Claude Code v2.1.251 fixes a symlink swap that let file tools read and write outside the approved directory

GitHub·high signalXBlueskyLinkedInCopy link

The 2026-08-28 release fixes Read, Write and Edit following a symlink swapped inside the working directory after the permission check had already run, a TOCTOU that could reach outside the approved location, and separately fixes Grep and Glob not applying `Read(...)` deny rules through a symlinked search path. It also rejects plugin commands whose marketplace entry points outside the plugin directory with a path-traversal error, and blocks project settings from enabling raw API body logging or redirecting beta tracing past a managed OTLP collector. New non-security work includes `PreModelSwitch`/`PostModelSwitch` hooks and a per-session prompt-cache line in `/cost` exposing hit ratio and tokens re-cached.