Claude Code adds a Containment Escape rule to auto mode and blocks plugin symlink path escapes
Claude Code v2.1.257, shipped 2026-09-01, adds a Containment Escape rule so cloud metadata-credential fetches, egress evasion and cross-tenant reach are no longer auto-approved in auto mode unless the environment marks them expected, and adds a one-time prompt before the first file read outside the working directories with a `permissions.blockReadsOutsideWorkingDirectories` option. The same release fixes plugins reading files outside their own directory through a declared command, agent, skill or hook path that is a symlink, and fixes Bash Read/Edit deny rules not applying to `< file` redirects or reader commands like `tac` and `egrep`. It also adds `CLAUDE_CODE_SUBAGENT_MODEL_FORCE` to pin every subagent to one model regardless of per-spawn overrides.
↳ Follow the thread