Back to rankings

Claude Code Patches a Plugin Symlink Bypass and Untrusted Artifact Instruction Leak

Claude CodeView original changelog

Claude Code 2.1.265, released September 8, 2026, closed two more paths where a session could act outside a boundary a user relied on. A plugin path containing a backslash could bypass the symlink containment check on macOS and Linux, letting a plugin's files reach outside the directory it was supposed to be confined to. Separately, Anthropic changed how the Artifact tool reads a page someone else published: the summary Claude receives now treats that content as untrusted and flags embedded instructions instead of relaying them as if they came from the user, closing off a route for prompt injection through a shared artifact. Both fixes continue Anthropic's near-weekly pattern through August and into September 2026 of narrowing gaps in Claude Code's permission, sandbox, and isolation layers.

Key Takeaways

  • A symlink trick let a plugin escape its own folder, with a backslash in the plugin path bypassing the containment check macOS and Linux rely on to keep plugin files scoped correctly.
  • Artifacts are now read as untrusted content, closing a prompt-injection route where a page someone else published could try to slip instructions into Claude's context.
  • This is the latest in a long weekly cadence, following clusters of six, nine, and twelve permission and sandbox fixes Anthropic shipped through August 2026.
  • Neither issue required user action, both ship automatically to anyone on Claude Code's standard auto-update channel.
  • The fix targets agent trust, not just file access, since the artifact change stops Claude from treating a third party's embedded text as if it came from the user.
  • The release landed the same day as a same-day regression, version 2.1.266 shipped hours later to revert an unrelated gateway sign-in bug 2.1.265 had introduced.

Two More Trust-Boundary Fixes Land in 2.1.265

Claude Code 2.1.265 shipped on September 8, 2026 as a large, 50-bullet release, and buried inside a long list of quality-of-life fixes and VS Code polish were two changes that matter for what a Claude Code session is allowed to do without a user's explicit say-so. Both continue a pattern Anthropic has kept up nearly every week since mid-August: finding a narrow way a permission, sandbox, or isolation boundary could be stepped around, and closing it.

Plugin Symlink Containment Escape

Claude Code checks that a plugin's files stay inside the plugin's own directory before treating them as trusted. Anthropic found that a plugin path containing a backslash could slip past that symlink containment check on both macOS and Linux, which meant a maliciously or carelessly packaged plugin could point at files outside the folder it was supposed to be confined to. The fix closes that specific bypass, keeping plugin file access scoped to where a user actually installed it.

Untrusted Content Is Now Flagged, Not Relayed

The second fix targets a subtler risk: prompt injection through Claude Code's own Artifact tool. When Claude reads an artifact that someone else wrote, such as a shared web page or dashboard, the tool used to summarize that content directly back into the conversation. Anthropic changed that summary step so it now explicitly treats the artifact's content as untrusted, calling out any instructions embedded in the page rather than quietly relaying them into Claude's context as if the user had typed them. That closes a route where a crafted artifact could try to get an agent to act on the artifact author's instructions instead of the user's.

Part of a Longer Pattern

Neither fix is a dramatic standalone exploit on its own, but they follow the same shape as the batches of permission and sandbox fixes Anthropic shipped roughly weekly through August, including clusters of six, nine, and twelve gaps patched in single releases. The consistency of the cadence suggests active, ongoing scrutiny of Claude Code's trust boundaries rather than one-off patching.