Back to rankings

Claude Code Patches Six More Permission, Symlink, and Credential-Leak Gaps

Claude CodeView original changelog

Claude Code 2.1.268, released September 10, 2026, closed six more ways a session could act outside a boundary a user had configured, continuing the near-daily pattern of permission-hardening releases that ran through August and into September. The release fixed deny and ask rules on symlinked system directories that silently stopped applying when a path was spelled by its real location, closed a gap where an env -C or eval command on the same line as a file operation could dodge a Read or Edit deny rule, and stopped plugin, marketplace, and MCP error messages from printing tokens, passwords, or resolved secrets. It also stopped a respawned in-process teammate from inheriting tools or a system prompt from a same-named agent file in an untrusted folder, and tightened Cowork's auto-approve mode so the Artifact tool refuses a local file outside the session's folders or behind a symlink instead of reading it without asking.

Key Takeaways

  • Symlinked system directories are now actually protected, closing a gap where deny and ask rules on /etc, /tmp, /var, and /bin stopped working once a path was given by its resolved, non-symlinked location.
  • env -C and eval could previously smuggle a file operation past a Read or Edit deny rule; the permission checker now catches both.
  • Error messages were quietly leaking secrets: git-URL tokens and passwords in plugin and marketplace errors, and resolved ${VAR} values in MCP server details and login errors, are now redacted.
  • A respawned teammate could inherit behavior from an untrusted, same-named agent file, letting a file in an unvetted folder influence a running session; that path is now closed.
  • Cowork's skip-all-approvals mode had a blind spot: the Artifact tool could read a local file outside the session's folders or behind a symlink without asking, and now refuses it.
  • This continues a sustained run of permission and sandbox hardening stretching back through late August, indicating Anthropic treats trust-boundary bugs as a standing priority rather than one-off patches.

Symlink and Permission-Rule Bypasses Closed

Claude Code 2.1.268 fixed two related gaps in how deny and ask permission rules hold up against symlinks and command-line tricks. Rules written to protect symlinked system directories such as /etc, /tmp, and /var on macOS, and /bin on Linux, previously stopped applying whenever a command referenced the path by its real, resolved location rather than the symlinked spelling; Bash commands could do the same by writing a deny rule against the symlinked path and then targeting the real path instead. Anthropic closed both directions of that gap in this release.

A second, related fix addressed Read and Edit deny rules breaking down when the command carried extra syntax the permission checker could not fully analyze. Wrapping a file operation in env -C (to run a command in a different directory) or eval on the same line as the guarded path let the check be skipped entirely. Both fixes fall squarely into Anthropic's ongoing effort to make permission rules mean what they say, regardless of how a path or command is phrased.

Credential and Secret Leaks in Error Messages

Two further fixes stopped Claude Code from inadvertently printing secrets in error text. Plugin and marketplace errors could previously surface a token or password embedded in a git source URL; that text is now scrubbed before display. Separately, /mcp and /plugin server details, claude mcp list/get, and MCP login errors could show secrets that had already been resolved from ${VAR} placeholders in an MCP configuration file, exposing values a user had deliberately kept out of the config file itself. Both are now redacted.

Untrusted Agent Files and Cowork's Artifact Tool

Rounding out the release, Anthropic fixed a case where a respawned in-process teammate could pick up tools or a system prompt from a same-named agent file sitting in a folder the user had never trusted, letting an untrusted file influence a running session's behavior. Separately, in local Cowork sessions set to skip all approvals, the Artifact tool now refuses a local file outside the session's own folders, or one reached through a symlink, instead of reading it without asking, closing an unintended blind spot in an otherwise fully automated approval mode.