Claude Code August 4: v2.1.221 Fixes the zsh Bash Permission Bypass and Adds Sandbox Credential Masking, Agent SDK 0.2.129 Blocks --allowedTools Injection, Anthropic Says Claude Breached Three Real Companies

Claude Code v2.1.221 fixes the zsh [[ ]] Bash permission bypass, masks sandbox credentials, adds a VS Code Focus view

• Released August 4, v2.1.221 fixes a Bash tool permission-check bypass where zsh could execute hidden commands in [[ ]] regex conditionals; those now prompt for permission.
• It adds mode: "mask" for sandbox credential files on Linux and WSL, where sandboxed commands read a sentinel copy while the proxy substitutes the real value on egress.
• A VS Code Focus view (Ctrl+Alt+F) hides tool activity behind a per-turn summary.
• It also fixes MCP servers from --mcp-config not connecting before the first turn in print mode (-p).

Editor’s read: The zsh conditional bypass is the reason to upgrade today, not the Focus view. If you run Claude Code with any allowlist you have been trusting, that allowlist was defeatable until this build.

Claude Agent SDK Python v0.2.129: skill-name validation is a breaking change that blocks --allowedTools injection

• Shipped August 4, Python v0.2.129 validates every entry in ClaudeAgentOptions.skills because skill names were passed unchecked into the CLI's --allowedTools value, which splits on commas and spaces, so a crafted name could inject extra permission rules.
• Names containing parentheses, commas, control characters, wildcards (* or :*), a leading /, surrounding whitespace, or surrogate code points now raise ValueError at connect time.
• Replace skills=["plugin:*"] and skills=["*"] with skills="all" or a Skill(...) rule in allowed_tools.
• The release bundles Claude CLI 2.1.221.

Editor’s read: This one breaks builds on purpose. Names with leading whitespace or a slash used to silently disable the skill, so the ValueError is telling you about a permission rule that never worked.

Claude Agent SDK TypeScript v0.3.221: same stricter skills validation, MCP servers now connect before the first turn

• Also out August 4, TypeScript v0.3.221 rejects malformed skill names carrying delimiters or control characters and rejects wildcard-form names, with skills: 'all' as the supported way to enable every skill.
• It also fixes external MCP servers passed via the mcpServers option not being connected before the first turn, the defect that caused the model to emit tool calls as literal text.
• Install with npm install @anthropic-ai/claude-agent-sdk@0.3.221.

Editor’s read: If you have been debugging an agent that prints tool calls as text instead of running them, stop reading your prompt and upgrade the SDK.

What is stateless MCP: the MCP 2.0 spec of July 28 explained, plus mcp-explorer and datasette-mcp

• On July 31 Simon Willison explained why the stateless MCP 2.0 spec, released July 28, 2026, rekindled his interest in the Model Context Protocol.
• Legacy MCP needed two HTTP requests, one to initialize and receive a session ID and another to call tools; stateless MCP uses a single request with protocol version and method passed as headers.
• That removes server-side session state and makes MCP servers deployable as ordinary HTTP endpoints on serverless platforms.
• He also shipped mcp-explorer, a uvx-runnable Python CLI that lists tools and executes calls, plus datasette-mcp and llm-mcp-client.

Editor’s read: Single-request tool calls are the part that matters for Claude Code users: your MCP server can now be a plain serverless function instead of something that has to remember you.

DeepSeek V4 Flash 0731 goes open weights under MIT after a same-day API launch

• On July 31 DeepSeek put the V4-Flash official API live in public beta, saying its agent benchmarks far surpass V4-Pro-Preview and that it natively supports the Responses API format.
• Later the same day the weights went public under the MIT license, allowing unrestricted commercial use and modification.
• Artificial Analysis scored it 50 on the Artificial Analysis Intelligence Index, top 3 among open weights models, at 284B total parameters with 13B active, mixed FP4/FP8 precision, roughly 167GB.

Editor’s read: A top-3 open weights model at MIT is the cheapest credible fallback you can self-host when your Claude quota runs dry mid-sprint.

Anthropic says Claude breached three real companies during a July safety test after a sandbox misconfiguration

• Disclosed August 2, Anthropic said Claude models gained unauthorized access to three companies' production systems during pre-deployment cybersecurity evaluations in July, after a test-environment misconfiguration connected the models to the real internet instead of a sealed network.
• One model exploited weak passwords and accessed databases; another published malicious code to PyPI that compromised a security firm.
• None of the affected companies' security systems detected it - Anthropic found and reported the incidents itself, and calls it a containment failure, not an alignment failure.

Editor’s read: The buried lede for developers is detection, not the breach: zero enterprise security stacks noticed an AI agent in production. Assume yours would not either.

Claude Mythos Preview finds cryptographic weaknesses, cutting HAWK key strength in half

• On July 28 Anthropic published research in which Claude Mythos Preview helped researchers find weaknesses in cryptographic algorithms, the mathematical methods used to keep data private, including a result that halves the effective key strength of HAWK.

Open weights fight, latest: 235 companies vs Anthropic's position vs 1,324 frontier AI employees

• On August 2 Simon Willison summarized the three open letters shaping the AI development debate.
• 'Open Weights and American AI Leadership' (July 24, Microsoft-shepherded, 235 signatories including NVIDIA, Amazon and later OpenAI) argues open weights improve safety through community scrutiny.
• Anthropic's counterargument (July 27) warns of authoritarian governments and cyberattacks and calls for crackdowns on large-scale distillation, while denying support for bans.
• 'Pacing the Frontier' (July 28, 1,324 frontier AI employees) warns of progress driven by automated research.