Claude Code's most important shipment this week wasn't a feature. On July 18, 2026, release 2.1.214 closed six specific ways the tool-permission analyzer failed open — cases where it silently auto-approved a command or a file write it should have paused on. If you run the agent with an allowlist and reduced prompting, these were the seams where something could run without the confirmation you thought was guarding it. The fix makes each case fail closed: prompt instead of assume.
Here's the one to act on regardless of your setup: a single-segment allow rule like Edit(src/) was auto-approving writes to a nested src/ directory anywhere in the tree — not just your project's src/. So the broad globs in your allowlist have been wider than they read. Updating fixes the matcher; it does not** rewrite the rules you already have. That's the two-line action at the end.
The six gaps, and why each one matters#
Every item below is from the official changelog. Each is a place the analyzer's model of a command diverged from what the shell would actually do — and divergence, in a permission checker, means something ran that shouldn't have.
- Single-segment globs matched too broadly.
Edit(src/)and similardir/rules approved writes to any matching directory in the tree instead of only<cwd>/dir. This is the one with the widest blast radius, because broad edit globs are common and the over-match is invisible. - Windows PowerShell 5.1 bypass. A permission-check bypass affecting commands run in PowerShell 5.1 sessions — a Windows-specific hole, now closed.
- File-descriptor redirects. Redirect forms that bash parses differently than the analyzer could slip past the check. The analyzer now fails closed on that mismatch and prompts.
- Very long commands. The analyzer could misjudge long commands and run them automatically; now anything over 10,000 characters always prompts.
- zsh subscripts in
[[ ]]. Variable subscripts and modifiers inside[[ ]]comparisons were treated as inert text; those commands now prompt for approval. - Unsafe
help/maninvocations. Certainhelpandmancommands were auto-approved despite carrying unsafe options, command substitutions, or backslash paths — no longer.
The pattern across all six is the same failure shape: a checker that guesses permissive when it's unsure. The right default for a security boundary is the opposite, and 2.1.214 flips it.
Who should care most#
If you run Claude Code interactively and approve most actions by hand, these fixes are good hygiene but rarely load-bearing — you're the backstop. The exposure concentrates wherever there is no human in the loop: background sessions, CI pipelines, agent-view runs, anything running unattended with an allowlist doing the gating. There, a failed-open check doesn't ask anyone — it just proceeds. A Windows shop on PowerShell 5.1, or a team leaning on broad Edit(...) globs to keep an autonomous agent moving, had the most surface area here.
This lands the same week Claude Code tightened the other side of unattended runs — capping concurrent subagents and disabling nested subagents by default so one prompt can't fan out into an unbounded, unbudgeted swarm. If that's your exposure, we walked through those controls in how to cap a runaway Claude Code agent. Permission checks decide what an agent may do; the subagent caps decide how much of it can run at once. Both are the same trend: the guardrails maturing faster than the horsepower.
The two-line action#
- Update. Move to 2.1.214 or later (2.1.217 is current as of July 21). This closes all six gaps at once.
- Re-read your allow-rules. Updating fixes the matcher, not your list. Open your permission settings and look for any bare single-segment glob —
Edit(src/),Read(config/),dir/**— and confirm it's scoped to the path you actually mean. The old behavior made "let the agent touch my project'ssrc" quietly mean "anysrcit can reach." Tighten anything broader than your intent, and prefer working-directory-relative rules over patterns that can match up the tree.
Permission bugs don't announce themselves — nothing broke, which is exactly why they persist. The fix is free; the audit takes five minutes; and if you run Claude Code where no one is watching, those five minutes are the highest-leverage thing you'll do to it this week.
