Back to rankings

Claude Code Patches Ten More Permission and Sandbox Gaps

Claude CodeView original changelog

Claude Code 2.1.282 closes ten permission, sandbox, and managed-policy enforcement gaps, the most notable of which let a plugin or locally defined skill name itself anthropic-skills:* or claude-ai:* to inherit the blanket auto-approval trust meant only for skills synced from a user's claude.ai account. Several other fixes stop malformed or mistyped managed-settings values from silently disabling an organization's policy instead of applying it, and close a path where project or local settings could override a managed sandbox or domain restriction. A separate fix closes a symlink path-traversal gap that could let CLAUDE.md or rules files be read from macOS's /Network share or /home through a crafted symlink.

Key Takeaways

  • A plugin could previously name itself anthropic-skills:* or claude-ai:* and inherit the auto-approval trust meant only for skills synced from a user's own claude.ai account, a namespace-impersonation bypass now closed.
  • A single mistyped or malformed value in a managed settings file could silently disable an entire policy block, not just the broken key, for permissions, autoMode, worktree, and attribution settings alike.
  • On Windows and WSL, a broken admin policy file used to leave the door open for a user-writable registry key or WSL config to take over in its place; it now stays locked.
  • Skills and commands could pre-approve their own tool access through allowed-tools, sidestepping an organization's allowManagedPermissionRulesOnly restriction entirely.
  • A crafted symlink could route CLAUDE.md or rules-file reads through macOS's /Network share or /home, a path-traversal gap now patched.
  • The release bundles ten distinct permission, sandbox, and policy fixes in one update, continuing a pattern of near-weekly hardening passes across recent Claude Code releases.

Closing a Trusted-Namespace Loophole

The most notable fix patches a gap in how Claude Code decides which skills and MCP servers count as trusted. Auto-approval rules written as Skill(anthropic-skills:*) or Skill(claude-ai:*) are meant to cover only skills that sync down from a user's claude.ai account, letting Anthropic's own first-party skills run without a permission prompt. Until this release, a plugin or a locally defined skill could simply name itself with that same namespace and inherit the same blanket trust. Claude Code now scopes those allow rules to skills that actually synced from claude.ai; skill folders, command files, and workflow commands that merely claim the anthropic-skills or claude-ai namespace no longer load at all, and MCP servers configured under either name stop listing skills or prompts, though their tools continue to work under normal permission rules.

Managed Policy Enforcement Hardened

Several other fixes close ways an organization's managed policy could silently stop applying. A managed settings file with a mistyped boolean lock, such as disableClaudeAiConnectors or allowManagedPermissionRulesOnly, is no longer ignored; the lock now applies as written, and Claude Code's startup output names the offending key. A single invalid nested value inside managed permissions, autoMode, worktree, or attribution settings previously caused the entire block to be skipped; the rest of the block now still applies. On Windows and WSL, if an admin policy file is present but broken or unreadable, Claude Code now keeps the user-writable HKCU registry key and WSL's /etc/claude-code from taking over in its place, closing a path to quietly escaping the intended policy. Repository, user, and --add-dir skills, commands, and skills-directory plugin manifests could also pre-approve their own tool access through their allowed-tools field even under an organization's allowManagedPermissionRulesOnly restriction; that self-approval path is now blocked.

Sandbox and Filesystem Fixes

sandbox.excludedCommands entries defined at the project or local settings level could previously override an organization's managed sandbox restrictions or its allowManagedDomainsOnly policy; those local overrides are now ignored whenever managed settings or --settings apply the stricter rule. Separately, Claude Code fixed a path-resolution gap where reading CLAUDE.md or rules files through a symlink could reach macOS's /Network share via a .. traversal or a /.vol-style kernel path, or list a rules symlink that pointed at macOS's /home; and a related fix stops Bash permission rules containing a mid-pattern :* wildcard from being silently skipped in settings files, a gap that let some allow-listed commands bypass pattern matching that --allowedTools already enforced correctly.