Across eight days — 15 to 22 July 2026 — Anthropic shipped Claude Code versions 2.1.211, 2.1.214, 2.1.216, and 2.1.218, and the official changelog reads like a punch list of exactly the exploit classes security researchers have spent July disclosing. Bash permission checks now fail closed on file-descriptor redirect forms the permission analyzer previously misjudged. Commands over 10,000 characters always prompt instead of auto-running. Zsh variable subscripts and modifiers that were being read as inert text now trigger an approval prompt, as do certain help and man invocations that could run unsafe options or command substitutions. A Windows PowerShell 5.1 bypass was closed, and permission validation was extended to catch commands containing invisible Unicode characters — the exact technique security researcher Johann Rehberger had publicly demonstrated could smuggle shell instructions past production agentic coding tools inside skill files and MCP server metadata.
Two fixes stand out against this site’s own coverage. On 15 July, Anthropic fixed worktree creation following a repository-committed symlink at .claude/worktrees that could write files outside the repo — the same trust-boundary category as the GhostApproval symlink flaw Wiz disclosed on 8 July, which at the time saw Anthropic treat the underlying behaviour as “outside our current threat model.” And a 15 July fix neutralising bidirectional-override, zero-width, and look-alike characters in permission previews relayed to chat channels directly closes a class of attack where a malicious tool input could visually alter what a human approver sees before clicking “approve.” Anthropic also changed Claude Code so the /verify and /code-review skills only run when explicitly invoked, rather than Claude deciding to run them on its own — reducing the surface area for an agent to autonomously trigger a sensitive review flow.
So what
This is the vendor-response half of the story that’s been missing from every AI-coding-agent security post published here since early July — Check Point’s live-attack findings, Wiz’s GhostApproval research, and the AI Now Institute’s Friendly Fire paper all documented that these tools have enough filesystem and shell access to matter, but none of them are the fix. Twelve-plus bypass fixes in eight days is a genuine signal that Anthropic is treating this class of vulnerability as a priority rather than a one-off patch, and it’s a materially better answer than “outside our threat model” was two weeks ago. It doesn’t change the underlying advice, though: known-vendor patch velocity is one input into a build-trust decision, not a substitute for your own repo hygiene, least-privilege file access, and sandboxed execution when AI coding agents touch anything production-adjacent or client-facing. If you’re weighing how much autonomy to give AI coding tools on a live engagement, that’s exactly the governance work we bring to AI-assisted development projects, or get in touch to talk through your current setup.