Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-09-02 · high
The release also fixes a Bash deny-rule bypass and a macOS Monterey launch failure that had broken the app since 2.1.255.
Why now: Anthropic posted 2.1.257 and the 2.1.258 follow-up back to back, both showing up in the release notes as of September 2, 2026.
Claude Code 2.1.257 adds a permission rule Anthropic calls Containment Escape. In auto mode, the assistant no longer auto-approves cloud metadata-credential fetches, egress evasion, or cross-tenant reach unless the environment marks them expected. Anthropic details the change in Claude Code's 2.1.257 release notes. The release also adds a one-time prompt before the first file read outside a project's working directories, plus a permissions.blockReadsOutsideWorkingDirectories setting to block them entirely.
It also closes a plugin path escape. A plugin's declared directory could be a symlink, letting it read files outside its own folder. Separately, Bash deny rules for Read and Edit weren't catching < file redirects, or readers like tac and egrep. A blocked file could still leak through a shell command that way.
A new CLAUDE_CODE_SUBAGENT_MODEL_FORCE environment variable pins every subagent to one model, overriding any per-spawn choice. It's useful for teams that need a whole fleet of agents running the same weights. The same day, Anthropic shipped 2.1.258 to fix a launch failure on macOS 12 Monterey that had broken the app across 2.1.255 through 2.1.257.
I run Claude Code unattended in cloud sandboxes for background jobs, so the containment fix matters more to me than the model-pin flag does. The plugin symlink bug and the Bash redirect gap are the same kind of bug: a permission check that trusted a stated path instead of the one it resolved to.
Each link below shares sources, entities, or timing with this story.
Two things in one release, and only one of them is in the security section. CLAUDE_CODE_SUBAGENT_MODEL used to override the model for every subagent. In 2.1.251 it sets the default instead. An agent definition's model: frontmatter now wins, and so does an explicit per-spawn mo...
Released August 15, v2.1.233 fixes Windows paths written with the NT device prefix \??\ slipping past UNC path validation. It follows the Git Bash Cygwin-symlink bypass and the PowerShell variable-writing parameter bypass in 2.1.232. The same release stops nested git repositor...
Anthropic released Claude Fable 5.1 on September 1. Claude Code v2.1.257 made it the default Fable model at 17:53 UTC that day, with a 1M-token context window, $10 per million input tokens, $50 per million output, and $0.25 per million on cache reads (claude-code CHANGELOG). B...
A spec is a press release until someone who didn't write it implements it. GitHub made Agent Plugins 1.0 generally available on August 12 across VS Code, Copilot CLI, the Copilot SDK, and the Copilot app on all plans. The spec, published August 6, was co-authored by AWS, Anysp...
v2.1.218 took dangerous-rm, background-&, and suspicious-Windows-path checks out of permission dialogs, and stopped prompting in plan mode for Bash the static analyzer can't prove read-only. /deep-research also now starts only when you invoke it. Fewer interrupts, but a model...
Roo Code announced it will archive its VS Code extension repo on May 15 and merge back into Cline, the project it originally forked from. CEO Matt Rubens said the team needs to "constantly destroy and recreate to keep up with what's newly possible." Translation: the extension...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.