The short version: between August 4 and 6, the three coding agents most founders actually run in a terminal — Claude Code, OpenAI's Codex CLI, and Google's Gemini CLI — each shipped a security release. They landed in the same 48 hours because they are all reacting to the same thing: the more autonomously an agent runs, the more the permission and sandbox layer becomes the attack surface. One of the fixes, in Claude Code, is a genuine permission-bypass class bug. If you point any of these at a live repository, update today.

The one that matters most: Claude Code 2.1.223#

Claude Code's v2.1.223 (August 6) fixed a Bash permission bypass where "a crafted command could hide parts of itself from permission checks." Concretely, the changelog notes commands padded with tabs or invisible Unicode could keep part of themselves out of the approval dialog (Claude Code changelog).

Sit with what that means. Claude Code's whole safety story for shell access is you see the command and approve it. This bug let an attacker craft a command that rendered as one thing in the prompt you approved and did another when it ran — the hidden tail never appeared in the dialog. It's the exact failure mode of trusting a human-in-the-loop prompt as a boundary: the boundary is only as good as the rendering, and the rendering was spoofable.

The same build closed two more:

And v2.1.222 two days earlier (August 4) had already stopped worktree-isolated sessions and their subagents from running destructive git commands against the main checkout — isolation now applies to file edits and Bash in every session type. Two builds, four permission holes closed, in 72 hours. That cadence is the story.

Codex CLI and Gemini CLI moved the same week#

This wasn't a Claude-only scramble.

Three vendors, three codebases, one week, one theme: lock down what the agent is allowed to do without asking, and make the sandbox tighter.

When every competitor in a category ships the same class of fix in the same week, it's not a bug report — it's the category admitting where the risk actually lives.

The money is pointed at the same spot#

If you want confirmation that this is structural and not a coincidence, follow the capital. On August 3, Zenity closed a $125M Series C (led by Norwest, with SoftBank Vision Fund 2, Hitachi, LG, and Intel Capital participating) to build a security layer for autonomous agents — its pitch is securing "the era of 1 billion AI agents" (SiliconANGLE). The CLI vendors are hardening the permission model from the inside; investors are funding a governance layer on the outside. Both are betting the same way.

What to actually do#

  1. Update all three you use, today. Claude Code to ≥2.1.223 (claude update, confirm with claude --version); Codex CLI to rust-v0.146.1+; Gemini CLI to 0.54.0 (npm install -g @google/gemini-cli@latest).
  2. Re-check your config, not just your version. A patch doesn't undo an allow: * you set months ago, a trusted-folder that shouldn't be trusted, or a stray --dangerously-skip-permissions. Verify any org-level bypass-disable policy actually holds now that Claude Code enforces it.
  3. Stop treating the prompt as the boundary. This week's headline bug was the approval dialog itself being spoofable. Put a real boundary underneath it — a sandbox with a deny-by-default network allowlist and least-privilege credentials — so a bypassed prompt isn't game over. That's the durable version of this story, and we made it its own how-to: your agent's approval prompt is not a security boundary.

For the feature-by-feature view of which of these terminal agents to run in the first place, see our Claude Code vs Codex CLI vs Gemini CLI comparison. For the deeper Claude Code sandbox mechanics — credential masking, egress proxying — see what v2.1.221 changed. The versions will keep moving. The lesson underneath them won't: an autonomous agent needs a boundary that holds even when the prompt doesn't.