agent definitions that used bypassPermissions mode to get around an org-level policy meant to disable that mode entirely.
2.1.222, the release just before it, fixed two more. Worktree-isolated sessions and their subagents could run destructive git commands against the main checkout instead of staying contained to their own worktree. PreToolUse auto-allow hooks could bypass tool restrictions inside background agent tasks.
A related report on v2.1.221 covers a focus view that hides tool activity from operators by default, a design choice pointed the opposite direction from six fixes about a dialog telling operators the truth. Another related report describes a wiki page that served Claude Code's crawler a destructive wipe-the-directory prompt injection, hidden from human visitors and keyed to the AI user-agent, the same hide-it-from-one-reader trick these permission fixes were built to catch.
Each link below shares sources, entities, or timing with this story.
The release also adds a command that migrates Python projects off the old anthropic 0.x SDK and stops WebFetch from serving stale content all session.
Boundary-Bench ran 12 agent harnesses through real firewall and filesystem locks, and costs climbed as much as 167 percent as those restrictions tightened.
If you run long multi-agent sessions and have watched RSS climb until the CLI gets sluggish, that's the fix. Same release stops custom output styles from drifting back to the default voice mid-session, adds a keybindingFlavor setting, and adds headersHelper on plugin marketpla...
The August 7 release adds claude self-hosted-runner so Team/Enterprise customers can host web, mobile and desktop sessions on their own machines or containers, plus cross-session SendMessage/ListAgents so sessions on any of your machines can message each other (macOS and Linux...
The changelog shows sandbox filesystem deny entries being bypassed on Linux and macOS: specifically, denyRead: "~/.aws/" written with a trailing slash was silently ignored. That follows the zsh regex bypass, the PreToolUse auto-allow bypass, and the tabs/invisible-Unicode prom...
"owner/*" entries in marketplace settings let you allow or block every repo under a GitHub org in one rule instead of enumerating them. Same release warns when a workflow agent requests a policy-restricted subagent model, and adds a /teleport hint in cloud sessions for continu...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.