AI Coding News: August 6, 2026 — Claude Code 2.1.223 and Gemini CLI 0.54.0 Ship Same-Day Security Fixes
August 6 turned out busier than the past two days: two of the five agents we track shipped security fixes on the same day. Claude Code 2.1.223 landed with a Bash permission bypass fix and a patch for tab-and-Unicode padding tricks in permission prompts, and Google's Gemini CLI cut its first stable release in over a week — 0.54.0 — to close a cleartext credential leak. OpenAI's Codex CLI and OpenCode also shipped smaller updates, while GitHub Copilot CLI held at v1.0.78 for a third straight day. Here's what actually changed, sourced from each project's own changelog.
Claude Code 2.1.223: Two Permission-System Security Fixes
Anthropic's Claude Code changelog lists version 2.1.223, released the day after 2.1.222's worktree-isolation fix, with two further security patches: a Bash permission bypass that crafted commands could exploit, and a fix for permission prompts that could be padded with tabs or invisible Unicode characters to obscure what a command actually does. Two more hardening fixes closed a workflow dynamic import() escape and an issue where agent definitions using bypassPermissions mode ignored organization policy.
- Security: fixed a Bash permission bypass exploitable with crafted commands, and permission prompts now correctly handle tab and Unicode padding used to obscure a command's real intent.
- Code review:
/reviewnow aliases/code-review, reviewing the current diff or PR, with/code-review ultraavailable for a deeper cloud-based review. - Marketplace management gets owner wildcard entries (
"owner/*") instrictKnownMarketplacesandblockedMarketplacessettings. - Cloud sessions show a new
/teleporthint for continuing a session locally withclaude --teleport <session id>. - Also fixed: resumed sessions after a mid-session
/cd, gateway model discovery hiding provider-prefixed Claude models, andCLAUDE_CODE_DISABLE_1M_CONTEXTnow applying auto-compaction consistently across all Claude 1M-context models.
Gemini CLI 0.54.0: First Stable Cut in a Week Fixes a Credential Leak
Google's Gemini CLI releases page shows v0.54.0 landing August 6 — its first stable release since v0.53.0 on July 28, the gap we flagged as "holding" in yesterday's roundup. The release carries two security-relevant fixes: session IDs now rotate on model fallback, preventing a stale session ID from causing stateful API errors when the CLI switches models mid-session; and GoogleCredentialsAuthProvider now enforces HTTPS, closing a path where credentials could have been sent in cleartext.
OpenAI Codex CLI 0.146.1: Safer Auto-Review Defaults
OpenAI's Codex CLI releases page shows rust-v0.146.1, a single-fix patch on top of last week's rust-v0.146.0 conversation-handling release. It applies safer automatic-review defaults for more capable models and explains permission changes directly in the terminal interface instead of leaving them silent.
OpenCode v1.18.14: Simpler xAI Login, Steadier Provider Retries
The open-source, terminal-native agent OpenCode shipped v1.18.14 on August 5, per its GitHub releases page, one release after v1.18.13's right-to-left and localization work. xAI login is now a single device-code flow that works better in headless and remote environments. On reliability, OpenCode now preserves structured mid-stream provider errors so compatible providers can retry failed responses, retries more transient provider and network errors instead of failing immediately, and counts cache writes in ACP usage totals.
Also Watching: GitHub Copilot CLI
GitHub's Copilot CLI changelog still tops out at v1.0.78 from August 3, with nothing new published in three days — the longest quiet stretch among the tools we track this week.
Why This Matters
Two unrelated permission-and-credential fixes landing on the same day, in two different codebases, is worth noticing even though neither is a fire drill: Claude Code closed a way a command could visually disguise itself past a permission prompt, and Gemini CLI closed a way credentials could leak in cleartext during a model-fallback retry. Neither is a dramatic exploit, but both are the kind of quiet hardening you'd expect once these agents get default-on autonomy — auto mode, background sessions, multi-provider fallback — and the surface area for something to go wrong grows with it. If you run either tool with elevated permissions or automated provider fallback, these patches are worth pulling in on your next update rather than waiting for a scheduled bump.
Sources & References
Comments
Share your thoughts and join the conversation