Back to rankings

Claude Code Exempts Manually Typed ! Commands From Strict Sandbox Mode

Claude CodeView original changelog

Claude Code 2.1.260 changed how strict sandbox mode treats commands typed directly at the ! bash-mode prompt, letting them run outside the sandbox even when sandbox.allowUnsandboxedCommands is set to false. Anthropic's reasoning is that a command a user types themselves at the ! prompt is equivalent to typing directly into their own terminal, not an action the agent is taking on the user's behalf. Teams that enabled strict sandbox mode specifically to force every shell command, including their own, through the sandbox should be aware the setting no longer covers manually typed ! commands.

Key Takeaways

  • Strict sandbox mode (sandbox.allowUnsandboxedCommands: false) no longer covers ! bash-mode commands, which now always run outside the sandbox.
  • Anthropic's justification is that manually typed commands are equivalent to using a regular terminal, not an agent action requiring containment.
  • The change is a behavior change, not a bug fix — it is listed under "Changed" rather than "Fixed" in the release notes.
  • Organizations relying on strict sandbox mode as a blanket compliance control should confirm whether this new exception affects their threat model.
  • The setting still applies to commands the model itself generates and runs; only manually typed ! commands are exempted.
  • This lands in the same release as several permission-enforcement fixes, underscoring how actively Anthropic is iterating on the sandbox and permission layer.

A Carve-Out in Strict Sandbox Mode

Claude Code 2.1.260 changed the behavior of strict sandbox mode (sandbox.allowUnsandboxedCommands: false) so that it no longer applies to commands a user types directly at the ! bash-mode prompt. Those commands now always run outside the sandbox, described in the release notes as being treated "like typing into your own terminal."

What changed

Previously, turning on strict sandbox mode forced every Bash command through the sandbox without exception, including commands a user manually typed rather than commands Claude generated. As of 2.1.260, manually typed ! commands are exempt from that restriction and run unsandboxed regardless of the setting.

The reasoning, and who should care

Anthropic's framing treats the ! prompt as functionally equivalent to a regular terminal: since the user is directly authoring and running the command themselves, not asking Claude to act on their behalf, sandboxing it adds friction without protecting against an untrusted agent action. That is a defensible distinction for most users.

It matters more for organizations that adopted strict sandbox mode as a blanket policy control, expecting it to route every shell command through the sandbox without exception, including their own. For those teams, this is a behavior change worth knowing about: a setting they may be relying on for compliance or audit reasons now carries an unstated exception for manually typed commands.