The Permissions You Thought You Granted Were Wider Than That — Five Bypass Paths Closed in Claude Code v2.1.214
Claude Code v2.1.214 is about fixes, not features. It closes five holes in permission checking, including a PowerShell 5.1 bypass, overly broad dir/** matching, and parsing failures on commands over 10,000 characters. Here's what to check today if you run the agent unattended.
On July 18, Anthropic shipped v2.1.214 of its coding agent, Claude Code. There isn't much in the way of headline features; the bulk of the release is fixes that close holes in permission checking. It looks like a quiet release, but for anyone running the agent in automatic mode, it may be the most worthwhile changelog of the month.
Claude Code decides, for every command, whether it's safe to run, and asks a human to confirm only the risky ones. What got fixed this time were cases where that decision itself didn't work correctly — in other words, bugs where the scope you thought you had granted was actually wider.
Five places where the granted scope was off
Organizing the permission-related fixes listed in the changelog gives us the following. None of these come with a published exploit demonstration; they're described as internal fixes that Anthropic closed on its own.
| What was fixed | What was happening |
|---|---|
| Windows PowerShell 5.1 | There was a path that slipped past permission checks |
dir/** allow rules | Meant to cover only paths under the working directory, but matched any directory with the same name, anywhere |
| Long Bash commands | Parsing failed on commands over 10,000 characters and on file descriptor redirections |
zsh [[ ]] comparisons | Checks were too loose for forms using variable subscripts |
help / man | Certain combinations were auto-approved even with dangerous options attached |
These five share something in common: every one of them is a gap in shell syntax interpretation. An agent's permission settings ultimately rest on how accurately it can read a command as a string. Let the reading get one notch sloppier, and the effective scope widens while the settings screen looks exactly the same.
The dir/** fix in particular is a cue to revisit your settings
The change with the biggest practical impact is likely the shift in dir/** behavior. Until now, an allow rule like src/** would also match a same-named directory outside the working directory. As of this release, it's limited to <cwd>/src.
It's a fix in the right direction, but the flip side is that permissions are now narrower than before. Any setup that was unknowingly relying on the broader matching may see more confirmation prompts after updating. If an unattended script suddenly stalls midway, this is the first place to look.
Alongside this, docker commands now prompt for confirmation when they carry a flag that redirects which daemon to connect to. The intent appears to be preventing the mix-up where you think you're isolated inside a container but are actually pointed at a different daemon.
The power to end a conversation now belongs to the AI as well
A new tool, EndConversation, has been added. Per the changelog description, it lets Claude terminate a session in response to extremely abusive users or attempts to circumvent its restrictions.
This is less a development-workflow feature than an operational safety valve. In situations where the only option used to be refusing to respond, there's now the additional choice of closing the conversation itself. If you host a shared agent for your team internally, it's worth letting people know in advance that sessions can end unexpectedly.
Long-running tools that used to go silent now have a pulse
The other addition is a periodic progress heartbeat for long-running tool calls. Previously, during a lengthy operation, nothing moved on screen and there were stretches where it was hard to tell whether things had stalled or were still progressing.
With a regular signal coming through, monitoring decisions get easier. On top of that, the header information in memory files now includes an ISO-format timestamp, and OpenTelemetry log output has been expanded. The trend is that the material for observing what the agent is doing right now, from the outside, keeps growing bit by bit.
What to check after updating
- Audit your allow rules: confirm that no setting containing
**was counting on matching outside the working directory. - Re-test your automation: if you run the agent under cron or CI, do one full pass after updating to see whether it stops at a confirmation prompt.
- Prioritize Windows environments: since the PowerShell 5.1 fix is included, don't put off updating environments that use automatic mode on Windows.
- Somewhere to land the logs: if you have an OpenTelemetry destination, check that it can pick up the added fields.
Don't lean too hard on "it's been closed" as a reason to relax
These fixes are welcome. But how you read them matters. The fact that this many bypass paths surfaced at once also shows that this kind of adjudication is inherently hard. Shell syntax is complex, and it's more realistic to assume that parsing gaps will keep appearing.
In fact, for setups that have the agent read external content, the risk that the ingested material gets mixed in as instructions has been pointed out for a long time. Permission checking is one important wall, but you want to avoid a design that depends on it alone. Defending in multiple layers — separating the working directory, keeping credentials out of the environment, running a sandbox alongside — is no different after this update.
One more thing: the fact that the effective scope of permissions can shift with every update is no small burden for unattended operation. In exchange for the convenience, there's no denying that reading changelogs has become a standing part of the job. The cost of that cross-checking needs to be factored into how you design your automation.
References: Claude Code Changelog (Anthropic) / anthropics/claude-code CHANGELOG.md / Releasebot: Claude Code Updates / Configure permissions - Claude Code Docs
