Pattern: Permission Systems Are Failing Open at the Parser Layer, Not the Policy Layer

Claude Code Changelog·high signal

Every one of v2.1.214's six permission bypasses shares a root cause: the permission analyzer's model of a command diverged from what the shell actually executes — bash file-descriptor redirects, zsh `[[ ]]` subscripts, 10,000-character commands, PowerShell 5.1 sessions, glob depth semantics. None were policy mistakes; all were parser mismatches. The practical implication for anyone building agent sandboxes is that allowlists are only as sound as the shell grammar reimplementation behind them, and any allowlist over a Turing-complete shell will keep producing this bug class. Prefer deny-by-default with narrow explicit commands over broad allow patterns you assume the analyzer reads the way your shell does.