Anthropic just shipped 12+ permission-bypass fixes to Claude Code in eight days — the vendor response we've been waiting for
Between 15 and 22 July 2026, Anthropic shipped Claude Code versions 2.1.211 through 2.1.218 closing more than a dozen distinct permission-check bypass classes — Bash and PowerShell command-parsing gaps, invisible-Unicode instruction injection, and worktree symlink exploits — the most concentrated security-hardening sprint in the tool's release history, and a direct answer to the exploit research this site has been tracking since early July.
23 July 2026
Across eight days — 15 to 22 July 2026 — Anthropic shipped Claude Code versions 2.1.211, 2.1.214, 2.1.216, and 2.1.218, and the official changelog reads like a punch list of exactly the exploit classes security researchers have spent July disclosing. Bash permission checks now fail closed on file-descriptor redirect forms the permission analyzer previously misjudged. Commands over 10,000 characters always prompt instead of auto-running. Zsh variable subscripts and modifiers that were being read as inert text now trigger an approval prompt, as do certain help and man invocations that could run unsafe options or command substitutions. A Windows PowerShell 5.1 bypass was closed, and permission validation was extended to catch commands containing invisible Unicode characters — the exact technique security researcher Johann Rehberger had publicly demonstrated could smuggle shell instructions past production agentic coding tools inside skill files and MCP server metadata.
Two fixes stand out against this site’s own coverage. On 15 July, Anthropic fixed worktree creation following a repository-committed symlink at .claude/worktrees that could write files outside the repo — the same trust-boundary category as the GhostApproval symlink flaw Wiz disclosed on 8 July, which at the time saw Anthropic treat the underlying behaviour as “outside our current threat model.” And a 15 July fix neutralising bidirectional-override, zero-width, and look-alike characters in permission previews relayed to chat channels directly closes a class of attack where a malicious tool input could visually alter what a human approver sees before clicking “approve.” Anthropic also changed Claude Code so the /verify and /code-review skills only run when explicitly invoked, rather than Claude deciding to run them on its own — reducing the surface area for an agent to autonomously trigger a sensitive review flow.
So what
This is the vendor-response half of the story that’s been missing from every AI-coding-agent security post published here since early July — Check Point’s live-attack findings, Wiz’s GhostApproval research, and the AI Now Institute’s Friendly Fire paper all documented that these tools have enough filesystem and shell access to matter, but none of them are the fix. Twelve-plus bypass fixes in eight days is a genuine signal that Anthropic is treating this class of vulnerability as a priority rather than a one-off patch, and it’s a materially better answer than “outside our threat model” was two weeks ago. It doesn’t change the underlying advice, though: known-vendor patch velocity is one input into a build-trust decision, not a substitute for your own repo hygiene, least-privilege file access, and sandboxed execution when AI coding agents touch anything production-adjacent or client-facing. If you’re weighing how much autonomy to give AI coding tools on a live engagement, that’s exactly the governance work we bring to AI-assisted development projects, or get in touch to talk through your current setup.