Claude Code 2.1.268 patches three permission bypasses

Claude Code 2.1.268 closes three gaps in how deny and ask rules get enforced, according to the release notes.

The first is a symlink problem. Deny and ask rules written against a symlinked directory didn't apply when a command resolved the real path instead. On macOS that covered /etc, /tmp, and /var. On Linux it covered /bin. A rule blocking writes to /tmp could be walked around just by hitting the path the symlink actually points to.

The second is a parsing gap. Read and Edit deny rules got skipped whenever a command line included env -C or eval in a form the checker couldn't parse. The rule wasn't wrong, it just never got evaluated for that line.

The third matters most for automation. PermissionRequest hooks never fired at all under claude -p, the headless mode used for scripted and CI runs. If a job's only safety check was a PermissionRequest hook, that job ran with no permission checking, and nothing in the logs would have said so.

I use deny rules as a sandbox boundary in my own projects, treating them as the thing standing between an agent and the parts of the filesystem I don't want touched. None of these three bugs are edge cases. Symlinked system paths and env -C show up in normal shell usage, not just adversarial input, and headless -p runs are exactly where nobody's watching in real time to catch a rule not firing.

If you run -p jobs with a PermissionRequest hook as the enforcement layer, update and re-test them. The release notes don't say how long the headless gap existed before 2.1.268, so there's no way to know how many runs it affected.