Claude Code Patches Six Sandbox-Escape Bugs In Two Releases

Anthropic patched six ways Claude Code agents could slip past their permission checks, across two releases dated August 4-6, 2026 in the project's changelog.

For anyone running Claude Code without watching every step, the permission dialog is the only checkpoint between an agent's plan and the filesystem. Multiple bugs meant that checkpoint could approve one thing while a different command ran.

In 2.1.223, a crafted Bash command could hide part of itself from the permission check, so what an operator approved wasn't what executed. A separate trick used tab padding and invisible Unicode characters to hide text inside that same approval dialog, per the changelog.

The same release closed a path where workflow scripts escaped their sandbox through dynamic import() calls. It also fixed agent definitions that used bypassPermissions mode to get around an org-level policy meant to disable that mode entirely.

2.1.222, the release just before it, fixed two more. Worktree-isolated sessions and their subagents could run destructive git commands against the main checkout instead of staying contained to their own worktree. PreToolUse auto-allow hooks could bypass tool restrictions inside background agent tasks.

A related report on v2.1.221 covers a focus view that hides tool activity from operators by default, a design choice pointed the opposite direction from six fixes about a dialog telling operators the truth. Another related report describes a wiki page that served Claude Code's crawler a destructive wipe-the-directory prompt injection, hidden from human visitors and keyed to the AI user-agent, the same hide-it-from-one-reader trick these permission fixes were built to catch.