Claude Code v2.1.223: five security fixes close permission bypass and sandbox escape paths

Claude Code v2.1.223 ships five security fixes — three of them close paths where crafted commands could hide from approval dialogs or escape the workflow sandbox.

The fixes:

• Bash permission bypass — crafted commands could hide parts of themselves from permission checks
• Tab/Unicode padding — commands padded with tabs or invisible Unicode characters could conceal content in the approval dialog
• Workflow sandbox escape — dynamic import() let workflow scripts execute code outside the sandbox
• bypassPermissions policy gap — agent definitions with bypass mode ignored org-level disable policies
• Session resume after /cd — resuming a session after a mid-session /cd was broken

Three feature additions round out the release:

• Marketplace wildcards — "owner/*" entries now work in strictKnownMarketplaces and blockedMarketplaces managed settings, letting admins allow or block all repos under a GitHub org in one entry
• Subagent model fallback warnings — when a restricted subagent model falls back to the parent model, Claude Code now warns you instead of silently substituting
• /teleport hint — cloud sessions display how to continue locally with claude --teleport <session id>

The Bash and Unicode fixes are the ones that matter most. Both let a command appear harmless in the approval dialog while executing something different underneath. If you’re running Claude Code with permissive Bash settings, those were exploitable paths.

Update to v2.1.223 before your next session — especially if you rely on workflow agents or permissive Bash permissions. The /teleport hint and marketplace wildcards ship in the same release.