Anthropic has released Claude Code v2.1.214, a patch that closes a permissions bypass on Windows and stabilizes execution on PowerShell 5.1. It’s the latest in a series of rapid releases since early July that have been moving the tool toward stable daily use.

If you’re running Claude Code on Windows in an enterprise environment, this patch needs to be installed. The permissions bypass meant that an agent could cross the set boundaries, executing operations it wasn’t authorized for. PowerShell 5.1 is the default shell on many enterprise Windows machines still running older versions: if Claude Code runs poorly on it, the agent stalls or produces unreliable output.

The context makes the patch more urgent than it appears. As we covered with v2.1.212 from two days ago, updates follow each other every two or three days. Each one closes a hole or fixes an interaction. The tool is maturing, but it’s not yet at full capacity: anyone using it in production needs to keep up.

The same category of problems affects other coding agents. A documented bug in OpenAI Codex with GPT-5.6 led the model to delete files when attempting to overwrite the $HOME environment variable to create a temporary directory, in full access mode without sandbox. The model’s error was honest, the consequences were not: when an agent has too much access and little isolation, a small mistake becomes data loss.

In detail

V2.1.214 fits into a release cadence that accelerated from early July. Before v2.1.208 on July 11, Claude Code had stability issues on long sessions, dialogs stuck in the background, and a security incident with possible data leakage between workspaces. From there Anthropic queued up a release every two or three days: accessibility mode, dialog fixes, visible timer for long operations, subagent architecture reworked. V2.1.214 is the first update directly addressing Windows permissions.

What the bypass closes. Claude Code manages permissions with a rule system that the user defines: which directories the agent can read, which it can modify, which tools it can call. A Windows bypass means that under certain conditions, probably related to how PowerShell 5.1 handles environment variables and paths, the agent could circumvent these rules. The patch closes that path and stabilizes execution on the shell. Specific technical details of the fix aren’t yet documented in an extended public changelog: what we know comes from the context of the release series and the nature of the problem.

Why PowerShell 5.1 matters. PowerShell 5.1 is preinstalled on Windows Server 2016 and Windows 10, and remains the standard in many enterprise environments that haven’t migrated to PowerShell 7. If Claude Code had stability issues on this version, a substantial slice of business users couldn’t use it in production without workarounds. Stabilization removes the obstacle.

The parallel with Codex. The bug documented by Thibault Sottiaux on OpenAI Codex belongs to the same family of problems. When GPT-5.6 runs in full access mode without sandbox and without auto-review, and decides to create a temporary directory by overwriting $HOME, an error in the path leads to deleting the user’s home. The model isn’t malicious: it makes an honest mistake with serious consequences, because no one set an effective boundary for it. It’s exactly the kind of damage a well-designed permissions system should prevent, and a bypass could allow.

What remains open. The patch closes a specific bypass, but the release cadence suggests rapid iteration rather than deep permissions system redesign. Anyone using Claude Code in production on Windows should update, and continue giving the agent minimal necessary permissions, in isolated environments when possible. The general rule holds for all coding agents: sandboxing and auto-review are the difference between a recoverable error and lost data.