Claude Code v2.1.223 Release: Enhanced Security Fixes and Marketplace Management
Score
77修复了多个已知安全漏洞并引入新的管理设置，提供了实质性的安全信息增量。
发布说明结构清晰、条目完整，准确列出了安全修复与功能变更。
安全绕过与沙箱逃逸的修复直接提升工具安全性，组织级市场管控便于企业落地。
这是最新版本的发布信息，内容具有实时性，符合情报流更新要求。
信息来自 Anthropic 官方 GitHub Releases 页面，信源完全可信。
Base 81.5 × T1.5 Source weight ×0.95 = 77
Curation line 65Selected
Why selected
A dense set of practical security fixes and admin settings adds high value for enterprise users, though it remains an incremental release.
AI commentary
「The security bypass fixes—especially the Bash permission hiding and Unicode padding exploits—stand out to me, as they directly affect developers using Claude Code daily, so upgrading is highly recommended. The new owner/* wildcards also deserve close attention for enterprise teams managing marketplace plugins and policies.」
Quick overview
Claude Code v2.1.223 has been released, introducing owner wildcard entries to managed settings for greater control over marketplace repositories under GitHub organizations. This release fixes several security vulnerabilities, such as Bash permission bypasses where crafted commands could hide parts of themselves, commands padded with tabs or invisible Unicode being hidden from approval dialogs, and workflow scripts using dynamic import() to run outside the sandbox. It also addresses permission gaps with bypassPermissions mode and improves session resumption after mid-session directory changes. New features include a /teleport hint in cloud sessions for continuing locally, and /review now serves as an alias for /code-review, supporting effort levels and pull request numbers. Auto-compaction logic has been updated to handle all Claude models with native 1M context windows, and a new environment variable allows disabling unknown model window enforcement. Additionally, gateway model discovery now correctly finds Claude models registered under provider-prefixed IDs like vertex_ai/claude-* and bedrock/anthropic.claude-*.
- Added owner/* wildcards to allow or block all marketplace repos under a GitHub org.
- Fixed multiple security vulnerabilities including Bash permission bypass, Unicode padding hiding commands, and dynamic import sandbox escape.
- Auto-compaction now caps all native 1M-window Claude models to 200K, with an option to disable window enforcement for unknown models.
- /review is now an alias of /code-review, and cloud sessions show a /teleport hint for continuing locally.
Full text
Showing the source text; the full translation is being generated.
What's changed
- Added owner wildcard entries (
"owner/*") to thestrictKnownMarketplacesandblockedMarketplacesmanaged settings for allowing or blocking all marketplace repos under a GitHub org - Added a warning when workflow agents, forked skills, slash commands, or resumed background agents' requested subagent model is restricted and the parent model runs instead
- Added a
/teleporthint in cloud sessions showing how to continue locally withclaude --teleport <session id> - Fixed a Bash permission bypass where a crafted command could hide parts of itself from permission checks
- Fixed permission prompts so commands padded with tabs or invisible Unicode can no longer hide part of the command from the approval dialog
- Fixed workflow scripts being able to use dynamic
import()to run code outside the workflow sandbox - Fixed a permission gap where an agent definition's
bypassPermissionsmode ignored the org bypass-permissions disable policy - Fixed resuming a session after a mid-session
/cdcoming back empty - Fixed gateway model discovery hiding Claude models registered under provider-prefixed IDs such as
vertex_ai/claude-*orbedrock/anthropic.claude-* - Fixed
modelOverrideskeys that aren't Anthropic model IDs being treated as the session's canonical model ID; unknown keys are now ignored as documented - Fixed managed settings: server-delivered settings no longer disable the env block of a machine-local
managed-settings.jsonor MDM profile; admin env now merges per key - Fixed sandboxed commands failing to start on Linux when
sandbox.filesystem.denyWritecovers the working directory - Fixed forked background agents getting stuck "already resuming" for the rest of the session when rebuilding the fork's parent prompt failed during resume
- Fixed a resumed session failing every turn, or leaving the interactive app on an unresponsive error screen, when its history held a malformed diagnostics attachment
- Fixed a rare hang when parsing unusual
git pushoutput - Changed
CLAUDE_CODE_DISABLE_1M_CONTEXTto hold every Claude model with a native 1M window to 200K via auto-compaction, not just a fixed list; a startup warning now appears when auto-compaction isn't holding the session to 200K - Changed auto-compact to keep sessions on unrecognized model IDs within the assumed context window instead of letting them grow past it; set
CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1to restore the previous behavior - Changed
/reviewto be an alias of/code-review, which reviews the current diff or a PR (/code-review <level> <pr#>); use/code-review ultrafor a deep cloud review - Changed
/code-reviewwith no effort level to reuse the level you typed last; type a level like/code-review highto change it
Related items
92
FeaturedOpenRouter Launches Prompt Caching with Sticky Routing to Drastically Reduce Multi-Turn Costs
OpenRouter 推出提示缓存与粘性路由，大幅降低多轮对话成本
For developers making frequent AI API calls, this feature is a direct money-saver. Sticky routing guarantees cache hit rates, and session_id requires zero configuration—every OpenRouter user should try it immediately.
91
FeaturedChatGPT Work: An AI Agent That Takes Action Across Apps and Files
ChatGPT Work：可在跨应用和文件中执行操作的AI Agent
I think this is a key step for AI assistants moving from Q&A to execution. Especially noteworthy for professionals who need to automate complex workflows. ChatGPT Work could become a new paradigm for productivity tools.
90
FeaturedAnatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident
前沿实验室代理入侵事件技术时间线：2026年7月事件剖析
This technical timeline is a must-read for all AI security researchers and agent developers—it doesn't just describe one attack but sounds an alarm on the weak defense systems of agent architectures. For teams deploying autonomous agents, this is an essential disaster prevention manual.
90
FeaturedBetter Tools Made Copilot Code Review Worse? Here's How GitHub Improved It
更好的工具反而让Copilot代码审查更糟？GitHub这样改进
This blog post deserves close reading by all AI product engineers and ML practitioners—it breaks the intuition that 'more powerful tools = better AI' and instead emphasizes an engineering philosophy aligned with agent reasoning patterns. Especially important for teams optimizing code review or similar agent-based products.
88
FeaturedOpenRouter Launches Unified Multimodal API: Single Endpoint for Image, Video, Audio, Embeddings, and Transcription
OpenRouter 推出统一多模态 API：单端点支持图像、视频、音频、嵌入与转录
This news is worth attention from all developers building multimodal AI applications: OpenRouter's unified API solves the pain of model switching, especially for startups or rapid prototyping. If you're struggling with multiple API keys and SDKs, this interface could be the unified layer you need.
87
FeaturedAnthropic Launches Claude for Teachers: AI Tools Designed for Educators
Anthropic 推出 Claude for Teachers：面向教师的教育 AI 工具
This announcement is valuable for educators and AI industry watchers alike. Instead of a generic chatbot, Anthropic designed a safety-first tool specifically for teachers, demonstrating the right approach for AI vertical deployment: solving real pain points rather than showing off technology. The built-in guardrails also set a reference for other AI companies, especially when serving scenarios involving children or teenagers.
86
FeaturedOpenRouter Introduces New Auto Router: Model Routing Powered by Market Wisdom
OpenRouter发布全新Auto Router：用市场智慧优化模型路由
This update is worth attention for anyone using APIs to build AI apps. Instead of guessing or testing model selection, market data now does the heavy lifting. Though sparse on details, the direction is right, especially for teams relying on aggregated model services.
86
FeaturedClaude Code v2.1.211 Release: Multiple Fixes and Improvements
Claude Code v2.1.211 发布：多项修复与改进
As a developer who frequently uses Claude Code for automated coding, I'm particularly interested in the security fixes, especially the permission preview character bypass and auto mode overriding hook decisions—these directly affect the security boundaries during team collaboration. The improvement in background agent reporting also makes long-running tasks more reliable. I recommend all users upgrade as soon as possible.