Claude Code 2.1.222 and 2.1.223 Patch Four Agent-Sandbox Escapes, Including a Bash Command That Hides Itself From the Permission Prompt
The Claude Code changelog for August 4-6, 2026 lists an unusually dense run of agent-containment fixes: 2.1.223 closes a Bash permission bypass where a crafted command could hide parts of itself from permission checks, a related trick using tab padding and invisible Unicode to hide text from the approval dialog, workflow scripts escaping the workflow sandbox via dynamic import(), and agent definitions whose bypassPermissions mode ignored the org-level disable policy. 2.1.222 fixed worktree-isolated sessions and their subagents running destructive git commands against the main checkout, and PreToolUse auto-allow hooks bypassing tool restrictions inside background agent tasks. For anyone running unattended coding agents, these are approval-surface bugs, not cosmetic ones — the permission dialog was showing operators something different from what would execute.
↳ Follow the thread