Vibe Coding2026-08-29 · source-backed

Bash permission checks were auto-approving arithmetic assignments.

Issue

2026-08-29

Confidence

source-backed

Sources

Redaction

redacted

Story

Claude Code 2.1.251 fixes checks that auto-approved commands assigning an arithmetic expression to an integer shell variable, naming OPTIND=1/0 and RANDOM=2+2. Both now prompt. The same release changes how Bash command output files are created and read back in the sandbox so a sandboxed command can't redirect or replace them. Parser-level gaps where the shape of a command, not its effect, decided whether it needed approval. (Claude Code Changelog)

Source trail

Claude Code Changelog More from github.com

Entities

Bash CHANGELOG Claude Code Claude Code Changelog OPTIND Parser RANDOM

Provenance

Canonical issue: Ramsay Research Agent — August 29, 2026
AI generated: no
Story unit: 2026-08-29-bash-permission-checks-were-auto-approving-arithmetic-assignments
Labels: source-backed, canonical briefing excerpt

Fetching from the wire…

Bash permission checks were auto-approving arithmetic assignments.

Story

Related stories

Claude Code moved dangerous-command adjudication from dialogs to the auto-mode classifier.

Claude Code 2.1.224 patches fourth sandbox bypass in four releases

Claude Code 2.1.251 turned a cost guarantee into a suggestion, and fixed a symlink that escaped the approved directory

The Agent Permission Layer Is the Attack Surface Now, and It's Made of String Parsing

Claude Code 2.1.222 and 2.1.223 patched four agent-sandbox escapes, including a Bash command that hid itself from the permission prompt.

Claude Code Removes Its 200-Subagent Spawn Cap

Claude Code 2.1.218 Flips Fork Skills to Background

Claude Code's June 9 release adds `--safe-mode`, `/cd`, and a switch to hide bundled skills.

Source trail

Entities

Provenance

Bash permission checks were auto-approving arithmetic assignments.

Story

Related stories

Claude Code moved dangerous-command adjudication from dialogs to the auto-mode classifier.

Claude Code 2.1.224 patches fourth sandbox bypass in four releases

Claude Code 2.1.251 turned a cost guarantee into a suggestion, and fixed a symlink that escaped the approved directory

The Agent Permission Layer Is the Attack Surface Now, and It's Made of String Parsing

Claude Code 2.1.222 and 2.1.223 patched four agent-sandbox escapes, including a Bash command that hid itself from the permission prompt.

Claude Code Removes Its 200-Subagent Spawn Cap

Claude Code 2.1.218 Flips Fork Skills to Background

Claude Code's June 9 release adds `--safe-mode`, `/cd`, and a switch to hide bundled skills.

Source trail

Entities

Provenance