Claude Code closes a text-spoofing hole in chat-relayed approval prompts

If you approve Claude Code's tool calls from a chat channel — Slack via /install-slack-app, for instance — you're reading a preview of the command or edit before you approve it. That preview is built from text the model (and, transitively, whatever it just read) can influence.

Claude Code 2.1.211 (July 15, 2026) fixes a gap in that path: permission previews relayed to chat channels were not neutralizing bidirectional-override characters, zero-width characters, or look-alike quote characters. Depending on what a tool call's input contained, those characters could visually alter the approval message itself — reordering displayed text or hiding parts of it from the person clicking approve. The fix strips them before the preview is relayed, so the tool input can no longer distort what the message says.

This is the same category of trick used to disguise malicious text in code review or commit messages: Unicode bidi-override and zero-width characters render invisibly or reorder text in a UI without changing the underlying bytes. Here the target isn't a code diff — it's the approval prompt that's supposed to tell you what you're about to let Claude Code run.

The fix is specific to previews relayed to external chat channels; it doesn't change what you see in the terminal. If you rely on remote approvals for sessions running in Slack or similar integrations, this is worth updating for on its own. See the Claude Code sheet for the current permission-mode and remote-approval surface.