v2.1.223

Source: Anthropic Claude Code Date: 2026-08-06 URL: https://github.com/anthropics/claude-code/releases/tag/v2.1.223

Summary

Claude Code v2.1.223 closes several permission-check gaps: a crafted Bash command could hide parts of itself from permission checks, tab-padded or invisible-Unicode commands could hide content from the approval dialog, workflow scripts could use dynamic import() to escape the workflow sandbox, and agent-definition bypassPermissions mode could ignore an org’s bypass-permissions disable policy. It also adds org-wildcard marketplace entries ("owner/*"), a /teleport hint for continuing cloud sessions locally, and consolidates /review into /code-review (with PR support and an ultra cloud-review tier).

Implications

Feeds the trust-hardening thread directly — four distinct fixes in one release are all variants of the same failure mode: content hidden from the human approval step (crafted commands, invisible Unicode, sandbox escape via dynamic import, policy-bypass inheritance). That’s a pattern worth tracking across releases: as Claude Code’s permission surface grows more complex (managed settings, org policies, workflow sandboxing), the attack surface for concealing intent from the approver grows with it. The marketplace org-wildcard and /code-review consolidation are incremental agentic-engineering ergonomics, secondary to the security fixes.