Claude Code fixes Slack approval spoofing

Claude Code 2.1.211, released July 15, fixes a bug in how permission-approval previews get relayed to chat channels like Slack, which reviewers use to approve remote or background agent actions without opening a terminal. Per Anthropic’s changelog, that preview text did not neutralize bidirectional-override characters, zero-width characters, or look-alike quotation marks, so a crafted tool input could visually alter the approval message a human actually sees. A dangerous command could be made to look harmless right up until someone clicked approve. The fix sanitizes the preview text before it renders in chat.

The same release adds a --forward-subagent-text flag (and CLAUDE_CODE_FORWARD_SUBAGENT_TEXT environment variable) to surface subagent text and thinking in stream-json output. It also fixes subagents with an explicit model override reverting to the parent model on resume, plus a prompt-caching billing regression on Bedrock, Vertex, Mantle, and Foundry that charged trailing system context as fresh input tokens on every request. The prior release, 2.1.210 on July 14, added a live elapsed-time counter to tool-summary lines and startup warnings for risky Write(path), NotebookEdit(path), and Glob(path) permission rules.

This fix matters most for teams running coding agents that work while you are away and reviewing approvals through a chat surface rather than the terminal. That relay step, not the agent’s reasoning, was the weak point. It follows a separate fix this week to Claude’s web_fetch tool leaking data through page links, and the two share a theme: the risk was never that the model would misbehave on its own, but that the narrow channel it uses to act, or to be supervised, could be tampered with. Update to 2.1.211 if approvals route through Slack or another chat integration, and treat any garbled or oddly spaced text in an approval prompt as a reason to check the raw command before approving it.