🧭 Claude Code 2.1.223 Patches Four Permission-Bypass Vulnerabilities

Released at 00:52 UTC on August 6, Claude Code 2.1.223 fixes four distinct shell permission-bypass vulnerabilities — following the two patched in 2.1.221 just 48 hours earlier. The pattern suggests active security research is surfacing these categories faster than they can be addressed in a single release.

What was fixed

• Bash crafted-command bypass: Specially structured bash commands could execute without triggering the user approval prompt. The fix tightens how the permission classifier tokenises compound commands before presenting them.
• Tab/Unicode padding attack: Tab characters and specific Unicode whitespace could be used to visually hide portions of a command in the permission dialog — the user would see a benign-looking string while the actual shell received a different one. Now stripped before display and evaluation.
• dynamic import() sandbox escape: JavaScript code running in a workflow sandbox could use dynamic import() to load modules outside the sandboxed scope. Blocked at the evaluator level in 2.1.223.
• bypassPermissions ignoring org policy: When bypassPermissions mode was set, it previously overrode organisation-level permission policies. It now respects org policy floors — operators cannot grant users more than org policy allows.

Context: six fixes in five days

Between August 1 and August 6, Anthropic has shipped three releases totalling six security fixes across two platforms (Linux/WSL/macOS shell and Windows PowerShell). That pace is unusual and likely reflects structured security-research engagement — possibly a bug bounty programme or a coordinated disclosure pipeline — rather than a single broad audit. Expect more hardening releases before the end of the month.

🧭 /code-review ultra, /teleport, Marketplace Wildcards, and a 200K Context Floor

Beyond the security patches, Claude Code 2.1.223 adds four developer-facing features that meaningfully change how teams manage reviews, context, and large-scale deployments.

/code-review ultra — deep cloud PR review

The /review command has been renamed /code-review and gained an effort level parameter. Running /code-review ultra offloads the analysis to a long-running cloud agent that reads the full diff, traces impacted call sites across the codebase, checks test coverage gaps, and returns a structured report. Syntax:

# Inline review of current changes
/code-review

# Deep review — specify a PR number to pull from GitHub
/code-review ultra 1234

# Fast inline review (alias preserved)
/review

The ultra mode runs asynchronously — you keep working while the cloud agent processes. You receive a notification when the review is ready, similar to the existing background task flow.

/teleport — continue cloud sessions locally

Cloud sessions now surface a hint when they detect the session could be resumed elsewhere: claude --teleport <session-id>. This pulls the cloud session's context and conversation history into a local Claude Code instance, letting you continue work in your IDE after an auto-mode cloud run without losing any context. Previously you had to reconstruct the session manually or start fresh.

Marketplace wildcard entries

The strictKnownMarketplaces and blockedMarketplaces managed settings now accept "owner/*" wildcard entries, e.g. "anthropics/*" to allow all GitHub repos under an organisation's namespace. Enterprise admins who previously had to enumerate every permitted repo can now manage this at the org level.

1M-context models capped at 200K

The environment variable CLAUDE_CODE_DISABLE_1M_CONTEXT has changed behaviour: it no longer simply disables the feature — it now enforces a hard 200K token cap and triggers auto-compaction when that limit is approached. This is useful in cost-sensitive CI environments where runaway context accumulation would previously result in unexpectedly large bills on 1M-token models.