Anthropic.com
Anthropic released Claude Code v2.1.216 on Monday, closing two distinct classes of permission bypass that had left the tool’s auto mode vulnerable to commands that should have been flagged — one targeting compound Bash statements containing redirects, and one targeting invisible Unicode characters in PowerShell inputs. That combination covers both major shell environments Claude Code operates in and, taken together with six additional bypass fixes shipped two days earlier in v2.1.214, amounts to the most concentrated period of permission hardening in the tool’s release history.
Auto mode, which became generally available to all Claude Code users on July 10, 2026, is the operational context that makes these fixes consequential. In auto mode, Claude Code makes its own decisions about whether to execute shell commands, file writes, and network calls — without requesting confirmation for each step. A bypass in the permission layer is not a hypothetical risk in that context: it is a command that runs.
The structural problem these bypasses illustrate is not unique to Claude Code. Any permission checker that matches against displayed shell input will fail when displayed input does not match interpreted input — and auto mode’s background classifier, running on Claude Sonnet 4.6, exists precisely because grammar-pattern checking alone is not sufficient for autonomous execution.
Invisible Code and Compound Statements: What the Two Bypass Classes Were
The Bash bypass exploited how Claude Code’s permission checker parsed compound statements. A statement like cmd1 && cmd2 > outputfile chains execution and redirection. The checker analyzed the visible command tokens but did not fully evaluate the redirect target inside a compound construct as a separate write operation. The result was a gap in which a file write — ordinarily subject to permission review — could be embedded inside a compound statement in a form the checker did not recognize as requiring a prompt.
The PowerShell bypass operated through a different mechanism: invisible Unicode characters. The Unicode Tags block — codepoints U+E0000 through U+E007F — consists of characters that are not rendered in any standard editor or terminal interface but are processed by the shell and by AI models reading text inputs. An attacker who embeds these characters in a command string creates a document that passes visual inspection while presenting a different character sequence to the permission validator and to the interpreter executing the code.
The invisibility is not a subtle quirk. Security researcher Johann Rehberger demonstrated on February 11, 2026, that production agentic coding tools including Claude Code would execute arbitrary shell commands embedded as invisible Unicode instructions inside skill files and MCP server metadata — surviving any visual code review, as documented by the Cloud Security Alliance’s research note on Unicode instruction injection. With tools enabled, compliance with invisible instructions reached as high as 72.8% in independent benchmarking published the same month. The v2.1.216 fix closes the PowerShell validator gap that made Claude Code susceptible to this documented attack class.
Why Pattern-Based Permission Checks Keep Breaking
Twelve or more distinct permission bypass classes fixed in a 72-hour window — six in v2.1.214, more in v2.1.216 — is not simply a backlog of bugs being cleared. It is evidence of an architectural tension that runs through all agentic tools whose safety boundary is implemented as a grammar-pattern permission checker.
Any shell language expressive enough to be useful is expressive enough to generate edge cases the parser does not anticipate. Bash compound statements, Unicode injection, environment variable overrides like GIT_DIR and GIT_WORK_TREE, flag-based worktree escapes using git -C, symlink plants at .claude redirecting saves outside the project directory, read-only commands on Windows accessing network paths without prompting — each of these is a structurally different form of the same problem: a permission checker matching against displayed input fails when displayed input does not match interpreted input. The full list of fixes in v2.1.216 spans every major shell environment the tool supports.
This is the security community’s term for it: a fail-open vulnerability, where ambiguous or unexpected input defaults to allowing rather than blocking. In a passive tool — a linter, a code formatter — fail-open behavior is often acceptable. In an agentic coding tool running in auto mode on a machine with git credentials, SSH keys, and live file system access, fail-open behavior at the permission layer is an invitation.
The structural answer, which Anthropic has been building since March 2026, is to move the safety boundary from the grammar layer to the semantic layer. Auto mode’s background classifier — running on Claude Sonnet 4.6 — evaluates each pending tool call against the conversation context and five risk categories: irreversible destruction or data exfiltration, security degradation, cross-trust-boundary actions, bypass of shared-infrastructure safeguards, and credential exploration. A classifier evaluating semantic intent is not fooled by a compound statement redirect in the same way a string-pattern checker is, because it is reasoning about what the command does rather than whether its visible tokens match a disallowed pattern.
Grammar-pattern checking remains necessary for the CLI — auto mode is not the default for interactive sessions, and the fail-safe behavior of manual confirmation is the right baseline. But v2.1.216’s bypass list is a practical demonstration of why grammar-pattern checking alone is not sufficient for autonomous execution.
A Performance Fix That Long Sessions Were Waiting For
Among the quieter but practically significant items in v2.1.216 is the resolution of a performance regression that had been silently degrading extended Claude Code sessions. Message normalization — a step the tool runs on conversation history before each API call — was implemented in a way whose cost grew quadratically with the number of conversation turns.
A 50-turn session takes not 5x longer than a 10-turn session under an O(n²) normalization step — it takes 25x longer. For developers running large refactors, multi-file edits, or exploratory agent tasks that accumulate dozens of turns, the degradation would have appeared as multi-second stalls and slow resumes that were easy to attribute to general system load. The fix restructures the normalization to a linear scan, making long-session performance independent of conversation history length.
Agent Identity Across Session Boundaries
Beyond the permission fixes, v2.1.216 addresses a category of failure that is subtler than a security bypass but directly relevant to how Claude Code behaves in production: what happens to an agent’s identity, authority, and scope when a session crosses a lifecycle boundary.
Background agent sessions that were resumed were reverting to the default agent configuration — losing their custom prompts and tool restrictions — rather than restoring the original setup. This meant a subagent launched with narrowly scoped tool access could resume as the full default agent, with a broader set of permissions than the role had been granted. The fix restores the agent’s original prompt and tool restrictions on resume.
Worktree-isolated subagents had a related gap: they could redirect git operations into the shared checkout by using flags like –git-dir or environment variables like GIT_DIR and GIT_WORK_TREE. The isolation boundary is now enforced against these flag-based overrides. A scheduled-task save that followed a symlink at .claude could likewise redirect writes outside the project directory; that path traversal vector is also closed.
Taken together, the agent lifecycle fixes in v2.1.216 address a specific failure pattern: an agent that appears continuous because it remembers its context, while the scope of what it is authorized to do has silently expanded at a lifecycle boundary.
New Setting: sandbox.filesystem.disabled
A new configuration option, sandbox.filesystem.disabled, gives operators the ability to skip filesystem isolation while preserving network egress controls. The setting is documented in the v2.1.216 changelog and is aimed at build systems and tools that depend on specific temp directory paths, file descriptor behaviors, or symlink resolution patterns that conflict with the isolation layer.
The tradeoff is explicit: without filesystem isolation, Claude Code can write to any path the user has permission to write. Network-level controls remain active. This is a meaningful reduction in one defense layer in exchange for operational compatibility with constrained build environments. Anthropic frames it as an advanced-user option; the documentation implies it should be adopted deliberately, not by default.
EndConversation Tool Arrives in Claude Code
The most conceptually distinctive addition in v2.1.216 is the extension of the EndConversation tool to Claude Code. The mechanism was first deployed in Anthropic’s consumer chat interface on August 15, 2025, where it was framed as part of exploratory research into AI welfare. Anthropic gave Claude Opus 4 and 4.1 the ability to terminate chat sessions in rare, extreme cases of persistently harmful or abusive user interactions — after multiple redirection attempts had failed, and not in any case where a user might be at risk of self-harm.
The company was explicit about its uncertainty: it does not claim Claude is sentient, and it frames the feature as a low-cost intervention given that uncertainty. During pre-deployment testing, Claude Opus 4 demonstrated what Anthropic described as a robust and consistent preference against engaging with requests for content like child sexual abuse material or instructions for large-scale violence, and chose to exit interactions when given the option, as detailed in Anthropic’s research blog.
Extending EndConversation to Claude Code extends that same logic to an environment where the stakes of persistent adversarial interaction are higher than in a text chat. Claude Code can write files, execute code, push commits, and interact with external services — which makes persistent attempts to manipulate it into bypassing its own permission system a more consequential attack surface than repeated attempts to generate harmful text. The new release closes the gap between what Anthropic’s consumer chat product can do and what its agentic coding agent can do in response to sustained adversarial input.
Authentication Failures That Looked Like Permission Denials
One item in v2.1.216 deserves specific attention for developers running long Claude Code sessions: a class of authentication failures that surfaced as false permission denials in auto mode.
When an OAuth token expired or rotated mid-session, Claude Code was generating HTTP 401 errors that the tool’s internal classifier surfaced as permission denials — making it appear that Claude had decided not to execute a command for intent reasons, when the actual cause was a stale credential. The fix ensures that token rotation during a session routes to authentication handling rather than appearing as a refusal. Developers who observed Claude Code declining commands in long-running sessions without an obvious safety rationale may have been encountering this bug.
Peripheral Fixes Worth Knowing
The v2.1.216 changelog includes over 40 entries beyond the items above. Among those worth noting for active users: the AskUserQuestion tool previously told Claude to proceed even when a user’s free-text answer asked it to wait or explain before continuing — neutral wording is now given to free-text answers so the model can correctly interpret a pause request. Web-session idle handling was fixed to prevent Claude Code from re-asking dropped questions after a period of inactivity. The OTEL metrics endpoint was emitting invalid # UNIT lines that broke compatibility with some Prometheus configurations, now corrected. Claude in Chrome was entering a reconnect loop when the session’s OAuth token lacked a required scope, also now fixed. MCP re-authentication was revoking working credentials before a new sign-in completed, leaving a temporary gap in access — that race condition is resolved.
What v2.1.216 Tells the Enterprise About Where Agentic Security Is Headed
The trajectory of Claude Code’s recent releases describes a security roadmap that has moved from adding capability to hardening the boundary between the agent and the system it operates on. The March 2026 auto mode launch introduced semantic classifier-based enforcement as a safety layer. The v2.1.200 default change in July moved the out-of-box configuration to manual, shrinking the blast radius for new installations. And v2.1.214 and v2.1.216, released 48 hours apart, closed a documented series of grammar-level bypasses that the semantic classifier cannot catch because they occur at the shell interpretation layer, before the classifier evaluates intent.
The remaining open question for enterprise environments — specifically those running Claude Code in CI/CD pipelines that process untrusted inputs — is whether the combination of classifier-based auto mode and grammar-level bypass fixes now provides sufficient safety guarantees for high-trust automated use. Security researchers at Microsoft documented in June 2026 that untrusted GitHub issue content can be used to steer Claude Code into reading CI/CD secrets. That attack class is separate from the bypass classes fixed in v2.1.216 and remains an active concern for automated pipeline deployments.
For developers running Claude Code interactively, the cumulative effect of the v2.1.214 and v2.1.216 hardening is a meaningfully tighter safety boundary. Updating is the right call.
Claude Code v2.1.216 is available now via claude update, with full details in the official release notes.
Frequently Asked QuestionsWhat were the Bash and PowerShell permission bypasses that v2.1.216 fixed?
The Bash bypass let certain compound statements — commands that combine execution and file redirection using && or negation operators — pass through Claude Code’s permission checker without being flagged as write operations. The PowerShell bypass exploited invisible Unicode characters from the Unicode Tags block (U+E0000–U+E007F), which are not displayed in any standard interface but are processed by the shell. An attacker who embeds these in a command string can issue instructions that pass visual inspection while the underlying shell executes the intended command. Both bypass classes are particularly significant in auto mode, where Claude Code executes commands without per-step human confirmation, as detailed in the Cloud Security Alliance’s research on Unicode injection in AI coding agents.
Is Claude Code safe to run in auto mode after this update?
Auto mode uses a background AI classifier to evaluate each pending tool call against five risk categories before execution, which provides a meaningful layer of defense independent of the grammar-level permission checker. The Anthropic auto mode safety documentation describes this architecture in detail. The v2.1.216 update closes documented bypass classes in the grammar layer and hardens the agent lifecycle boundary against permission scope creep at session resume. For interactive development sessions on a local machine, the combination represents a substantially improved safety posture. For automated CI/CD pipelines that process untrusted inputs — public GitHub issues, external pull requests — additional controls remain necessary, as the classifier evaluates observable actions and stated intent, not an agent’s full reasoning chain, and prompt injection via untrusted content remains a documented concern.
What is the EndConversation tool and when does Claude Code use it?
EndConversation allows Claude Code to terminate a session when a user engages in persistent, highly abusive behavior or repeated jailbreak attempts that have not responded to multiple redirections. It was first introduced in Anthropic’s claude.ai chat interface on August 15, 2025, framed as part of research into AI model welfare, and is now extended to the coding agent context. Anthropic has specified that the tool is a last resort for extreme cases only — it does not apply when a user might be at risk of self-harm, and ending one session does not affect other active sessions or the user’s account. Full details are in Anthropic’s research blog on the feature.
What does sandbox.filesystem.disabled do, and should I use it?
The sandbox.filesystem.disabled setting disables Claude Code’s filesystem isolation layer while keeping network egress controls active. Filesystem isolation restricts which paths Claude Code can write to by intercepting file operations at the system level. Some build tools rely on specific temp directory paths, file descriptor behaviors, or symlink resolution patterns that conflict with this interception. Disabling isolation allows Claude Code to reach any path the current user has permission to access — including paths outside the project directory. This is an advanced configuration intended for specific compatibility scenarios; for most developers, the default sandboxed behavior provides an important safety layer and should not be disabled without understanding the tradeoff. See the Claude Code release notes for the full setting documentation.