Claude Code v2.1.289 fixes sandbox bypasses of Bash deny rules and a batch of plugin bugs
ashwin-ant · ghdev · 2026-10-04
Anthropic shipped Claude Code v2.1.289 with a batch of permission and stability fixes:
- Security fixes: Two sandbox auto-allow bypasses where Bash deny/ask rules were skipped — one when an env-var prefix carried an expanded value (e.g. TZ="$HOME" rm -rf build), one when a bare variable assignment preceded the command. Also fixed deny/ask rules not holding on nested parts of compound shell commands, and Read deny rules not applying to @-mentioned, changed, or IDE-selected files via symlinks.
- Plugin system: Numerous fixes including stale copies of locally installed plugins, plugins failing to load in the first session after upgrade, sessions ending when plugin handlers threw asynchronously, and a bug letting user-installed plugins rewrite descriptions of org-managed MCP server sign-in tools.
- Other: Fixed terminal freezes on unclosed <script> tags, reverted a VSCode change that caused frequent sign-outs, and sped up opening large files in plugin code panes.
More from coding & agent
- Dev orchestrates 6 AI skills for a test-fix pipeline, spending just $3/week on DeepSeek — Own-Awareness8037 · 2026-10-05
- fastapi-gql-mcp: one GraphQL MCP surface cuts tool tokens from ~11k to ~2.5k and stops payload bloat — tangkikodo · 2026-10-05
- Tencent Hunyuan's RSR Boosts 27B Model Terminal-Bench 2 pass@3 from 57% to 74% — Tencent-Hunyuan · 2026-10-05
- Yes, AI Can Build a Game Engine — jimmystar889 · 2026-10-05
- UT Austin study: context compression tuned to cut tokens can make coding agents 20-80% slower — omarsar0 · 2026-10-05
- Wavestone dissects Claude Code, Codex and 9 more agents, finds a 7-part harness blueprint — blaizedsouza · 2026-10-05