Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-09-16 · high
Version 2.1.273 stops a repo-chosen memory directory from loading into the prompt when read access outside the working folder is blocked.
Why now: Anthropic posted the fix in the 2.1.273 release notes on 2026-09-15.
Anthropic released claude-code v2.1.273 on September 15 with a fix aimed at anyone running the agent against untrusted repositories. A repo's own settings can point at a memory directory anywhere on disk. Under the permissions.blockReadsOutsideWorkingDirectories setting, that directory was still getting loaded into the prompt, recalled, indexed, and used for memory extraction.
That matters because the setting exists for cases where you don't trust the repo. If the agent honors a repo's memory-directory pointer even with reads supposedly blocked, a hostile repo could get its own instructions or data pulled into context through a path the operator thought was closed. Claude-code's v2.1.273 release notes don't say how long the gap existed or whether any prompts or outputs got affected in practice. They say loading, recall, indexing, and extraction are now blocked along with everything else outside the working directory.
The release carries three other fixes. A subshell that could hide a dangerous rm from bypass-mode's safety checks is closed. Sub-agents and background agents no longer get misreported as failed when a streamed reply leaves out token usage or a model ID. The context meter and auto-compact stop double-counting advisor-tool turns. It also adds opt-in x-claude-code-* request headers for LLM gateways, gated behind CLAUDE_CODE_GATEWAY_HINT_HEADERS=1.
If you set blockReadsOutsideWorkingDirectories for a specific reason, the September 15 fix means that protection didn't hold before this release.
Each link below shares sources, entities, or timing with this story.
The release also adds a command that migrates Python projects off the old anthropic 0.x SDK and stops WebFetch from serving stale content all session.
Two of the six hid commands from the approval dialog itself, using tab padding, invisible Unicode, and split Bash strings.
Grep and Glob had the same gap, and the release also blocks project settings from logging raw API request bodies.
The same release adds a plugin eval command and fixes a permission rule that leaked across Claude Code's settings sources.
Version 13.24.0's manifest said one thing, its bundled scripts said another, and the mismatch sent the background worker into a kill and respawn loop on every hook event.
The mirror syncs nightly from Anthropic's internal review queue, and every plugin in it already cleared automated security scanning before listing.
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.