Back to rankings

Claude Code Closes MCP OAuth Leak and Bash Sandbox and cp/mv Permission Gaps in 2.1.321

Claude CodeView original changelog

Claude Code 2.1.321 fixes cases where the agent could act outside what a user authorized. MCP OAuth requests no longer send secrets such as refresh tokens to another host when a server redirects them, and a read-only Bash command no longer runs outside the sandbox without a prompt. Deny rules and protected-file prompts now apply to the file that a cp or mv into a directory writes.

Key Takeaways

  • MCP OAuth secrets no longer follow a redirect to another host, which protects refresh tokens.
  • A read-only Bash command could run outside the sandbox with no prompt, and that gap is closed.
  • Bash write checks used the wrong folder in one case, letting a write skip its prompt.
  • Deny rules and protected-file prompts now apply to cp and mv destinations inside a directory.
  • /bin/cp and /bin/mv get the same checks as cp and mv, removing a spelling-based bypass.
  • Anyone relying on deny rules or the sandbox should update, since earlier versions let the agent act past them.

A cluster of boundary fixes

Claude Code 2.1.321 includes five fixes that share one question: can the agent do something the user did not authorize? Each closes a path where a protection existed but did not hold.

MCP OAuth secrets sent to another host

MCP OAuth requests could send secrets such as refresh tokens to a different host when an MCP server redirected them. The release fixes this, so credentials stay with the host they were issued for. Developers who connect Claude Code to third-party MCP servers over OAuth are the ones this protects.

Read-only Bash outside the sandbox

A read-only Bash command could run outside the sandbox without showing a permission prompt. The sandbox is meant to confine commands, so a path around it undermines the isolation that sandbox users rely on. The release closes this case.

Writes judged from the wrong folder

Bash permission checks could judge a file write from the wrong folder, and so skip a prompt that should have appeared. The release fixes the folder the check uses.

cp and mv into a directory

Deny rules and protected-file prompts did not apply to the file that a cp or mv into a directory writes. A rule that denied writes to a file could be bypassed by copying or moving another file into its folder under the same name. The rules now apply to that destination file. A related change gives cp and mv spelled by a path, such as /bin/cp, the same path checks as plain cp and mv.

Why it matters

None of these is a new feature. Together they mean OAuth credentials, the Bash sandbox and deny rules behave as documented. Users on 2.1.320 or earlier who depend on deny rules or the sandbox should update.