Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-09-19 · high
Tag characters that hide instructions in pasted text get stripped, and you see the cleaned prompt before it sends.
Why now: Anthropic posted this in the v2.1.277 release notes on GitHub on September 19, 2026.
Claude Code's 2.1.277 release strips invisible Unicode formatting and tag characters from your prompt, then shows the cleaned version before it sends.
Tag characters from the U+E0000 block are the standard way to hide instructions inside text you paste from a web page or an issue body. Paste something poisoned and you could hand Claude Code instructions you never wrote or saw.
The stripping itself isn't the safeguard. A client could silently drop odd Unicode ranges and call it done. Showing the prompt after cleanup lets you compare what you pasted against what gets sent.
That protection matters most for scraped input, not typed prompts. Anyone piping in text from GitHub issues, docs pages, or another agent's output has no way to eyeball what's hidden until the preview shows it.
The release note doesn't say whether the same stripping covers text arriving through tool output as well as direct pastes. That gap matters if you pipe scraped content through Claude Code's tools instead of typing it yourself.
Each link below shares sources, entities, or timing with this story.
One matching segment in a chained Bash command used to exempt the entire thing from the sandbox, not just the part you allowlisted.
Go update. Then go read your sandbox.excludedCommands configuration, because it probably means something different than you thought it did. The bug: a single glob in sandbox.excludedCommands exempted an entire compound Bash command from the sandbox if any one segment matched....
Two of the six hid commands from the approval dialog itself, using tab padding, invisible Unicode, and split Bash strings.
The release also adds a command that migrates Python projects off the old anthropic 0.x SDK and stops WebFetch from serving stale content all session.
Version 2.1.273 stops a repo-chosen memory directory from loading into the prompt when read access outside the working folder is blocked.
The same release adds a plugin eval command and fixes a permission rule that leaked across Claude Code's settings sources.
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.