Eight AI agent permission fixes in a day. Two reverted.

Most teams treat the approval prompt as the safety story. You let the agent run, it asks before it touches anything real, you click yes or no. Two consecutive Claude Code releases this week are a useful reminder that the AI agent permission layer is ordinary software with ordinary defects — eight of them patched on August 14, one more on August 15, and two of the day-one fixes reverted within 24 hours because they broke normal work.

What actually happened

From Anthropic's own changelog, version 2.1.232 fixed or hardened eight separate ways the permission and sandbox layer could be routed around:

• A PowerShell bypass where variable-writing parameters could silently overwrite $PSDefaultParameterValues and redirect where later commands wrote files.
• A Windows bypass where Git Bash followed Cygwin-style symlinks that path validation read as regular files.
• Nested git repositories inheriting trust from a parent directory instead of requiring their own confirmation.
• Remote Control sessions bridged inside a cloud session inheriting that session's transcript or credentials.
• A shared-/tmp socket directory that would accept a pre-planted symlink or another user's directory.
• A protected-path bypass in the Linux filesystem sandbox.
• Project settings being able to override the sandbox's own ripgrep binary.
• Bash input redirections (< file) not being permission-checked the way their argument spellings were.

Version 2.1.233, the next day, closed a Windows NT \??\ device-prefix path that bypassed UNC validation and leaked NTLM credentials. It also reverted the Cygwin-symlink and input-redirection changes from the day before, noting "a narrower version will return in a later release," and fixed a 2.1.232 regression where auto mode kept stopping for approval on ordinary cd <dir> && <command> > file commands.

Why agent permissions matter for your business

Read the revert, not the fix list. A tightened permission check shipped Thursday, generated false stops on routine commands, and was pulled Friday. That is the actual shape of this layer right now: it moves, it over-blocks, it under-blocks, and both failure modes cost you.

We run agents in our own build pipeline, and we do not treat the prompt as the control. The prompt is the last line, not the plan. The controls that held up are the boring ones — a dedicated OS account with no access to production credentials, a network allowlist, secrets in a manager the agent can request from but never read, and a git history you can revert. None of those changed on August 14 or 15, which is the point.

Also worth noting: seven of these eight were Windows or Linux path-handling bugs. If your team runs agents on Windows, you are on the surface with the most edges.

Sources: Claude Code CHANGELOG (Anthropic).