--- collection: coding-agents collection_name: Coding Agents week_start: 2026-08-03 title: Security hardening dominates as Claude Code patches permission bypasses release_count: 11 generated: 2026-08-10 canonical: https://releases.sh/collections/coding-agents/digest/2026-08-03 --- # Security hardening dominates as Claude Code patches permission bypasses Claude Code shipped three consecutive security-focused releases fixing Bash permission bypasses and sandbox escapes, while Devin graduated automations to GA with queueing support and Anthropic expanded Claude Code's deployment options with self-hosted runners. ### A week of permission-bypass fixes in Claude Code The defining theme of the week was security, with Claude Code shipping three releases in three days that each closed distinct permission-check gaps. [v2.1.221](/release/rel_Z0WSuG0O0Qh38qf7AjknN-claude-code-v2-1-221-fixes-bash-tool-permission-bypass-adds-focus-view-and) fixed a Bash tool bypass where zsh could execute hidden commands inside regex conditionals, and added credential-file masking for sandboxed commands on Linux and WSL — a meaningful hardening step for teams running untrusted workloads. The very next day, [v2.1.222](/release/rel_BFpHVqOccghRUA9vLslSx-claude-code-v2-1-222-fixes-worktree-isolation-and-hook-bypass-vulnerabilities) addressed a different class of issue: worktree-isolated sessions could run destructive git commands against the main checkout, and PreToolUse auto-allow hooks could be bypassed in background agent tasks. Isolation now properly applies to file edits and Bash in every session type, which closes what was arguably the most dangerous gap of the three. The pattern continued with [v2.1.223](/release/rel_G1hDm6xoiapkV3NoQGHrg-claude-code-v2-1-223-fixes-bash-permission-bypass-and-sandbox-escapes), which fixed another Bash permission bypass where crafted commands could hide from permission checks entirely, plus similar gaps in permission prompts and workflow sandboxes. That release also introduced a notable behavior change: 1M-context models are now auto-compacted to a 200K window, with unknown model IDs kept within the assumed window unless explicitly disabled. For security-conscious teams, this trio of releases makes a strong case for pinning to the latest version rather than staying on an older, vulnerable one. ### Devin's automations platform matures [Cognition's Devin August 7 release](/release/rel_MCr3wQbtSQ6qQWGeJQ8rw-devin-august-7-2026-automations-ga-queueing-and-security-profiles) is the week's other big story. Automations have graduated from beta to the production v3 API, and the headline addition is queueing: you can now set maximum concurrent runs and queue depth per automation, see queue lifecycle states in the events table, and track activity via a dedicated chart. Concurrency groups are also available in the public API. Alongside that, security profiles are now generally available, and personal access tokens have hit GA. For teams already running automations in production, the queueing support removes a real operational constraint — previously you had to manage concurrency yourself or risk overwhelming your infrastructure. The smaller [snapshot recovery and Linear Reconnect update](/release/rel_1IuQ9J9dOz3Tez0SiYr_2-devin-improves-snapshot-build-recovery-and-adds-linear-reconnect-action) is routine polish by comparison. ### Claude Code widens its deployment surface Beyond the security fixes, [v2.1.224](/release/rel_PGWWietOyhv80YsFey6HI-claude-code-v2-1-224-adds-self-hosted-environments-and-cross-session-messaging) introduced self-hosted environments via `claude self-hosted-runner` on Team and Enterprise plans, letting sessions run on your own machines or containers. That's a notable option for organizations with data-residency or compliance constraints. The same release added cross-session messaging with `SendMessage`, and fixed a sandbox file-deny bypass on Linux and macOS — continuing the week's security theme. [v2.1.225](/release/rel_DNbLbsOPB518lQ0-NVjiO-claude-code-v2-1-225-fixes-oauth-token-loss-and-mcp-401-bursts) followed with fixes for a transient OAuth token loss that could break headless sessions and MCP 401 bursts on macOS, plus gateway spend-limit support in usage warnings. A final [reliability-focused release](/release/rel_Fka9ZAKrEADUtZJx-Wt9D-claude-code-v2-1-226-reliability-improvements) rounded out the week. Over in the Codex world, [v0.146.1](/release/rel_q3fRe19Ha_2BcAucoCiue-codex-cli-0-146-1-applies-safer-automatic-review-defaults-for-cyber-models) applied safer automatic-review defaults for cyber-capable models, and [0.147.0](/release/rel_MqUbl76bzPq58lF-1glNT-codex-cli-release-0-147-0) added portable agent plugins with cross-catalog search. Grok Build's [1.0.0](/release/rel_LKPyWRiZJwGu9bxD7iI_3-grok-build-1-0-0-ships-with-mcp-image-fix-and-terminal-polish) fixed MCP image handling for large screenshots and improved terminal layout, though these were quieter weeks for both tools. ## Releases covered ### Anthropic - [Claude Code v2.1.221 fixes Bash tool permission bypass, adds Focus view and sandbox credential masking](https://releases.sh/release/rel_Z0WSuG0O0Qh38qf7AjknN-bash-tool-permission-bypass-fixed-sandbox-credential-masking-shipped) - [Claude Code v2.1.222 fixes worktree isolation and hook bypass vulnerabilities](https://releases.sh/release/rel_BFpHVqOccghRUA9vLslSx-worktree-isolation-strengthened-hook-bypass-fixed) - [Claude Code v2.1.223 fixes Bash permission bypass and sandbox escapes](https://releases.sh/release/rel_G1hDm6xoiapkV3NoQGHrg-bash-permission-bypass-fixed-sandbox-escapes-closed) - [Claude Code v2.1.224 adds self-hosted environments and cross-session messaging](https://releases.sh/release/rel_PGWWietOyhv80YsFey6HI-self-hosted-runners-and-cross-session-messaging-arrive) - [Claude Code v2.1.225 fixes OAuth token loss and MCP 401 bursts](https://releases.sh/release/rel_DNbLbsOPB518lQ0-NVjiO-oauth-token-loss-fixed-mcp-401-bursts-resolved) - [Claude Code v2.1.226 reliability improvements](https://releases.sh/release/rel_Fka9ZAKrEADUtZJx-Wt9D-reliability-improvements) ### Cognition - [Devin August 7, 2026: automations GA, queueing, and security profiles](https://releases.sh/release/rel_MCr3wQbtSQ6qQWGeJQ8rw-automations-ga-queueing-and-security-profiles-launch) - [Devin improves snapshot build recovery and adds Linear Reconnect action](https://releases.sh/release/rel_1IuQ9J9dOz3Tez0SiYr_2-snapshot-build-failures-easier-to-fix-linear-reconnect-added) ### OpenAI - [Codex CLI 0.146.1 applies safer automatic-review defaults for cyber models](https://releases.sh/release/rel_q3fRe19Ha_2BcAucoCiue-cyber-models-get-safer-auto-review-defaults) - [Codex CLI Release: 0.147.0](https://releases.sh/release/rel_MqUbl76bzPq58lF-1glNT-codex-cli-release-0-147-0) ### xAI - [Grok Build 1.0.0 ships with MCP image fix and terminal polish](https://releases.sh/release/rel_LKPyWRiZJwGu9bxD7iI_3-mcp-screenshots-intact-theme-detection-works-in-tmux)