Back to rankings

Claude Code Patches Three More Permission and Credential-Leak Gaps

Claude CodeView original changelog

Claude Code 2.1.274, released September 17, 2026, closed three more paths where a session could act outside a boundary a user had configured, continuing Anthropic's near-daily cadence of permission-hardening releases. The release fixed Bash commands that loop over or assign certain special shell variables so they now correctly trigger a permission prompt, and stopped worktree-isolated sessions from accepting Bash commands that used certain nested shell expansions to slip past isolation. Separately, Anthropic fixed MCP connection errors and the MCP login tool's description leaking secrets that had been resolved from ${VAR} placeholders in MCP configs, closing a credential-exposure path.

Key Takeaways

  • Three more trust-boundary gaps closed in Claude Code 2.1.274, continuing Anthropic's near-daily cadence of permission and credential fixes through August and September 2026.
  • Special shell variables could dodge Bash permission checks, letting a command that looped over or assigned certain variables run without the approval prompt it should have triggered.
  • Worktree isolation had a nested-expansion gap, where certain shell expansions let a command inside an isolated worktree slip past the isolation boundary; it is now refused outright.
  • MCP error messages were leaking secrets, with connection errors and the MCP login tool's description showing values resolved from ${VAR} placeholders in MCP configs.
  • The fixes ship with no user-facing UI changes, underscoring that Anthropic treats permission and isolation enforcement as an ongoing hardening effort rather than a one-time pass.

Anthropic Continues Its Near-Daily Permission Hardening

Claude Code 2.1.274, released September 17, 2026, closed three more paths where a session could act outside a boundary a user or organization had configured. The release continues a pattern that has run through August and September, where Anthropic has shipped small clusters of permission, sandbox, and credential fixes in nearly every release.

A Bash permission check gap involving special shell variables

Bash commands that loop over or assign certain special shell variables previously slipped past Claude Code's permission checker without triggering an approval prompt. These commands now correctly ask for permission before running, closing a route by which a crafted command could have executed without the review a user expects.

Worktree isolation gets stricter

Sessions running in an isolated worktree previously accepted Bash commands that used certain nested shell expansions, a technicality that could let a command reach outside the isolation boundary the worktree was supposed to enforce. Claude Code now refuses these commands outright.

MCP configs stop leaking secrets into error text

Separately, Anthropic fixed a credential-exposure issue where MCP connection errors and the MCP login tool's own description could show secrets that had been resolved from ${VAR} placeholders in MCP server configs. That meant a value meant to stay hidden, such as an API key referenced by an environment variable, could appear in plain text in an error message or a tool description.

Together, the three fixes fit the trust-boundary pattern that has defined Claude Code's recent release cadence: none of them are user-facing features, but each one closes a way a session, a command, or an error message could do or reveal more than a user had approved.