# claude-code-silently-patched-five-permission-and-hook-bypasses-across-2: Claude Code Silently Patched Five Permission and Hook Bypasses Across 2.1.216 to 2.1.222

> Claude Code Silently Patched Five Permission and Hook Bypasses Across 2.1.216 to 2.1.222 is a high-severity privilege escalation issue in Claude Code, an AI agent. Affected: Claude Code < 2.1.222. Fixed in 2.1.222.

- **Canonical URL:** https://catalog.anomity.ai/vuln/claude-code-silently-patched-five-permission-and-hook-bypasses-across-2
- **Aliases:** ti-069
- **Severity:** high
- **Attack type:** Privilege escalation, Sandbox escape
- **Component:** Claude Code (AI agent)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-08-04
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/claude-code-silently-patched-five-permission-and-hook-bypasses-across-2

## Summary

Five releases between 20 July and 4 August each fixed a security-relevant bypass, recorded only as changelog bullets with no advisory or CVE: Bash permission checking missed compound statements with redirects (2.1.216), background-session isolation failed to canonicalize symlinked directories (2.1.217), agent frontmatter hooks executed from untrusted folders (2.1.218), a Bash permission check could be bypassed with zsh regex conditionals (2.1.221), and a PreToolUse auto-allow hook bypass plus a worktree-isolation escape (2.1.222). 2.1.219 also added sandbox.network.strictAllowlist. Because none of these carry an advisory, version currency is the only signal a fleet has.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| Claude Code < 2.1.222 | 2.1.222 |

## Am I affected by this vulnerability?

You are affected if you run Claude Code < 2.1.222. Versions 2.1.222 and later include the fix.

## How do I fix it?

Upgrade Claude Code to 2.1.222 or later and enforce a minimum version across the fleet. These fixes ship without advisories, so a tool_version policy is the practical control: an out-of-date agent here means live permission bypasses, not just missing features.

## How do I find every machine running Claude Code?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Claude Code and which version, then enforce a policy on it.

## References

- article: https://github.com/anthropics/claude-code/releases

## Related vulnerabilities

- [a-repo-defined-claude-code-subagent-downgraded-its-own-security-review](https://catalog.anomity.ai/vuln/a-repo-defined-claude-code-subagent-downgraded-its-own-security-review) — medium
- [plugin4shell-sha-pinning-bypass-gives-zero-click-rce-across-claude-code](https://catalog.anomity.ai/vuln/plugin4shell-sha-pinning-bypass-gives-zero-click-rce-across-claude-code) — critical
- [CVE-2026-54316](https://catalog.anomity.ai/vuln/cve-2026-54316) — high
- [CVE-2026-46406](https://catalog.anomity.ai/vuln/cve-2026-46406) — medium
- [CVE-2025-59536](https://catalog.anomity.ai/vuln/cve-2025-59536) — critical
- [CVE-2026-21852](https://catalog.anomity.ai/vuln/cve-2026-21852) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=claude-code-silently-patched-five-permission-and-hook-bypasses-across-2