Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-07 · high
The same fix adds credential masking for JWTs and AWS SigV4 signatures, but every release before 2.1.224 stays exposed, per the changelog.
Why now: The fix landed in the same 2.1.221 through 2.1.224 run of releases the changelog covered as of August 7.
Claude Code's sandbox ignored a deny rule written as denyRead: "~/.aws/" with a trailing slash, letting agents read the directory anyway, per the project's changelog. It's the fourth distinct sandbox bypass patched in four releases, and this one meant AWS credentials sat exposed on both Linux and macOS despite a rule that looked like it blocked them.
Three bypasses came before it, all patched across the same 2.1.221 to 2.1.224 span: a zsh regex bypass, a PreToolUse auto-allow bypass, and one using tabs and invisible Unicode characters in prompts.
The same release adds sandbox credential masking. JWT claims get masked and AWS SigV4 requests get re-signed before they leave a sandboxed session, per the changelog. A separate fix restores sandbox violation details that had gone missing from Bash tool results.
Four bypasses in four releases is a pattern. Each fix has closed one specific hole, a trailing slash, a zsh regex, an auto-allow rule, leaving the underlying class of bug alone. Checking deny rules for trailing slashes takes thirty seconds. Treat any sandbox build before 2.1.224 as advisory only, and verify builds after it the same way.
Each link below shares sources, entities, or timing with this story.
Claude Code supports Bash / Shared entities / Same source / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Claude Code supports Bash); both cover Bash, CHANGELOG, Claude Code; cite the same source (changelog).
Claude Code supports Bash / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code supports Bash); both cover Bash, Claude Code, Linux, PreToolUse; reported by the same outlet (github.com).
Claude Code supports Bash / Shared entities / Same source / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code supports Bash); both cover Bash, CHANGELOG, Claude Code, Unicode; cite the same source (changelog).
Linked by a graph relationship (Claude Code supports Bash); both cover CHANGELOG, Claude Code, Same; cite the same source (changelog).
Claude Code supports Bash / Shared entities / Same source / Shared topic
Linked by a graph relationship (Claude Code supports Bash); both cover CHANGELOG, Claude Code, Linux; cite the same source (changelog).
Claude Code supports Bash / Shared entities / Same source / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code supports Bash); both cover CHANGELOG, Claude Code, Same; cite the same source (changelog).
Claude Code supports Bash / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code supports Bash); both cover Bash, Claude Code, PreToolUse; reported by the same outlet (github.com).
NVIDIA uses Claude Code / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (NVIDIA uses Claude Code); both cover Bash, Linux, PreToolUse, Same; overlapping topics (credential, sandbox).