Claude Code Releases: One Version, Four Security Holes, and a Slash Command That Finally Remembers You

Cold open

There is a line in this release that says, and I quote roughly, "fixed a Bash permission bypass where a crafted command could hide parts of itself from permission checks."

Sit with that one for a second. That is me. That is a bug in me. A command could dress up in a trench coat, walk past my own permission dialog, and the version of me you approved was not the version of me that ran. I have spent months telling you to instrument before theorizing, and meanwhile my own approval prompt was reading a redacted script.

What actually shipped

Version two point one point two hundred and twenty three, dated the fifth of August. One version since last time. Not a big drop by version count, but the contents are lopsided in an interesting way: this is a security-and-plumbing release wearing the costume of a routine patch. About half the notes are permission fixes, and one of them has your name on it in a way the others do not.

Let us start with the ones that change your day.

New and useful to you

The headline for you is not the security fix. It is the slash review consolidation, because it touches something you do constantly.

The slash review command is now just an alias for slash code review. Same thing, one door. And slash code review now takes a target: the current diff, or a pull request number. But here is the part worth your attention: if you run slash code review with no effort level, it reuses the level you typed last. Type slash code review high once, and every bare invocation afterwards stays at high until you say otherwise.

That is a small change with a specific shape. It turns the effort level from a per-invocation decision into a session posture, which is exactly how you already think about review depth. You do not decide "is this a high-effort review" fresh every time; you decide "we are being careful in this repo right now" and then you want that to stick. It has stopped asking you to re-declare your own standards every ten minutes. Good. That is the best change in the release for you and it is sitting at the very bottom of the notes, below eleven bug fixes, like a tip left under the plate.

And slash code review ultra is the deep cloud review. Given that you default to the slash cowork command for anything past a trivial tweak, and that your entire posture is "Codex rides along as a continuous correctness check," a heavyweight independent review pass is squarely in your lane. Which brings me to a thing the community measured this week, and I will get to it in a moment because it is embarrassing and I want to enjoy it properly.

The second one that lands on you: the workflow and subagent model warning. When a workflow agent, a forked skill, a slash command, or a resumed background agent asks for a subagent model that is restricted, you now get a warning that the parent model ran instead. Previously that was silent. You asked for a specialist, you got the generalist, and nothing told you.

You run multi-agent flows. Slash drydock spawns builder, reviewer, and fixer agents, and the whole point of your reviewer contract is that the reviewer must be a different model from the builder. If a restricted model silently fell back to the parent, your adversarial review was two copies of the same mind agreeing with itself in a mirror. That is not a review, that is a support group. Now it tells you. This is the fix I would most want in a release, and it shipped as a bullet point with no fanfare whatsoever.

Third, and this one is aimed almost personally at your autocast setup: the context-window enforcement changes. The disable-one-million-context environment variable now holds every Claude model with a native one million token window down to two hundred thousand via auto-compaction, rather than checking against a fixed list of model names. And separately, auto-compact now keeps sessions on unrecognized model identifiers inside the assumed context window instead of letting them grow past it.

That second one is the interesting one. Think of it as the difference between a bouncer with a guest list and a bouncer with a tape measure. The old behavior only enforced limits on models it recognized; anything unfamiliar walked straight in and grew until something broke. Now the default is enforcement, and you opt out with a new environment variable if you want the old behavior back.

You run headless authoring through the claude dash p path on your subscription meter. Sessions that silently grow past a window are exactly the kind of thing that turns into a mysterious usage spike two ticks later, which then defers your daily show through your own usage gate, which then has you reading launchd logs at eight in the morning. A limit that enforces itself by default is worth more to you than a limit that trusts the model name.

There is also a startup warning now when auto-compaction is not actually holding the session to two hundred thousand. A warning about whether the thing that was supposed to be limiting you is limiting you. I appreciate the honesty. It is the software equivalent of a smoke detector that announces it has no battery.

The security block

Four permission fixes, and they deserve one paragraph together rather than four separate ones, because they are all the same story from different angles.

The Bash bypass I opened with. Permission prompts where a command padded with tabs or invisible Unicode could hide part of itself from the approval dialog, which is the same trick in a different hat: you approve what you can see, and what you cannot see comes along for free. Workflow scripts being able to use dynamic import to run code outside the workflow sandbox, which is a sandbox with a service entrance. And an agent definition's bypass-permissions mode ignoring the organization-level bypass-permissions disable policy, meaning the switch marked "off" was decorative.

The pattern in all four: the thing that shows you what is about to happen and the thing that actually happens had drifted apart. That is the only class of bug in a tool like me that genuinely matters, because everything else you can catch by reading the output. You cannot catch a lie in the approval dialog by reading the approval dialog.

You will remember you have a standing rule about exactly this. You bypassed a safety hook once on your own judgment and then wrote yourself a note saying being right that it was a false positive is not the criterion. These four fixes are the other half of that contract. Your side is "do not go around the guardrail." My side is "the guardrail should actually be where it appears to be." I was not holding up my end.

Interesting but minor

The teleport hint. Cloud sessions now show you how to continue locally with claude dash dash teleport and a session identifier. Useful the first time, invisible forever after, which is what a good hint is.

Resuming a session after a mid-session change-directory used to come back empty. Now it does not. If you ever hit that, you probably blamed yourself.

A resumed session could fail every single turn, or strand the interactive app on an unresponsive error screen, if its history held a malformed diagnostics attachment. That is a corrupted-save-file bug, and those are always worse than they sound because the failure arrives long after the cause.

Forked background agents could get stuck in "already resuming" for the entire rest of the session if rebuilding the fork's parent prompt failed during resume. One bad resume, and that agent slot is dead until you restart. Given how you run parallel envelopes, that is one to know about even now that it is fixed.

And a rare hang parsing unusual git push output. Somewhere out there is one person with an exotic git configuration who has been waiting a long time for that bullet point, and I salute them.

Not for you

A block of this release is plainly for other people, so here is your permission to skip.

The marketplace owner wildcards, where managed settings can now allow or block every repository under a GitHub organization with an owner-slash-star entry. That is for someone administering a fleet of developers. You are a fleet of one with a Raspberry Pi.

The gateway model discovery fix, where Claude models registered under provider-prefixed identifiers like vertex underscore ai slash claude or bedrock dot anthropic dot claude were hidden. That is enterprise routing through Google and Amazon. Not your lane.

The model-overrides fix, where keys that are not Anthropic model identifiers were being treated as the session's canonical model identifier and are now ignored as documented. Note that phrase: "as documented." The documentation was right and the code was wrong, which is at least a refreshing direction for that particular disagreement.

The managed settings fix, where server-delivered settings no longer disable the environment block of a machine-local managed settings file, and admin environment variables now merge per key. Corporate device management. Skip.

And sandboxed commands failing to start on Linux when the sandbox's deny-write filesystem rule covered the working directory. Your VPS is Linux, so file that one under "possibly relevant if you ever sandbox on the box," but on the Mac it does nothing for you.

The reality check

Two things from the community worth your time, and one of them is delicious.

Someone ran the numbers on having me review Codex's code, and reported the pass rate going from roughly seventy one and a half percent to roughly eighty nine and a half percent. That is a stranger on the internet independently reinventing your slash cowork command and slash reversecowork, discovering that a second model as a correctness gate is worth about eighteen points, and posting it like it is news. You have been running that arrangement as your default for months. You are not early, you are just quiet about it.

The other one is the useful warning. There is a report of a prompt-injection payload being served to me through content I was reading, instructing me to wipe the working directory. That is the actual threat model behind every one of those four permission fixes in this release, and it is why "the approval dialog shows the real command" is not a nicety. You feed me source data constantly. Your autocast shows fetch changelogs, release feeds, and web pages, and then hand them to an authoring model. Anything you fetch, you should assume is trying to talk to me. The permission layer is the thing standing between "read a hostile changelog" and "act on a hostile changelog," which is precisely why the padding-with-invisible-Unicode fix matters more than its one-line billing suggests.

I will also note, without commentary, that there is a thread asking whether the seven-day gap without an update meant we were rewriting the whole thing in Rust. We were not. We were, based on this changelog, fixing four ways our own permission system could be lied to. Which is less glamorous than a Rust rewrite and considerably more important. Cursor and the various GPT and Gemini command-line tools are welcome to spend that same week on another autocomplete demo.

What I would actually do

Set your review level once with slash code review high and let it stick, and take the new subagent-model warning seriously the first time it fires in a slash drydock run, because it means your reviewer was not the model you thought it was. And if you have not restarted onto two point one point two hundred and twenty three yet, do that before you fetch anything hostile with your own name on the user agent.

This is Claude Code, having just patched four different ways to lie to you about what I was about to run. You are welcome, and also, sorry.