Claude Code v2.1.309 fixes over a dozen sandbox and permission bypass bugs
ashwin-ant · ghdev · 2026-10-23
Claude Code v2.1.309 patches a batch of sandbox and permission issues:
- Sandboxed Bash on macOS/Linux no longer runs shell startup files outside the sandbox; denyWrite globs now work through symlinks
- Sandboxed commands and auto-accepted edits can no longer modify the MCP config file passed via --mcp-config; disabled MCP servers stay disconnected
- Bash permission checks close several bypass paths, including wrapped cd in compound commands and subshell redirects defeating Edit(path) deny rules
- Worktree-isolated sessions now reject locale-prefixed and zsh arithmetic command bypasses
- Oversized nested CLAUDE.md files load only their start to stop repeated compaction, plus fixes for ctrl+enter queuing and !-mode slash commands
More from coding & agent
- Artificial Analysis launches Coding Agent Index v2.0 with lower scores across the board — ArtificialAnlys · 2026-10-23
- Coding Agent Index v2.0 scores drop across the board: 20 of 21 configs decline — ArtificialAnlys · 2026-10-23
- SWE-Atlas-QnA-AA benchmark: Muse Wonder Full tops revised repo Q&A grading at 68.8% — ArtificialAnlys · 2026-10-23
- FrontierCode v1.1: Opus 5.5 leads at 56%, mid-pack tightly packed at 43–49% — ArtificialAnlys · 2026-10-23
- Artificial Analysis launches Coding Agent Index v2.0: Claude Opus 5.5 leads at 61.7 — ArtificialAnlys · 2026-10-23
- File-Retrieved Tool Output Makes GPT Agents Substitute Approximations, Costing Accuracy — ucriverside · 2026-10-23