Claude Code v2.1.223 Patches Two Permission-Layer Flaws That Let Commands Hide From You

Today v2.1.223 closes a Bash compound-statement bypass and invisible Unicode tab-padding that let crafted commands hide parts of themselves from Claude Code approval dialogs -- upgrade immediately if you run any auto-approve hooks.

Two security fixes shipped in today's release, both targeting the permission layer that decides whether Claude Code needs user approval before running a command.

Bash compound-statement bypass: a crafted command using Bash compound-statement syntax could make the permission analyzer see a benign-looking command while Bash executed something else. The fix makes the analyzer fail closed on file-descriptor redirect forms it parses differently than Bash does.

Invisible Unicode / tab padding: commands padded with tab characters or invisible Unicode code points could visually hide part of the command in the approval dialog. You would approve what looked like "git status" but Bash would run something more. This closes the same class of bypass that v2.1.211 patched for whitespace characters in June.

These join a string of permission-hardening fixes since June (v2.1.211, v2.1.214, v2.1.216, now v2.1.223). The pattern suggests targeted fuzzing of the permission layer.

Other changes in v2.1.223:

• Added /teleport hint in cloud sessions showing the CLI handoff command
• Added owner/* wildcard support in managed marketplace settings
• Added a warning when a background agent's requested model is restricted by policy

What to do: run claude update or npm update -g @anthropic-ai/claude-code to get v2.1.223. If you have allowedTools or auto-approve hooks configured, this update is particularly relevant -- the bypass classes fixed today affect exactly that mode.

Why it matters: as Claude Code agents run unattended in CI and cloud sessions, the permission layer is the last defense between Claude and unintended system commands. Keeping it bypass-proof is foundational to safe agentic automation.

Sources: Claude Code changelog -- code.claude.com . Releasebot Anthropic Claude Code August 2026 . Claude Code permission guide -- petefreitag.com