--- collection: frontier-ai-labs collection_name: Frontier AI Labs week_start: 2026-07-13 title: Permission hardening and mode control across the agent toolchain release_count: 27 generated: 2026-07-20 canonical: https://releases.sh/collections/frontier-ai-labs/digest/2026-07-13 --- # Permission hardening and mode control across the agent toolchain Anthropic's Claude Code shipped three major security-focused releases this week, closing a permission bypass in PowerShell and fixing worktree isolation for subagents, while OpenAI's ChatGPT desktop app unified its Chat, Work, and Codex modes. The Claude Platform also introduced mid-conversation system messages for three flagship models. ### Permission patches and auto-mode discipline at Anthropic Three Claude Code releases in rapid succession tightened the agent's security posture. The most critical was [v2.1.214](/release/rel_dUN36wXVsS5wvQiQeWzNG-claude-code-v2-1-214-fixes-permission-bypass-in-powershell-5-1-and-bash), which fixed a permission-check bypass in Windows PowerShell 5.1 sessions and made Bash permission checks fail closed on file-descriptor redirect forms that Bash parses differently than the permission analyzer. The same release also added permission prompts for Docker daemon-redirect flags and fixed unbounded memory growth from oversized settings files. For teams that rely on the `/verify` and `/code-review` skills, [v2.1.215](/release/rel_WuIgUSny90synq58Hc-Ol-claude-code-v2-1-215-stops-auto-running-verify-and-code-review-skills) changed the default behavior: Claude no longer runs these skills automatically — they must now be invoked explicitly with `/verify` or `/code-review`. This gives developers more control over when Claude audits their work, reducing noise in fast-moving sessions. A day earlier, [v2.1.212](/release/rel_0KZum7utFwb2jPiz2dDy1-claude-code-v2-1-212-redesigns-fork-adds-auto-mode-reset-and-fixes-plan-mode) redesigned `/fork` so it copies your conversation into a new background session while you keep working — the old in-session subagent is now `/subtask`. It also added a `claude auto-mode reset` command to restore default auto-mode configuration, and fixed a plan-mode permission bypass that allowed file-modifying Bash commands to run without a prompt or SDK callback. Two additional releases hardened the agent further: [v2.1.211](/release/rel_gFpV0Wj0HF-k6mGxKVkMs-claude-code-v2-1-211-fixes-permission-preview-spoofing-credential-logout-and) neutralized bidirectional-override and look-alike quote characters in permission previews that could visually alter approval messages, while [v2.1.210](/release/rel_jPTMSDTDr3domeEyw4ER7-claude-code-v2-1-210-fixes-worktree-isolation-bypass-and-hardens-security) fixed `isolation: 'worktree'` subagents being able to run git-mutating commands against the main repo checkout instead of their own isolated worktree. For accessibility, [v2.1.208](/release/rel_mUy2O_SXVG9k8bsHpMrwm-claude-code-v2-1-208-adds-screen-reader-mode-and-fixes-memory-leaks) added an opt-in screen reader mode with plain-text rendering, alongside fixes for memory leaks in long sessions. ### Claude Platform: mid-conversation system messages and admin API Beyond the agent, the [Claude Platform](/release/rel_FuDzCkcyTXuV1GEAkRfwf-claude-platform-adds-mid-conversation-system-messages-to-fable-5-mythos-5-opus-4) made mid-conversation system messages available on Claude Fable 5, Claude Mythos 5, and Claude Opus 4.8 across the API, Amazon Bedrock, and Google Cloud — no beta header required. This means developers can now dynamically adjust system instructions mid-turn without restarting a conversation, which is particularly useful for multi-step workflows where the context or constraints shift. Separately, a new [Admin API beta](/release/rel_GaNOWwuqafImWFRWRujek-claude-platform-launches-admin-api-for-claude-enterprise-user-management-in-beta) for Claude Enterprise lets organizations list members, change roles, and manage groups and custom roles programmatically, reducing manual overhead for large teams. ### ChatGPT desktop: one switcher to rule them all On the OpenAI side, the story this week was about consolidation. The [ChatGPT desktop app](/release/rel_M0YO728Zv39ieRI28M7M4-chatgpt-desktop-app-revamps-layout-with-global-chat-work-codex-switcher) was redesigned with a global switcher for Chat, Work, and Codex modes, unified Recents across all conversation types, native Projects support, and cloud Work syncing across web, mobile, and desktop. The same update landed for [ChatGPT Business](/release/rel__FleQjagRPk8dTYgla-xk-chatgpt-business-desktop-app-adds-work-mode-projects-and-cross-device-sync) and [Enterprise & Edu](/release/rel_R0ttbCaEnyVkfOTg2iibx-chatgpt-desktop-app-gets-unified-recents-projects-and-cross-device-work-sync) users. On the enterprise side, [ChatGPT Enterprise & Edu](/release/rel_B6Sf3fr8w8M4OUgqVKl-r-chatgpt-enterprise-edu-expanded-admin-apis-and-analytics) expanded admin APIs with workspace-scoped Admin keys and up to 120 days of credit and Codex analytics history in the Global Admin Console. Separately, [ChatGPT](/release/rel_vV5U3Yg7AyTjCwjhIveV_-chatgpt-supercharges-search-across-chats-projects-and-files-on-all-platforms) supercharged search across chats, projects, and files on all platforms, with filters by content type — a small but meaningful improvement for navigating the growing volume of agent conversations. ### OpenAI SDKs and Codex incremental updates The OpenAI [Python SDK](/release/rel_Qg6Y0MR8mb1quYRO07MGh-openai-python-sdk-v2-46-0-adds-service-account-api-keys-endpoint) and [Go SDK](/release/rel_IEHG_-gukk3_XdnnQuhfm-openai-go-sdk-v3-44-0-adds-service-account-api-key-endpoint) both added a new endpoint for managing service account API keys under `/organization/projects/{project_id}/service_accounts/{service_account_id}/api_keys`, with the Python version also adding an `owner_project_access` filter on API key listing. The [Node SDK](/release/rel_uEEAzu7f_sQGjQeYN5qaa-openai-node-sdk-v6-48-0-adds-service-account-api-key-endpoint) added the same endpoint plus flickered async event iterators, streaming file uploads, and context to `runTools` callbacks. On the Codex front, [v0.144.6](/release/rel_PpNiXobP8QeMrUXQcGUid-codex-cli-0-144-6-updates-bundled-instructions-for-gpt-5-6-sol-terra-luna) refreshed bundled instructions for GPT-5.6 Sol, Terra, and Luna, and corrected their context windows to 272,000 tokens, while [v0.144.5](/release/rel_yTpBPHUOF62QLIBxqKWtD-codex-cli-0-144-5-expands-dangerous-command-detection-with-more-rm-forms) expanded dangerous-command detection with more `rm` forms and clearer rejection reasons. ## Releases covered ### Anthropic - [Claude Code v2.1.214 fixes permission bypass in PowerShell 5.1 and Bash redirects](https://releases.sh/release/rel_dUN36wXVsS5wvQiQeWzNG-powershell-5-1-permission-bypass-fixed-bash-redirects-fail-closed) - [Claude Code v2.1.215 stops auto-running /verify and /code-review skills](https://releases.sh/release/rel_WuIgUSny90synq58Hc-Ol-verify-and-code-review-skills-no-longer-auto-run) - [Claude Code v2.1.212 redesigns /fork, adds auto-mode reset, and fixes plan mode permission bypass](https://releases.sh/release/rel_0KZum7utFwb2jPiz2dDy1-fork-now-copies-conversation-to-background-plan-mode-permission-bypass-fixed) - [Claude Code v2.1.211 fixes permission preview spoofing, credential logout, and session cost counter](https://releases.sh/release/rel_gFpV0Wj0HF-k6mGxKVkMs-permission-preview-spoofing-fixed-sessions-no-longer-all-log-out-together) - [Claude Code v2.1.210 fixes worktree isolation bypass and hardens security](https://releases.sh/release/rel_jPTMSDTDr3domeEyw4ER7-worktree-isolation-bypass-fixed-tool-result-hardening) - [Claude Code v2.1.208 adds screen reader mode and fixes memory leaks](https://releases.sh/release/rel_mUy2O_SXVG9k8bsHpMrwm-screen-reader-mode-added-memory-leaks-fixed) - [Claude Platform adds mid-conversation system messages to Fable 5, Mythos 5, Opus 4.8](https://releases.sh/release/rel_FuDzCkcyTXuV1GEAkRfwf-mid-conversation-system-messages-now-live-on-three-more-models) - [Claude Platform launches Admin API for Claude Enterprise user management in beta](https://releases.sh/release/rel_GaNOWwuqafImWFRWRujek-admin-api-beta-manage-claude-enterprise-users-groups-and-roles) ### OpenAI - [ChatGPT desktop app revamps layout with global Chat/Work/Codex switcher](https://releases.sh/release/rel_M0YO728Zv39ieRI28M7M4-desktop-app-gets-global-switcher-work-syncs-across-devices) - [ChatGPT Business desktop app adds Work mode, Projects, and cross-device sync](https://releases.sh/release/rel__FleQjagRPk8dTYgla-xk-desktop-app-unifies-chat-and-work-projects-now-in-app) - [ChatGPT desktop app gets unified Recents, Projects, and cross-device Work sync](https://releases.sh/release/rel_R0ttbCaEnyVkfOTg2iibx-desktop-app-adds-projects-unified-recents-work-sync) - [ChatGPT Enterprise & Edu expanded admin APIs and analytics](https://releases.sh/release/rel_B6Sf3fr8w8M4OUgqVKl-r-workspace-scoped-admin-keys-120-days-of-analytics-history) - [ChatGPT supercharges search across chats, projects, and files on all platforms](https://releases.sh/release/rel_vV5U3Yg7AyTjCwjhIveV_-unified-search-across-chats-projects-and-files) - [OpenAI Python SDK v2.46.0 adds service account API keys endpoint](https://releases.sh/release/rel_Qg6Y0MR8mb1quYRO07MGh-service-account-api-keys-endpoint-owner-project-access-filter) - [OpenAI Go SDK v3.44.0 adds service account API key endpoint](https://releases.sh/release/rel_IEHG_-gukk3_XdnnQuhfm-service-account-api-key-management-added) - [OpenAI Node SDK v6.48.0 adds service account API key endpoint](https://releases.sh/release/rel_uEEAzu7f_sQGjQeYN5qaa-service-account-api-key-endpoint-added-header-normalization-fixed) - [Codex CLI 0.144.6 updates bundled instructions for GPT-5.6 Sol, Terra, Luna](https://releases.sh/release/rel_PpNiXobP8QeMrUXQcGUid-gpt-5-6-sol-terra-luna-instructions-and-context-windows-fixed) - [Codex CLI 0.144.5 expands dangerous-command detection with more rm forms](https://releases.sh/release/rel_yTpBPHUOF62QLIBxqKWtD-dangerous-command-detection-catches-more-rm-forms)