Back to rankings

Claude Code Patches Six Permission and Sandbox Gaps

Claude CodeView original changelog

Claude Code 2.1.281 closed six separate gaps in its permission and sandbox enforcement, continuing Anthropic's near-weekly cadence of trust-boundary fixes. The release patched a macOS path-resolution bug that let permission dialogs and attachment checks read through /.vol, /.nofollow and /.resolve mount points before a user approved them, stopped a recursive rm whose target came only from command substitution (such as rm -rf "$(pwd)") from running unprompted in auto and --dangerously-skip-permissions mode, and closed a NUL-byte trick that silently turned a permission rule into a wildcard matching everything. It also fixed sandbox exclusion lists that were not matching real commands, stopped claude --bg from skipping the workspace trust prompt, and made --setting-sources restrictions carry over to spawned sessions. Alongside the fixes, Anthropic tightened auto mode itself, extending its server-side classifier review to read-only and sandboxed commands and giving the dangerous-rm prompt a two-minute timeout instead of blocking indefinitely.

Key Takeaways

  • Six separate permission and sandbox bugs were fixed in 2.1.281, continuing Claude Code's frequent cadence of trust-boundary patches.
  • A macOS mount-point bypass let permission dialogs and attachment checks resolve a path through /.vol, /.nofollow or /.resolve, which can reach a network mount, before a user approved it.
  • A crafted recursive rm whose target came only from command substitution, such as rm -rf "$(pwd)", could run without a prompt in auto mode and --dangerously-skip-permissions mode.
  • A NUL byte in a permission rule was silently expanded into a wildcard that matched everything, rather than the intended narrow pattern.
  • Claude Code now runs the auto mode classifier review on read-only and sandboxed commands too, not just commands that write or reach the network.
  • The dangerous-rm confirmation now waits two minutes before denying an unanswered command, so unattended and CI sessions keep going instead of hanging indefinitely.

Six permission and sandbox bugs fixed

Claude Code 2.1.281 shipped six distinct fixes to the permission and sandbox layer that decides what the agent is allowed to do without asking first. None of these are framed by Anthropic as security advisories, but each one describes a way the tool could act, or be made to act, outside what a user had actually authorized, which is why they matter more than an ordinary bug fix.

A macOS mount-point bypass in permission checks

On macOS, permission dialogs and attachment checks could read a path under /.vol, /.nofollow or /.resolve before a user approved the action. These are special filesystem entry points that can resolve to a network mount, meaning a crafted path could reach storage outside the working directory while the approval prompt was still evaluating a more innocent-looking path. Claude Code now resolves these paths correctly before the check runs.

A recursive rm that skipped the prompt

Anthropic fixed a case where a recursive rm command running in auto mode or --dangerously-skip-permissions mode would execute without a confirmation prompt if its target came only from command substitution, for example rm -rf "$(pwd)". Such a command now asks for approval even when a Bash allow rule would otherwise cover it, unless a session explicitly opts out with CLAUDE_CODE_DISABLE_SUBSTITUTION_RM_PROMPT=1.

A NUL byte that turned a rule into a wildcard

A permission rule containing a NUL byte was being expanded into a match-everything wildcard instead of failing safely. That rule now matches nothing, closing off a way a narrowly-scoped allow or deny rule could have been made to apply far more broadly than intended.

Sandbox exclusion lists that missed real commands

Sandbox excludedCommands entries were not correctly matching git rev-parse --git-dir, programs named like shell builtins, or commit messages containing [WIP] or # lines, meaning commands meant to be excluded from sandboxing could slip through unrecognized. Anthropic also fixed sandboxed Bash commands being unable to write to $TMPDIR when CLAUDE_CODE_TMPDIR was set.

Background sessions skipping the trust prompt

claude --bg could start a background session, and run its project hooks, in a directory that had never passed the workspace trust prompt. It now requires trust to be established first, or exits when run non-interactively.

Restriction flags not following spawned sessions

--setting-sources (and the SDK's settingSources option) was not being forwarded to sessions spawned from a parent session: teammates, /bg, claude agents sessions, and --worktree --tmux. A restriction set on the parent now correctly carries over to everything it spawns.

Auto mode gets stricter, and more patient

Two changes to auto mode in this release work in tension, and Anthropic shipped them together. Where auto mode's server-side classifier review runs, it now also reviews read-only and sandboxed shell commands, not just commands that write or reach the network, and blocks them when the classifier flags something. CLAUDE_CODE_AUTO_MODE_SERVER now also applies on a direct Anthropic API connection, so teams can explicitly opt in or out of the server-side classifier.

At the same time, the dangerous-rm confirmation prompt in --dangerously-skip-permissions and auto mode now waits two minutes for an answer before denying the command with a rewrite hint, rather than blocking indefinitely. That keeps unattended and CI sessions from hanging forever on a prompt nobody is watching, while still defaulting to deny rather than allow when nobody answers. CLAUDE_CODE_DISABLE_DANGEROUS_RM_TIMEOUT=1 turns the timeout off for sessions that want the old blocking behavior.