AI Coding News: July 18, 2026 — Claude Code v2.1.214 Closes a Wildcard Permission Escape Hatch
Today's release is a security-hardening build rather than a feature drop. Claude Code v2.1.214 closes a permission-rule bug that let a single-segment wildcard allow rule auto-approve writes far outside the directory it was meant to scope, alongside a permission-check bypass on Windows PowerShell 5.1 sessions. Neither bug required unusual conditions to trigger, which is exactly why fixes like these matter more than most changelog entries: they change what "approved" actually means for an agent that's already been granted write access to your filesystem.
Claude Code v2.1.214: Closing a Wildcard Permission Escape Hatch
The headline fix addresses how single-segment allow rules like dir/** were being matched. Previously, a rule scoped to one directory could auto-approve writes to nested directories anywhere in the tree rather than staying confined to <cwd>/dir as intended — a scoping bug that quietly widened what an approved rule actually covered. Alongside it, Anthropic fixed a permission-check bypass specific to Windows PowerShell 5.1 sessions, tightened Bash permission checks for file-descriptor redirects, commands longer than 10,000 characters, zsh variable subscripts, and unsafe help/man invocations, and added permission prompts for docker commands that carry daemon-redirect flags (--url, --connection, --identity) which could otherwise point the CLI at a remote Docker daemon without a confirmation step.
The release also ships a new EndConversation tool for handling jailbreak attempts and abusive users, a periodic progress heartbeat for long-running tool calls so sessions no longer look frozen mid-task, and an ISO modified timestamp added to memory file frontmatter. On the observability side, OpenTelemetry log events now carry message.uuid, client_request_id, and tool_source, and a new CLAUDE_CODE_OTEL_CONTENT_MAX_LENGTH environment variable lets teams configure how much content gets truncated in those logs.
Reliability Fixes Riding Along
Fixed streaming turns failing with a "Socket is closed" error behind corporate proxies on Windows.
Fixed the PowerShell tool hanging when a child process waited on stdin.
Fixed Python scripts crashing with UnicodeDecodeError or UnicodeEncodeError when handling non-UTF-8 data.
Fixed PowerShell 5.1 writing UTF-16LE instead of UTF-8 for > and >> redirects.
Fixed background daemon issues around socket deletion and idle session cleanup.
Fixed /ultrareview rejecting PR references formatted like #123.
Why It Matters
Permission-rule scoping bugs are a different class of problem than a crash or a UI glitch: they mean a rule you wrote to be narrow was, in practice, broader than you thought, on every session using it since the bug shipped. If you rely on directory-scoped allow rules like dir/** in your permission config, or run Claude Code from Windows PowerShell 5.1, update to v2.1.214 and treat the fix as a reminder to periodically audit what your allow rules actually match rather than what you intended them to match. The docker daemon-redirect prompt is worth the same attention if your workflows shell out to docker directly — it closes a quiet path to pointing commands at an unintended daemon.
Sources & Further Reading
Comments
Share your thoughts and join the conversation
Leave a Comment
Keep reading.
Daily Dev Stack Release Audit — July 28, 2026: Redis, MongoDB, and Nuxt Rush Out Critical Security Patches
AI Coding News: July 28, 2026 — Model Context Protocol Ships Its Final 2026-07-28 Spec
