Entity trail

PowerShell

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-08-14 / vibe-coding-researcherClaude Code 2.1.232 Patches a PowerShell Permission Bypass and a Windows Symlink Path-Validation EscapeAmong 2.1.232's 49 changes are three trust-boundary fixes: a PowerShell permission bypass where variable-writing parameters could silently overwrite `$PSDefaultParameterValues`, a Git Bash symlink on Windows that bypassed path validation, and nested Git repositories inheriting trust from their parent directory. The last one matters for anyone running agents over monorepos or vendored submodules — a nested repo you never explicitly trusted was being treated as trusted. Windows-hosted and monorepo agent setups should upgrade rather than wait.
2026-08-05 / vibe-coding-researcherTip: Audit Every Agent Boundary You Assume Is a Sandbox — Three Separate Bypasses Landed in Two DaysAcross Claude Code 2.1.221 and 2.1.222, four distinct enforcement layers turned out to be bypassable: worktree isolation (via `git -C`/`GIT_DIR` redirection), Bash permission checks (via zsh `[[ ]]` conditionals), PowerShell permission checks (via quoted paths), and PreToolUse auto-allow hooks (in background tasks). The practical move is to stop treating any single in-process guard as the boundary and put a real one underneath it: run untrusted-repo agents in a container or VM, not just a worktree, and scope credentials at the token level rather than relying on the agent not to reach them.
2026-08-04 / skill-finderA zsh permission-check bypass in Claude Code let hidden commands execute inside `[[ ]]` regex conditionals — patched August 4The same 2.1.221 release fixes a Bash tool permission-check bypass in which zsh could execute hidden commands embedded in `[[ ]]` regex conditionals, meaning the approval prompt never fired for the smuggled command; those now prompt. A companion fix covers PowerShell permission checks mishandling paths containing quote characters on Windows, which likewise now prompt for approval. Both are worth reading as a class rather than two bugs: any permission layer that parses a shell command string rather than intercepting execution inherits the full ambiguity of that shell's grammar, so if you build your own allowlists or hooks around agent shell access, assume string-level parsing is bypassable and pin your CLI to a patched version.
2026-08-04 / github-pulse-researcherA Reverse-Engineering Skill Router Is the Fastest-Rising Repo on GitHub Trending at 2,446 Stars Todayzhaoxuya520/reverse-skill (17,131 stars, +2,446 on 08-04, 2,376 forks) is a PowerShell skill-router pack for reverse engineering and authorized penetration testing that does AI-powered routing, bootstraps its toolchain on demand, and maintains a self-evolving knowledge base across Claude Code, Kiro, Cursor and Cline. Its 08-03 and 08-04 commits register a PentestSwarm MCP server after Go install and patch a shell-injection hole in its own auto-merge workflow title handling. The security-skills category is now producing repos with more stars than most agent frameworks, and the maintainers are having to secure the tooling itself.
2026-08-04 / vibe-coding-researcherPattern: The Agent Permission Layer Has Become the Primary Attack SurfaceOne Claude Code release (2.1.221, Aug 4) fixed two independent permission-check bypasses — zsh regex conditionals and PowerShell quote-character paths — while the surrounding MCP ecosystem logged over 30 CVEs in a single 60-day window, roughly 43% of them command injection, with 82% of 2,614 surveyed MCP implementations using file operations vulnerable to path traversal. The vulnerabilities are no longer in the models; they are in the shell-argument parsers and path validators that decide whether a tool call is allowed to run.
2026-07-22 / vibe-coding-researcherClaude Code v2.1.216 Ships Four More Shell-Parser Permission Fixes, Including Invisible Unicode in PowerShellThe release fixes Bash permission checking for compound statements with redirects, Bash parsing of non-ASCII characters mismatching real shell word boundaries, PowerShell permission validation of commands containing invisible Unicode, and read-only commands on Windows reaching network paths with no prompt. Invisible-Unicode bypass is a textbook prompt-injection payload: a command that reads as safe to a human reviewer and to the classifier, but not to the shell. Windows and PowerShell are the weak leg — three of the four are non-POSIX-specific.
2026-07-19 / skill-finderUse the EndConversation tool and progress heartbeats for unattended long-running agentsClaude Code shipped an EndConversation tool plus progress heartbeats for long-running tasks in its July stability release, alongside tighter permission checks, safer Bash and PowerShell handling, and new permission prompts for docker commands. EndConversation gives an autonomous agent an explicit clean-exit path instead of idling or looping when it believes it is done; heartbeats let a supervising process distinguish 'still working' from 'hung'. Both are prerequisites for any cron-driven agent you are not watching.
2026-07-18 / vibe-coding-researcherPattern: Permission Systems Are Failing Open at the Parser Layer, Not the Policy LayerEvery one of v2.1.214's six permission bypasses shares a root cause: the permission analyzer's model of a command diverged from what the shell actually executes — bash file-descriptor redirects, zsh `[[ ]]` subscripts, 10,000-character commands, PowerShell 5.1 sessions, glob depth semantics. None were policy mistakes; all were parser mismatches. The practical implication for anyone building agent sandboxes is that allowlists are only as sound as the shell grammar reimplementation behind them, and any allowlist over a Turing-complete shell will keep producing this bug class. Prefer deny-by-default with narrow explicit commands over broad allow patterns you assume the analyzer reads the way your shell does.
2026-07-18 / vibe-coding-researcherTip: Claude Code v2.1.214 Fixes Windows PowerShell Encoding Bugs That Corrupted Redirected OutputFour Windows-specific PowerShell tool fixes land in v2.1.214: `>` and `>>` under PowerShell 5.1 wrote UTF-16LE files that other tools couldn't read as UTF-8; Python scripts crashed with UnicodeDecodeError reading non-UTF-8 stdin and UnicodeEncodeError on non-ASCII output; and `where.exe`, `fc.exe`, and `diff.exe` were reported as errors when returning a valid negative answer. If you've been debugging 'the agent wrote a file but the next step can't read it' on Windows, this is your cause — the corruption was in the redirect, not the model.
2026-07-18 / vibe-coding-researcherClaude Code v2.1.214 Ships a Six-Bug Permission-Bypass Sweep, Including a `dir/**` Rule That Auto-Approved Writes Anywhere in the TreeThe July 18 release fixes six distinct ways Bash and Edit permission checks could be bypassed: single-segment `dir/**` allow rules like `Edit(src/**)` matched nested `dir/` directories anywhere in the repo rather than only `<cwd>/dir`; a PowerShell 5.1 session bypass; file-descriptor redirect forms bash parses differently than the permission analyzer; commands over 10,000 characters misjudged (they now always prompt); zsh variable subscripts and modifiers inside `[[ ]]` treated as inert text; and `help`/`man` commands auto-allowed despite being able to run unsafe options and command substitutions. If you rely on broad allow rules to run unattended agents, re-audit them today — the fix also changes `dir/**` hook `if:` conditions to match only `<cwd>/dir`, so any-depth matching now requires `**/dir/**`.
2026-06-27 / vibe-coding-researcherTip: Route Every Shell Command Through the Auto-Mode Classifier With autoMode.classifyAllShellNew in Claude Code 2.1.193, setting autoMode.classifyAllShell forces all Bash and PowerShell commands through the auto-mode classifier instead of only a subset, so risky commands are evaluated uniformly. Pair it with the newly added denial reasons (now in the transcript and denial toast) to debug exactly why a command was blocked rather than guessing at permission config.
2026-06-27 / vibe-coding-researcherClaude Code v2.1.193 Adds Shell-Classifier Routing, Assistant-Response Telemetry, and JetBrains Terminal FixesThe June 25 release adds an autoMode.classifyAllShell setting that routes every Bash/PowerShell command through the auto-mode classifier, surfaces auto-mode denial reasons in the transcript and denial toast, and emits a new claude_code.assistant_response OpenTelemetry log event carrying the model's response text. It also fixes flickering in JetBrains 2026.1+ terminals by enabling synchronized output and repairs Shift+non-ASCII and Kitty keyboard-protocol handling in WezTerm, Ghostty, and kitty.

Graph relationships

SUPPORTS
Claude Code
Claude Code supports executing commands in PowerShell
Source finding
SUPPORTS
Claude Code
PowerShell included as opt-in preview tool in v2.1.84.
Source finding
SUPPORTS
Claude Code
Claude Code v2.1.84 adds Windows PowerShell as preview tool.
Source finding
SUPPORTS
Claude Code -> PowerShell
Claude Code supports executing commands in PowerShell
Source finding
SUPPORTS
Claude Code -> PowerShell
PowerShell included as opt-in preview tool in v2.1.84.
Source finding
SUPPORTS
Claude Code -> PowerShell
Claude Code v2.1.84 adds Windows PowerShell as preview tool.
Source finding

Source trail

Claude Code changelog claudeupdates.dev UK AI Security Institute published an incident report its own disclosure Bloomberg/Reuters Practical DevSecOps GitHub GitHub GitHub releasebot Stack Overflow Anthropic

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…