Claude Code Closes Seven More Permission and Auto Mode Gaps
Claude CodeClaude Code 2.1.271, released September 14, 2026, continued Anthropic's near-daily cadence of permission-hardening releases, closing seven more paths where a command could dodge a permission rule or bypass auto mode's safety review. Four separate Bash permission-check gaps were patched, covering unrecognized-option file reads, wildcard-expanded files, misrepresented shell-variable flags, and directory-hopping command chains. Anthropic also changed how auto mode reviews inline shell commands and subagent hand-backs, and added a new per-command allowed_domains setting that scopes network access to only the hosts a specific command needs instead of a standing broad allow rule.
Key Takeaways
- Four Bash permission-check bypasses were patched, covering option-following file reads, wildcard-expanded files, misrepresented shell-variable flags, and directory-hopping command chains.
- Auto mode's safety classifier no longer has the final say alone on inline shell commands: commands inside skills and slash commands now go through default-mode permission rules instead of classifier-only review.
- Subagent hand-backs are now explicitly reviewed: a dedicated call the classifier checks directly, closing a gap where only the subagent's last message was checked after the fact.
- A new per-command
allowed_domainssetting lets auto mode open network access to only the hosts a specific Bash, PowerShell, or Monitor command needs, replacing a standing broad allow rule. - This is the latest in a long, near-daily series of permission and sandbox hardening releases that ran through August and into September 2026, following similar bundles on 2.1.257, 2.1.259, 2.1.260, 2.1.265, 2.1.267, 2.1.268, and 2.1.269.
- None of the seven fixes or additions require user action: they ship automatically in 2.1.271, and no configuration change is needed to benefit from them.
Seven More Permission and Auto Mode Gaps Closed
Claude Code 2.1.271, released September 14, 2026, continued the near-daily cadence of permission-hardening releases that ran through August and into September 2026, closing seven more paths where a command could dodge a permission rule or where auto mode's safety classifier could be bypassed.
Four Bash Permission-Check Fixes
Anthropic patched four separate Bash permission-check gaps. Checks were missing a file read by commands such as fmt or column when that file followed an option the checker did not recognize. Checks were also skipping files that a wildcard expanded to when the wildcard sat inside a command's pattern or option value, for example grep -v dir/* file. A crafted shell-variable declaration flag could misrepresent the command actually being run to the permission checker, and Bash commands chaining two directory changes, a subshell, or a cd-plus-git sequence could skip the prompt required by permissions.blockReadsOutsideWorkingDirectories in bypass and auto mode.
Auto Mode's Classifier Gets Backup
Two "Changed" items narrow how much auto mode's safety classifier is trusted to decide alone. Inline ! shell commands inside a skill or slash command now follow the same default-mode permission rules as any other command, instead of being judged solely by the classifier; a command no explicit rule covers is now treated as a normal reviewed tool call rather than an automatic pass. Separately, when a subagent hands control back to the agent that spawned it, that hand-back now goes through a dedicated call the safety classifier reviews directly, closing a gap where only the subagent's last message was checked after the fact.
New Per-Command Domain Scoping
The release also added a capability that narrows what auto mode can reach in the first place, rather than only patching after-the-fact bypasses. A new allowed_domains setting can be applied per command for Bash, PowerShell, and Monitor tool calls under auto mode with sandboxing: the specific hosts a command needs are reviewed alongside the command itself and opened only for that single call, with every other host refused by default.
Together, the seven changes extend a pattern Anthropic has sustained since August: narrow, frequent corrections to Claude Code's permission, sandbox, and policy-enforcement layers, none of which require any user action to take effect.