Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-30 · high
A repository's settings file could redirect where Claude Code stores config and temp files, before a single prompt ran.
Why now: Anthropic released v2.1.251 on August 28 and listed these fixes in its changelog.
A symlink swapped into the working directory after Claude Code's permission check passed could redirect a write the check never caught. Anyone opening a repository they didn't write in Claude Code was exposed to file writes and reads outside the directories they'd approved.
Grep and Glob had a matching gap. A symlinked search path let them skip Read(...) deny rules meant to keep files out of reach. A rule written to block a directory could be walked around instead of enforced. Anthropic fixed both in v2.1.251, released August 28, according to its Claude Code changelog.
The same release closes a plugin marketplace issue where entries could point outside the plugin directory. It also closes a settings issue. A project's .claude/settings.json could set CLAUDE_CONFIG_DIR, CLAUDE_CODE_TMPDIR, or TMPDIR through its env block. Cloning a repo in Claude Code let the repo's settings file redirect where the tool reads its configuration and writes its temp files. That happened before a single prompt ran.
Anthropic also tightened approval. Settings that terminate sandbox TLS, route sandbox traffic through a proxy, or inject credentials now require explicit approval. So does ANTHROPIC_CUSTOM_HEADERS when it sets an auth or routing header.
The changelog doesn't say whether these were found through a bug bounty, internal review, or active exploitation. There's no word on how long the gaps sat open before the fix.
Each link below shares sources, entities, or timing with this story.
Same source / Semantically similar
Cite the same source (Claude Code changelog - code.claude.com (v2.1.251, 2026-08-28)); covers closely related ground (similarity 0.77).
Cite the same source (Claude Code changelog - code.claude.com (v2.1.251, 2026-08-28)); covers closely related ground (similarity 0.76).
Cite the same source (Claude Code changelog - code.claude.com (v2.1.251, 2026-08-28)); covers closely related ground (similarity 0.72).
Cite the same source (Claude Code changelog - code.claude.com (v2.1.251, 2026-08-28)); covers closely related ground (similarity 0.70).
Cite the same source (Claude Code changelog - code.claude.com (v2.1.251, 2026-08-28)); covers closely related ground (similarity 0.70).
Same source
Cite the same source (Claude Code changelog - code.claude.com (v2.1.251, 2026-08-28)).
Cite the same source (Claude Code changelog - code.claude.com (v2.1.251, 2026-08-28)).
Cite the same source (Claude Code changelog - code.claude.com (v2.1.251, 2026-08-28)).