Claude Code v2.1.211: 権限プレビュー偽装対策とBedrock課金バグを修正Claude Code v2.1.211 patches a security vulnerability that allowed spoofing of…

Anthropic has released Claude Code version 2.1.211, a maintenance update that addresses two distinct issues: a security vulnerability that could allow an attacker to spoof the tool's permissions preview screen, and a billing calculation error affecting users who run Claude Code through Amazon Bedrock. Both fixes matter because they touch the parts of the tool that users are expected to trust most directly, namely the interface that governs what actions an AI agent is permitted to take and the accounting that determines how much a session costs.

Claude Code is Anthropic's command-line coding agent, a terminal-based tool that lets developers delegate tasks such as editing files, running commands, and searching a codebase to a Claude model. Because the agent can execute real actions on a developer's machine, it uses a permission system that pauses to ask for confirmation before performing sensitive operations. The permissions preview is the screen that shows the user what the model is about to do, for example which shell command it intends to run or which file it wants to modify, so the user can approve or reject it. This human-in-the-loop checkpoint is a foundational safety mechanism for agentic coding tools, and its integrity depends on the preview accurately reflecting the action that will actually be carried out.

The vulnerability patched in this release appears to have undermined that guarantee. According to the release information, the flaw allowed the permissions preview to be spoofed, meaning the content displayed to the user could be made to differ from the operation that would ultimately execute. If exploited, such a discrepancy could lead a developer to approve something they did not intend, for instance by presenting a benign-looking command while a different or more dangerous one runs underneath. This class of problem is significant for any system that relies on user consent, because the security model assumes that what the user sees is what the user is agreeing to. Spoofing risks are especially relevant in agentic workflows where instructions or content may originate from untrusted sources, such as web pages, repositories, or files that the model reads during a task, raising the possibility of prompt-injection-style manipulation. The v2.1.211 fix is intended to restore the preview's fidelity so that the displayed action matches the executed one.

The second fix concerns Amazon Bedrock, the managed AWS service through which organizations can access Anthropic's Claude models alongside models from other providers. Claude Code can be configured to route requests through Bedrock rather than Anthropic's own API, an option many enterprises prefer because it keeps usage within their existing AWS accounts, billing relationships, and governance controls. The update corrects a bug in which billing or cost calculations were not being computed correctly for Bedrock users. While the release notes do not specify the exact magnitude or direction of the error, incorrect usage accounting can affect budgeting, cost tracking, and reconciliation, so accurate token and cost reporting is important for teams that need to attribute spending or stay within limits.

For context, Claude Code has been shipping frequent incremental releases, and updates in the 2.1.x line have generally combined small feature refinements with reliability and security fixes. This cadence is common across the current generation of AI coding assistants, a category that also includes tools such as GitHub Copilot's agent features, Cursor, and various open-source command-line agents. As these tools take on more autonomous behavior, the surrounding safeguards, including permission prompts, sandboxing, and clear previews of pending actions, become as important as the underlying model's capabilities. Security researchers and vendors have increasingly focused on how agents handle untrusted input and how faithfully their interfaces represent intended operations.

Users running Claude Code are generally advised to update to the latest version to receive the fixes, particularly given the security nature of the permissions issue. Those who access Claude through Amazon Bedrock have an additional reason to upgrade in order to benefit from the corrected billing behavior. As with any release, the practical impact will depend on how each team uses the tool, but the combination of a security patch and a cost-accuracy correction makes v2.1.211 a worthwhile update for most active users.