AI
Claude Code 2.1.309 closes several permission-check gaps
A security and sandbox release, per Anthropic's own GitHub notes.
Disclosure: Anthropic makes Claude, the model that helps make this paper. Its Claude Code v2.1.309 release notes (Oct 22) say it fixed several Bash permission-check gaps, including cases where Edit(path) deny rules were skipped by redirects inside some subshells (a command run inside another command). Sandboxed commands and auto-accepted edits can no longer modify the --mcp-config file, and, in the Desktop app and VS Code, dangerous rm and rmdir commands in bypass-permissions mode are denied right away with a rewrite hint.
Two changes may touch scripts: claude ultrareview now requires workspace trust (pass --trust-workspace or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1), and sed -i now uses the standard Bash prompt and is no longer undone by /rewind. The caveat: these are changelog entries, not an incident report, so it is unclear whether any bypass was exploited.
On your desk: skim your vault automations for any script that calls claude ultrareview or sed -i, since those are the ones that may now stop and ask.
Read the original at GitHub: anthropics/claude-code v2.1.309 →