Claude Code 2.1.309 closes sandbox and permission holes

Anthropic released Claude Code 2.1.309 on October 22. Before this version, every sandboxed Bash command on macOS and Linux first ran the shell’s startup files outside the sandbox. The release fixes that, along with more than a dozen other holes in sandbox boundaries, Bash and PowerShell permission checks, and worktree isolation.

The release notes on GitHub also change how sed -i, claude ultrareview and the dangerous rm prompt in bypass mode behave. Those are the changes most likely to require edits to scripts and unattended setups.

What ran outside the sandbox

Claude Code’s sandboxing documentation describes the sandbox as a boundary the operating system enforces around Bash, PowerShell and Monitor commands and the processes they start. It uses Seatbelt on macOS and bubblewrap with socat on Linux and WSL2, and it is built on the open source @anthropic-ai/sandbox-runtime package. The sandbox is off by default. You turn it on with /sandbox or by setting sandbox.enabled to true in a settings file. Once it is on, sandboxed commands can write to the working directory, a per-user temp directory and any directories you have added, while protected paths stay write-denied.

A shell reads its startup files, such as .bashrc or .zshrc, every time it launches. In earlier versions that step happened outside the sandbox before each command, so anything those files executed ran with the user’s own access on every call, and only the command itself was confined.

The second fix concerns the MCP config file passed with --mcp-config. Until now, sandboxed commands and auto-accepted edits could modify it. The documentation says local MCP servers run outside the sandbox with the user’s full access, along with command hooks, plugin monitors, LSP servers and helpers like the status line command and apiKeyHelper. A write to that file from inside the sandbox could therefore change what Claude Code later starts outside it, which appears to be why the file is now protected.

Two fixes deal with symlinks. On macOS, denyWrite glob patterns did not apply at a path’s real location when the pattern’s folder was reached through a symlink. Write protection for the profile store failed the same way when the config directory itself was a symlink. On Linux, sandbox write denies were lifted if a background command outlived the session. That no longer happens.

One setting also gets stricter. Suppose the sandbox is enabled but cannot run. Commands that your settings exclude from the sandbox will now ask before writing to the sandbox’s write-list paths, and the unsandboxed fallback is refused in that case.

Where the permission checks slipped

The Bash permission check trusted a variable set by a command whose redirect could fail to open. Compound commands that change directory before running git now prompt when the cd is wrapped or prefixed, the same as they already did for a plain cd. An Edit(path) deny rule now blocks a Bash redirect to that path in commands that also contain a subshell. Before, some of those redirects went through.

Worktree-isolated sessions get two fixes to their isolation guard. It now refuses some locale-prefixed commands and, on zsh, some arithmetic commands that it had been letting through. In August, worktree isolation was extended to file edits and Bash across all session types after isolated sessions and their subagents were found able to run destructive git commands in the main working directory. Separately, worktrees and branch checkouts that Claude Code creates now ignore git replace refs, as its other git operations already did.

On Windows, the PowerShell checks were auto-approving some Set-Location or cd commands that target the current directory and carry extra arguments. These commands now prompt. Hooks that run in PowerShell were not blocking when the hook’s program exited with code 2. Also on Windows, PreToolUse and PermissionRequest hooks set to "shell": "powershell" failed open when Git for Windows wasn’t installed.

Two more fixes concern rules that did not reach everywhere they should. Split-pane agent teammates did not inherit the tool deny and --tools rules from the leader’s command line. And in print and SDK sessions, a later permission prompt could reconnect an MCP server that had been disabled.

Fixes outside security

Sessions could compact over and over after reading files under a very large nested CLAUDE.md. Now a nested CLAUDE.md over the size limit loads only its start. Long tool output previews were sometimes cut in the middle of an emoji, which left session transcripts that jq could not parse. Claude was also writing role names and placeholders as mentions in PRs, issues and comments, which notified unrelated GitHub users.

The “Waiting for API response” hint flickered behind gateways that send only keepalive pings. On routes off Anthropic’s backend it now waits 45 seconds. On Amazon Bedrock, fine-grained tool streaming stayed off when ANTHROPIC_BEDROCK_BASE_URL pointed at the default bedrock-runtime.<region>.amazonaws.com endpoint. In the VS Code chat panel, Edit and Write now wait 0.75 seconds for new problems after each edit in most cases, down from 1 to 1.5 seconds.

When a full disk cuts off a Bash command, Claude Code now says so and names the folder to free up. Starting on a full temp volume prints a clear message in place of a raw ENOSPC error. Many of the git commands Claude Code runs for itself are faster on Windows, and on every platform their errors now appear in English even when git is set to another language.

On self-hosted runners, a session that moves to a new runner now shows Claude the tool call that was interrupted, marked as outcome unknown. --startup-timeout-min no longer stops a session whose first prompt, such as /code-review, is still working in a subagent, though a frozen process is still stopped. In Slack, Claude Tag was posting a draft you had approved for a channel into your DM. A post with no channel is now refused so it can go to the approved channel.

What scripts need to change

sed -i now gets the standard Bash prompt and runs as written, where before it showed a simulated file-edit preview. Like other edits made through Bash, its changes are no longer restored by /rewind.

In the Desktop app and VS Code, bypass permissions mode handles dangerous rm and rmdir commands differently. The prompt now denies the command at once and gives a rewrite hint, so unattended sessions keep going. Worktree creation and reuse no longer let git fetch objects on demand, both in ordinary clones and in partial clones with a Bash sandbox configured. Such a partial clone fetches the objects first. The /claude-api skill now builds Managed Agents subagent teams on multiagent_20261001, with dynamic workflows on by default, in place of coordinator.

claude ultrareview now requires workspace trust. It asks for trust on a terminal and refuses everywhere else. Scripts can pass --trust-workspace, which takes no value, so any PR number or base branch goes before it. The alternative is to set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1.