Security hardening dominates as Claude Code patches permission bypasses

A week of permission-bypass fixes in Claude Code

The defining theme of the week was security, with Claude Code shipping three releases in three days that each closed distinct permission-check gaps. v2.1.221 fixed a Bash tool bypass where zsh could execute hidden commands inside regex conditionals, and added credential-file masking for sandboxed commands on Linux and WSL — a meaningful hardening step for teams running untrusted workloads. The very next day, v2.1.222 addressed a different class of issue: worktree-isolated sessions could run destructive git commands against the main checkout, and PreToolUse auto-allow hooks could be bypassed in background agent tasks. Isolation now properly applies to file edits and Bash in every session type, which closes what was arguably the most dangerous gap of the three.

The pattern continued with v2.1.223, which fixed another Bash permission bypass where crafted commands could hide from permission checks entirely, plus similar gaps in permission prompts and workflow sandboxes. That release also introduced a notable behavior change: 1M-context models are now auto-compacted to a 200K window, with unknown model IDs kept within the assumed window unless explicitly disabled. For security-conscious teams, this trio of releases makes a strong case for pinning to the latest version rather than staying on an older, vulnerable one.

Devin's automations platform matures

Cognition's Devin August 7 release is the week's other big story. Automations have graduated from beta to the production v3 API, and the headline addition is queueing: you can now set maximum concurrent runs and queue depth per automation, see queue lifecycle states in the events table, and track activity via a dedicated chart. Concurrency groups are also available in the public API. Alongside that, security profiles are now generally available, and personal access tokens have hit GA. For teams already running automations in production, the queueing support removes a real operational constraint — previously you had to manage concurrency yourself or risk overwhelming your infrastructure. The smaller snapshot recovery and Linear Reconnect update is routine polish by comparison.

Claude Code widens its deployment surface

Beyond the security fixes, v2.1.224 introduced self-hosted environments via claude self-hosted-runner on Team and Enterprise plans, letting sessions run on your own machines or containers. That's a notable option for organizations with data-residency or compliance constraints. The same release added cross-session messaging with SendMessage, and fixed a sandbox file-deny bypass on Linux and macOS — continuing the week's security theme. v2.1.225 followed with fixes for a transient OAuth token loss that could break headless sessions and MCP 401 bursts on macOS, plus gateway spend-limit support in usage warnings. A final reliability-focused release rounded out the week.

Over in the Codex world, v0.146.1 applied safer automatic-review defaults for cyber-capable models, and 0.147.0 added portable agent plugins with cross-catalog search. Grok Build's 1.0.0 fixed MCP image handling for large screenshots and improved terminal layout, though these were quieter weeks for both tools.