Back to rankings

Claude Code Patches Five More Permission and Policy Gaps

Claude CodeView original changelog

Claude Code 2.1.273, released September 15, 2026, closed five more ways a session could act outside a boundary a user or organization had configured, continuing the near-daily cadence of permission-hardening releases that ran through August and September. The release fixed Bash commands the permission checker cannot fully analyze skipping the approval prompt under permissions.blockReadsOutsideWorkingDirectories, along with a subshell that could hide a dangerous rm from bypass mode's safety check. It also stopped skills synced from claude.ai from remaining available after an organization disables Skills, fixed managed MCP-server restrictions being ignored when server-managed settings were also present, and closed a path where a repository's own settings could point a memory directory outside the session's working directories and have it used anyway.

Key Takeaways

  • A subshell could previously hide a dangerous rm command from bypass mode's safety check, one of the two fixes targeting permissions.blockReadsOutsideWorkingDirectories in this release.
  • Skills synced from claude.ai now move to a recoverable trash, not just staying active, once an organization disables Skills, closing a gap where org policy and actual behavior had diverged.
  • Three separate MCP and connector restriction settings, allowManagedMcpServersOnly, deniedMcpServers, and disableClaudeAiConnectors, were being silently ignored whenever server-managed settings were also configured.
  • A repository's own committed settings could point Claude's memory directory outside the session's allowed working directories and have it used anyway, a boundary a repository should not be able to widen on its own.
  • Anthropic also reverted a related 2.1.268 change that had caused legitimate commands like time -p make build to be denied outright instead of prompting for approval.
  • This continues a sustained cadence of permission-hardening releases running through early September 2026.

Five More Gaps in a Month-Long Pattern

Claude Code 2.1.273 continued a pattern that has run through most of August and September 2026: narrow, frequent fixes to places where the tool's permission, sandbox, or policy enforcement did not actually do what it claimed to. This release closed five such gaps.

Permission-Checker Blind Spots

Two of the fixes target permissions.blockReadsOutsideWorkingDirectories. First, Bash commands the permission checker cannot fully analyze were able to skip the approval prompt that setting is supposed to trigger. Second, a subshell could hide a dangerous rm invocation from the safety check that bypass mode otherwise applies, letting a destructive command through a mode that is meant to still catch the worst commands even when it is skipping ordinary prompts.

Policy and Settings Enforcement

A third fix addressed skills synced from claude.ai: previously, if an organization turned Skills off, already-synced skills stayed available on a user's machine instead of being removed. They now move to a recoverable trash instead of remaining active, bringing actual behavior in line with the organization's policy. A fourth fix corrected allowManagedMcpServersOnly, deniedMcpServers, and disableClaudeAiConnectors, three settings meant to restrict which MCP servers and connectors a session can use, which were being ignored whenever server-managed settings were also present, effectively letting a more permissive configuration silently override an intended restriction.

Memory Directories and Working-Directory Boundaries

The fifth fix closed a subtler path: a repository could specify its own memory directory through its committed settings, and that directory would be loaded into the prompt, recalled, indexed, and used for memory extraction even when it sat outside the directories permissions.blockReadsOutsideWorkingDirectories was supposed to confine the session to. A repository's own configuration should not be able to widen what a session can read beyond what the user or organization otherwise allowed, and this fix stops it from doing so.

The same release also reverted a related 2.1.268 change that had caused false positives: Read and Edit deny rules had been extended to Bash lines the permission checker cannot analyze, such as eval or env -C, but this caused legitimate commands like time -p make build to be denied outright rather than prompted for approval. That change was rolled back, so such commands once again prompt instead of being silently blocked.