Fetching from the wire…
01
02
03
04
05
06
07
08
Tools2026-09-15 · source-backed
2.1.268 had three, 2.1.269 closed a tee write bypass past Edit deny rules, 2.1.270 reverted a permission regression its own security release introduced, and now 2.1.271 has four more (Claude Code changelog). I don't read that as sloppiness. I read it as evidence that pattern-matching a shell command to decide what it will touch is the wrong shape of defense. Treat Bash deny rules as leaky and put the real boundary in the sandbox.
Each link below shares sources, entities, or timing with this story.
The changelog shows sandbox filesystem deny entries being bypassed on Linux and macOS: specifically, denyRead: "~/.aws/" written with a trailing slash was silently ignored. That follows the zsh regex bypass, the PreToolUse auto-allow bypass, and the tabs/invisible-Unicode prom...
v2.1.218 took dangerous-rm, background-&, and suspicious-Windows-path checks out of permission dialogs, and stopped prompting in plan mode for Bash the static analyzer can't prove read-only. /deep-research also now starts only when you invoke it. Fewer interrupts, but a model...
Two things in one release, and only one of them is in the security section. CLAUDE_CODE_SUBAGENT_MODEL used to override the model for every subagent. In 2.1.251 it sets the default instead. An agent definition's model: frontmatter now wins, and so does an explicit per-spawn mo...
Deny and ask rules on symlinked directories didn't apply when a command used the real path. That covered /etc, /tmp and /var on macOS and /bin on Linux (release). Read and Edit deny rules were also skipped when an env -C or eval command the checker couldn't parse appeared on t...
Claude Code 2.1.251 fixes checks that auto-approved commands assigning an arithmetic expression to an integer shell variable, naming OPTIND=1/0 and RANDOM=2+2. Both now prompt. The same release changes how Bash command output files are created and read back in the sandbox so a...
The August 7 release adds claude self-hosted-runner so Team/Enterprise customers can host web, mobile and desktop sessions on their own machines or containers, plus cross-session SendMessage/ListAgents so sessions on any of your machines can message each other (macOS and Linux...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.