Claude Code Patches Nine Permission, Sandbox, and Isolation Gaps

Claude CodeAug 28, 2026View original changelog

Claude Code 2.1.251 closed nine distinct ways a session could act outside boundaries a user had explicitly approved, the second such cluster in a week following six similar gaps patched on August 25. Fixes span file tools following a swapped symlink, Grep/Glob ignoring deny rules through symlinked paths, plugin commands and Workflow tool scripts escaping their allowed directories, a tracing bypass around a pinned OTLP collector, Claude in Chrome skipping Claude Code's own permission checks when telemetry was off, and several settings-approval gaps that let a server push weaken sandbox isolation or inject credential headers without asking first.

Key Takeaways

Nine separate escapes were closed in one release, the second cluster of permission and sandbox fixes in a single week for Claude Code.
Symlinks were a recurring theme, letting Read/Write/Edit write outside an approved directory and letting Grep/Glob search past a Read(...) deny rule.
Claude in Chrome now always goes through Claude Code's permission checks, closing a gap where telemetry-disabled sessions used the browser extension's own, weaker prompts.
Settings that weaken the sandbox now require explicit approval, including anything that terminates sandbox TLS, routes traffic through a custom proxy, or injects credentials.
ANTHROPIC_CUSTOM_HEADERS is now gated when it sets a credential, routing, or API-behavior header like Authorization or Host.
A repository's own settings file can no longer redirect where Claude Code stores its temp files or config directory, removing a subtle supply-chain style attack surface.

Anthropic shipped Claude Code 2.1.251 on August 28, 2026 with a fresh batch of fixes closing off nine separate ways a session could act outside the boundaries a user had approved. It is the second such cluster in the space of a week, following six similar gaps patched in the August 25 release, and it touches file tools, plugins, the Workflow tool, search commands, the Chrome browser extension, and the settings that govern the sandbox itself.

File Tools and Symlink Escapes

Read, Write, and Edit could be tricked into reading or writing outside an approved directory if a symlink inside the working directory was swapped out after Claude Code had already run its permission check. Grep and Glob had a related gap: Read(...) deny rules were not being applied to files reached through a symlinked search path, so a denied file could still be searched and its contents surfaced through a match. Both are now fixed.

Plugin and Workflow Path Safety

A plugin command declared in a marketplace entry could point to a script outside the plugin's own directory; such paths are now rejected with a path-traversal error before they run. The Workflow tool had a similar issue: it could read, and even quote back in an error message, a scriptPath located outside what the session was allowed to read, before the permission check had a chance to block it.

Tracing, Settings, and the Browser

Project-level settings could enable detailed beta tracing or raw API body logging, and in some configurations a lower-scope beta tracing endpoint could bypass an OTLP collector an administrator had pinned through managed settings or a host app. Separately, Claude in Chrome browser actions did not always go through Claude Code's own permission checks: sessions with telemetry disabled fell back to the Chrome extension's own, weaker prompts. All browser actions now route through the same permission system regardless of telemetry state.

Anthropic also tightened what a server-managed settings push is allowed to do without asking first. Settings that terminate sandbox TLS, route sandbox traffic through a custom proxy, inject credentials, or otherwise weaken sandbox isolation now require approval before they take effect, as does ANTHROPIC_CUSTOM_HEADERS when it sets a credential, org/tenant, routing, or API-behavior header such as Authorization or Host. Project-level settings can no longer set CLAUDE_CODE_TMPDIR, CLAUDE_CONFIG_DIR, or TMPDIR/TMP/TEMP, closing off a route by which an untrusted repository's own settings file could redirect where Claude Code reads and writes sensitive state.

Taken together, the fixes describe a consistent pattern: a symlink, a plugin, a workflow script, a tracing endpoint, a browser action, or a settings push finding a way around a check the user never explicitly reviewed.