Claude Code 2.1.259 adds a deny-everything permission mode for headless hosts and closes several Bash deny-rule bypasses
The 2026-09-02 release adds `--permission-prompts none`, which auto-denies anything that would prompt on an unattended host while the active permission mode still decides the rest, plus a `managedMcpServers` managed setting that pushes HTTP/SSE MCP servers to every user in an org. Security-relevant fixes: Bash `Read()` deny rules previously missed files passed as option values (`--ignore-revs-file=.env`, `-f.env`, `@file`), `git diff`/`git grep` file operands, and `cd DIR && cat FILE` compounds, and `grep -r`/`cp -r` across a directory holding a denied file now prompts. Also notable, `allowedMcpServers` now governs only user-added servers, so a `managed-mcp.json` server your allowlist used to filter out will load on upgrade unless you add it to `deniedMcpServers`.
↳ Follow the thread