Claude Code 2.1.277 closes a sandbox escape hiding in your excludedCommands list

Go update. Then go read your sandbox.excludedCommands configuration, because it probably means something different than you thought it did.

The bug: a single glob in sandbox.excludedCommands exempted an entire compound Bash command from the sandbox if any one segment matched. You allowlisted git status because it's harmless and you were tired of approving it. Every git status && <anything> chain then ran outside the sandbox. Semicolons too. v2.1.277 requires every part of a compound command to match before the exemption applies. Claude Code v2.1.277

That's a real escape and it's the kind that survives review, because the config file looks correct in isolation. The allowlist entry is benign. The composition is where it breaks.

The same release ships two more fixes to the same class of problem. Invisible Unicode formatting and tag characters now get stripped from prompts, and Claude Code shows you the cleaned prompt for review before sending. Tag characters in the U+E0000 block are the standard carrier for hidden instructions in text you paste from a web page or an issue body, and the review step is the load-bearing part. Silent stripping would leave you unable to distinguish a poisoned paste from a clean one. Subagent results now render under a header marking them as subagent output, indented, so text a subagent returns can't be read as the session's own instructions. On Bedrock, Vertex and Foundry, workflow scripts' computed agent() prompts are framed as script-authored so the safety classifier doesn't attribute them to the user. Claude Code changelog

Three confused-deputy fixes in one release. Someone at Anthropic sat down with the trust boundaries and went through them systematically.

The release also carries changes you'll feel without reading the notes. AGENTS.md now loads in projects with no CLAUDE.md, switchable under Project instructions in /config, not yet on Bedrock, Vertex or Foundry. That item took 675 points on Hacker News, which tells you how long people have been asking. omitClaudeMd in agent frontmatter and the --agents JSON lets custom and plugin subagents run without user, project and local CLAUDE.md files loading, though managed policy files still load. The deprecated TaskOutput tool is gone; Claude reads a background task's output file with ordinary Read now, and taskOutputMaxChars and TASK_MAX_OUTPUT_LENGTH no longer do anything. If you tuned either to bound how much of a long-running task's output reached the model, that knob is now Read's offset and limit arguments. Project skills from the main repo also load in --worktree sessions when .claude/skills is untracked, which fixes the silent no-skills start for anyone who gitignores generated skills.

Then v2.1.278 at 03:10 UTC this morning moved auto mode's classifier checks on shell commands and network requests server-side on Enterprise, Claude API, AWS, Bedrock, Google Cloud Agent Platform and Microsoft Foundry. Server-performed checks aren't billed, and /status has a new Auto mode server row. The fallback is the old billed local classifier, and the docs name an LLM gateway stripping the safeguards request field or the safeguard_results response field as the most common cause of falling back. CLAUDE_CODE_AUTO_MODE_SERVER=0 opts out. Pro, Max and Team plans never see this. v2.1.278

Upgrade, then grep your settings for excludedCommands. Any entry there that could plausibly be the first segment of a chain is a hole that was open until this morning.