Claude Code: Closes Sandbox Symlink, MCP Deny Rule and Windows Hook Fail-Open Gaps

Claude CodeOct 14, 2026View original changelog

Claude Code 2.1.299 patches a cluster of cases where guardrails did not block what they were meant to block. Sandboxed commands could reach denied paths through macOS symlinks, MCP deny and ask rules missed servers with double underscores in their names, Windows PreToolUse hooks failed open without Git for Windows, and plan mode could run a write that a hook allowed. Several permission-matching rules were also tightened.

Key Takeaways

Sandboxed commands could reach denied paths on macOS by going through a symlink, and could write into a --plugin-dir folder whose code runs outside the sandbox.
MCP deny and ask rules silently missed servers whose normalized names contain a double underscore.
Windows PreToolUse and PermissionRequest hooks failed open when Git for Windows was missing; a failing guard now blocks the call.
Plan mode could run a write that a PreToolUse hook or a mod's tool.check had allowed, which is now fixed.
MCP allow rules are stricter: mcp__a no longer matches servers named a__b or a_, so users should write mcp__<server>__*.
UserPromptSubmit hooks now run before skill or slash-command expansion, so a blocking hook also stops the command's embedded shell lines.

Overview

Claude Code 2.1.299 ships a group of fixes where a user-configured guardrail (a sandbox rule, a deny or ask rule, or a hook) did not stop an action it was meant to stop. Taken together they are a reminder to update promptly if the agent runs with sandboxing or restrictive permission rules.

Sandbox fixes

Sandboxed shell commands could write into a --plugin-dir folder. Claude Code reloads and runs code from that folder outside the sandbox, so this was a path from the sandbox to unsandboxed execution. It is now blocked.
On macOS, a sandboxed command could read or write a denied path through its real location when the denied path passed through a symlink.
Sandbox denyRead and allowRead globs containing braces, parentheses or backslashes in a folder name were interpreted differently by Claude Code's settings checks than by the sandbox itself. The two now agree.
Glob allowRead and allowWrite entries were not re-checked when the directory they start from was replaced by a symlink. They are now re-checked.
Worktree-isolated sessions accepted some awk programs that the isolation guard should have refused.

Permission rule and MCP fixes

Deny and ask rules for an MCP server (mcp__<server>) did not apply when the server's normalized name contained a double underscore.
Tools of an MCP server named constructor or toString asked for permission in auto mode and bypass permissions mode, and servers named constructor or prototype were never connected.
MCP allow rules now reach only the server they name: mcp__a no longer allows a server named a__b or a_. Users should write mcp__<server>__* with the whole normalized name. Agent tools: lists follow the same rule.
The Write and Edit tools could create a mod in a session's mods folder without asking in accept-edits mode when the config directory path had no .claude in it.
Plan mode could run a write (an MCP tool's, a file's or a shell command's) that a PreToolUse hook or a mod's tool.check hook had allowed.

Hooks that fail closed

On Windows, PreToolUse and PermissionRequest hooks that set no shell failed open when Git for Windows was not installed. A guard that fails now blocks the call. More broadly, actions a plugin hook can block are now refused, not let through, when the hook cannot be handed them or cannot hand back its answer, and a tool that already ran has its result withheld. UserPromptSubmit hooks now run before a skill or custom slash command expands, so a hook that blocks a prompt also stops its embedded shell commands.

Other hardening

The resume command printed at exit now names the session by ID, not by name, so nothing in a session name can run when the line is pasted.
In Cowork cloud sessions in auto mode, a PermissionRequest hook can no longer approve shell commands or subagents.
Requests to claude.ai's connector proxy and Anthropic-hosted MCP servers no longer follow HTTP redirects, and neither do MCP requests in cloud and self-hosted runner sessions.
Skills and commands whose file or folder name has hidden, direction-changing or blank-like characters, or < or >, are no longer offered until renamed.
Improved enforcement of managed permission rules, managed hooks and organization MCP tool names against user-installed mods.