Claude Code Permission Fixes and Purview's 5x Label Lift

Claude Code v2.1.214 Closed Four Permission-Bypass Bugs — Audit Your Allow Rules Now

If you have Claude Code deployed across an engineering team, v2.1.214 is not an optional update. The release patched four distinct permission-check failures:

• Edit(src/**) allow rules were auto-approving writes to any nested directory in the tree, not just /src/
• A permission-check bypass specific to Windows PowerShell 5.1 sessions
• Bash permission checks failing open on file-descriptor redirect forms that the analyzer parsed differently than bash itself
• Commands over 10,000 characters bypassing the check entirely and running automatically

The Windows PowerShell bug is the one that will catch enterprise teams flat-footed. Most Claude Code deployments I've seen use a mix of WSL and native PowerShell sessions, and the teams running PowerShell 5.1 — which is still the default on unpatched Windows Server images — had no effective permission boundary on the tool. That's not a theoretical risk on a 5,000-developer tenant; that's a live exposure.

What to do: Force the update via your endpoint management tool before the next business day. If you are on a managed enterprise rollout with a pinned version, unpin it for this release specifically. After updating, audit your settings.json allow rules — any dir/** pattern that was working as a catch-all was doing so because of the bug, not because the rule was correctly scoped.

The same release also fixed zsh variable subscript misparse and several other shell-parsing edge cases covered in the full changelog.

---

Purview Auto-Labeling Jumps to 500K Files Per Day — The Copilot Readiness Math Changes

Microsoft 365 Roadmap item 567890 quietly raised the SharePoint and OneDrive auto-labeling cap from 100,000 to 500,000 files per tenant per day. GA is August 2026, with preview available September 2026 (the roadmap dates appear inverted; assume GA in August, preview already underway in some tenants).

For a healthcare or financial services client with 20 million unlabeled documents sitting in SharePoint, the old cap meant a mandatory multi-month labeling runway before Copilot could be trusted with that content. At 500K/day the same estate gets labeled in roughly six weeks instead of six months — assuming your auto-labeling policies are tuned, your trainable classifiers are deployed, and you're not relying on manual review as a gate.

Most tenants I've looked at are not in that state. They have auto-labeling policies scoped only to the content types someone got around to configuring in 2023. If you push this lever and your policies are under-scoped, you get speed without coverage — which is worse than slow, because it creates a false confidence signal going into Copilot activation.

What to do: Before the August GA, run a Purview content explorer pass against your SharePoint estate and identify the top five unlabeled content categories by volume. Scope trainable classifiers or keyword policies to cover those before the scale increase kicks in. The capacity is only useful if the policies behind it are accurate.

---

MCP Tunnels Land in Both Anthropic SDKs

Both the TypeScript SDK v0.112.0 and Python SDK v0.117.0 shipped MCP Tunnel support in the same release window. The Python SDK also added a dreaming API parameter and fixed credential material leaking into traceback frame locals via SecretStr — that last fix matters for any deployment where exceptions are logged to a SIEM.

MCP Tunnels let a remote Claude session connect to a locally-hosted MCP server over an authenticated tunnel rather than requiring the server to be publicly reachable. For clients running MCP servers inside a private VNet — a database context server, an internal API gateway, a code-analysis tool — this removes the current requirement to either open an inbound port or deploy the MCP server to a public endpoint.

What to do: If you have MCP servers running inside a private network today and are working around the connectivity constraint with a reverse proxy or public exposure, test the tunnel approach in a dev environment. The ergonomics are materially cleaner and the credential-in-traceback fix alone is worth the SDK bump.

---

Claude Fable 5 Stays on Subscription Plans — Competitive Pressure Made It Permanent

Simon Willison covered the announcement: starting July 20, Claude Fable 5 is included in all Max and Team Premium plans at 50% of limits. The original plan was to pull it from subscriptions and move it to API-only pricing. Competitive pressure from GPT-5.6 Sol and Kimi K3 (which Moonshot AI is promising as open weights by July 27) made that untenable.

For clients on Team plans who were budgeting for an API-tier uplift to maintain Fable 5 access, that budget pressure is gone — for now. The 50% limit cap is the tradeoff. For heavy agentic workloads running long Fable 5 sessions, the cap will bind. Plan accordingly and monitor usage against that ceiling during the first billing cycle.

---

Agent2Agent Protocol Support Lands in M365 Copilot — Watch the August GA

Roadmap item 567670 confirms that agents published to Agents 365 can now be used as connected agents inside Agent Builder and Copilot Studio if they implement the Agent2Agent (A2A) protocol. GA is August 2026.

The governance implication: any A2A-connected agent inherits the calling agent's permission context unless you explicitly scope it otherwise. On a tenant where Copilot Studio agents are already running with broad SharePoint access, a misconfigured A2A connection is a data-access boundary problem waiting to manifest. This is worth a dedicated policy review before August GA — specifically, which agents in your Agents 365 catalog are eligible for A2A connections and what access scopes they carry.

---

Watch next week for the Kimi K3 open-weight release, expected July 27 — the 2.8T parameter model will stress-test Claude Fable 5's position at the top of the reasoning benchmark stack and likely trigger another round of Anthropic pricing or access adjustments.