Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-09-19 · high
One matching segment in a chained Bash command used to exempt the entire thing from the sandbox, not just the part you allowlisted.
Why now: Claude Code v2.1.277, which carries the fix, released September 19, 2026.
Claude Code's sandbox had a gap in how it read sandbox.excludedCommands. If you allowlisted something benign like git status, the sandbox checked the compound command as a whole. A single matching glob was enough to exempt everything chained to it with && or ;, including commands you never intended to trust.
That's a real problem for anyone treating excludedCommands as a narrow allowlist. The mental model is "this one command skips the sandbox." The actual behavior was "this compound command skips the sandbox if any piece of it matches." A chained command riding along on a trusted prefix got the same free pass.
Claude Code v2.1.277 closes it. Every segment of a compound command has to match for the exemption to apply, not just one.
If you're running Claude Code with a sandbox config and you've listed anything beyond single, standalone commands in excludedCommands, this changes what gets exempted. Open your config and check whether any entries assume partial matching still works, because as of v2.1.277 it doesn't.
The release notes don't say how long the broader-than-intended exemption had been in place, or whether a specific chained command was the trigger for the fix. Treat this as a config correction to make now, not a breach to investigate after the fact.
Each link below shares sources, entities, or timing with this story.
Tag characters that hide instructions in pasted text get stripped, and you see the cleaned prompt before it sends.
Two of the six hid commands from the approval dialog itself, using tab padding, invisible Unicode, and split Bash strings.
Go update. Then go read your sandbox.excludedCommands configuration, because it probably means something different than you thought it did. The bug: a single glob in sandbox.excludedCommands exempted an entire compound Bash command from the sandbox if any one segment matched....
A lazy-loading quirk in IPython 9.17 let %%bash run even when Agno's CodeMode explicitly turned shell access off.
Grep and Glob had the same gap, and the release also blocks project settings from logging raw API request bodies.
The release also adds a command that migrates Python projects off the old anthropic 0.x SDK and stops WebFetch from serving stale content all session.
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.