Claude Code Patches Five Permission and Sandbox Gaps
Claude CodeClaude Code 2.1.269, released September 11, 2026, closed five more paths where a session or a connected surface could act outside a boundary a user or organization had configured, continuing Anthropic's near-daily cadence of permission-hardening releases. The release stopped a Bash(tee:*) allow rule from covering write destinations outside a session's working directories, fixed plugin archives left readable and writable by other local users after extraction, and corrected a !-negation permission rule so it applies only within the settings source that wrote it instead of leaking across sources. It also fixed a plugin consent prompt that could show a misleading URL, obscuring which host a user was actually approving, and stopped Claude in Slack from silently falling back to a model an organization has not enabled instead of declining outright.
Key Takeaways
- A
Bash(tee:*)allow rule could write anywhere, bypassing Edit deny rules and reaching destinations entirely outside a session's working directories before this fix. - Plugin archives leaked to other local users, staying world-readable and world-writable after extraction on shared or multi-user machines.
- A narrow
!negation rule could escape its own settings source, letting a rule meant for one settings layer affect enforcement controlled by another. - A plugin consent prompt could misrepresent which host was receiving a request, undermining the purpose of asking for approval in the first place.
- Claude in Slack no longer quietly substitutes a fallback model when a user requests one an organization has not enabled; it now declines and explains why.
- This is at least the eighth distinct round of permission and sandbox hardening Anthropic has shipped since late August 2026, reflecting a sustained, near-daily focus on closing enforcement gaps rather than a one-time cleanup.
Bash tee No Longer Bypasses Edit Deny Rules
Claude Code's Edit() deny rules and its write-path checks previously did not apply to files a Bash tee command wrote. A Bash(tee:*) allow rule, meant only to let Claude pipe output into an approved location, could therefore be used to write to destinations outside a session's working directories entirely, sidestepping the same protection that blocks the Edit and Write tools from touching those paths. Anthropic closed the gap so a tee-based write is now checked the same way as any other file-modifying action, and an allow rule for tee no longer implicitly grants access outside the working directory.
Plugin Archives No Longer Leak to Other Local Users
Plugin archives extracted for a session were previously readable by other users on the same machine, and files extracted from an archive kept whatever world-writable bits the archive itself carried. Stale files could also survive a re-extraction rather than being cleared out first. On any shared or multi-user machine, this meant a plugin's contents, and any secrets or configuration bundled with it, were not actually confined to the session that installed it. Claude Code now extracts plugin archives with correct, non-world-readable and non-world-writable permissions, and clears out stale files before re-extracting.
Permission Negation Rules Stay Inside Their Own Settings Source
A deny or ask permission rule written with a leading ! was meant to apply only within the settings file that defined it, whether that is a user, project, local, or managed settings source. Instead, such a rule could apply beyond its own source, meaning a narrow negation intended for one settings layer could affect enforcement controlled by another, higher-trust layer. Anthropic fixed the scoping so a ! rule now applies only within its own source, and a bare ! with no rule attached is ignored outright rather than silently affecting anything.
Plugin Consent Prompts Show the Real Host
Plugin headersHelper consent prompts, the dialogs Claude Code shows before sending custom headers to a remote endpoint, could display a URL path in a way that a user could misread as belonging to a different host than the one actually receiving the request. That is exactly the kind of ambiguity a permission prompt exists to prevent: if a user cannot tell which host they are approving, the approval step doesn't protect them. The prompt has been corrected to show the URL unambiguously.
Claude in Slack Stops Silently Falling Back to Disallowed Models
When a user asked Claude in Slack to switch to a model their organization had not enabled, Claude previously accepted the request and then quietly answered using a fallback model instead, without saying so. That let a conversation continue on a model the organization's policy was supposed to block, invisibly to both the user and any admin auditing model usage. Claude now declines the switch outright and tells the user an admin can enable that model if they want to use it.
Together, these five fixes continue the pattern that has run through August and into September 2026 of narrowing gaps in Claude Code's permission, sandbox, and policy-enforcement layers across the terminal, plugins, and Claude in Slack.