Claude Code 2.1.222 and 2.1.223 patched four agent-sandbox escapes, including a Bash command that hid itself from the permission prompt.

The changelog for Aug 4–6 is an unusually dense run: a crafted Bash command could hide parts of itself from permission checks, tab padding and invisible Unicode could hide text from the approval dialog, workflow scripts escaped their sandbox via dynamic import(), and agent definitions with bypassPermissions ignored the org-level disable policy. 2.1.222 fixed worktree-isolated sessions running destructive git commands against the main checkout. These are approval-surface bugs: the dialog was showing operators something different from what would execute.