Claude Code Patches a Bash Permission Bypass in 2.1.223
Claude Code 2.1.223 fixes a Bash permission bypass where a crafted command could hide part of itself from the permission check, and adds owner wildcard entries for marketplace allow and block lists.
What it is
Claude Code 2.1.223 is a security-and-features patch release for Anthropic's coding agent CLI.
What it does
The release closes a Bash permission bypass where a specially crafted command could conceal parts of itself from the permission check, letting disallowed commands slip through. It also adds owner wildcard entries (`"owner/*"`) to the `strictKnownMarketplaces` and `blockedMarketplaces` managed settings, so admins can allow or block every marketplace repo under a GitHub org in one rule instead of listing them individually. A new warning fires when a workflow agent, forked skill, slash command, or resumed background agent requests a subagent model that's restricted, so the parent model silently taking over doesn't go unnoticed.
Why it matters
Bash permission-check bypasses are exactly the kind of gap that turns a sandboxed coding agent into an unsandboxed one, echoing the worktree-isolation fix Anthropic shipped just a version earlier. The org-wide marketplace wildcard is a small but real convenience for enterprises managing plugin sources at scale.
How to use it
Update to Claude Code 2.1.223 or later, and set `"owner/*"` entries in `strictKnownMarketplaces` or `blockedMarketplaces` managed settings to cover an entire GitHub org.
Claude Code 2.1.257 Adds a Containment Escape Rule to Auto Mode
Claude Code 2.1.257 makes Claude Fable 5.1 the default Fable model and adds a Containment Escape rule so auto mode no longer auto-approves cloud metadata-credential fetches, egress evasion, or cross-tenant reach.
Claude Code 2.1.246 Warns You Before Your Wildcard Bash Rule Backfires
Claude Code 2.1.246 adds a startup warning for Bash allow rules with a wildcard placed before the subcommand, since those rules also match options inserted before it.
Claude Code 2.1.214 closes a PowerShell permission bypass
Claude Code 2.1.214 fixes four permission-check bugs, including nested-directory allow rules matching too broadly and a bypass in Windows PowerShell 5.1 sessions.