Back to rankings

Claude Code Tightens Auto Mode and the rm Safety Prompt

Claude CodeView original changelog

Claude Code 2.1.261 closed two gaps in how the tool decides what it can do without asking first. Auto mode now treats a link that packs content into a public diagram renderer's URL as an upload to that site, so it is no longer auto-approved unless the user explicitly asked for it, closing a route for content to leave the sandbox without a prompt. Separately, Anthropic widened the dangerous-rm safety check to also catch rm -rf invoked through positional shell parameters and inside double-quoted sh -c scripts, two phrasings that previously slipped past the safety prompt. Both fixes continue Anthropic's near-weekly pattern of narrowing the gap between documented and actual permission behavior in Claude Code.

Key Takeaways

  • Auto mode now recognizes diagram-renderer links as uploads, closing a route where packed content could leave a session without triggering an approval prompt.
  • The fix targets an easy-to-miss exfiltration channel: URLs that embed content for public diagram-rendering services look like ordinary links but function as a data transfer.
  • The dangerous-rm safety prompt now covers positional shell parameters, such as rm -rf $1 inside a script, that previously bypassed the confirmation step.
  • Double-quoted sh -c wrapping no longer hides an rm -rf from the safety check, closing a second disguised form of the same command.
  • Neither fix changes behavior for normal, non-destructive commands; both narrow existing protections rather than adding new restrictions.
  • The release continues a near-weekly cadence of permission and sandbox hardening that Anthropic has maintained through August and into September 2026.

Auto Mode Stops Treating Diagram-Renderer Links as Free Uploads

Claude Code's auto mode is designed to let the tool make routine permission decisions on a user's behalf while still asking before anything risky happens. Version 2.1.261 closes a specific gap in that logic: previously, a link that packed arbitrary content into the URL of a public diagram-rendering service could be treated as harmless and auto-approved, even though visiting that link effectively uploads the packed content to a third-party site. Anthropic changed the behavior so a link shaped like that is now recognized as an upload to that service, and auto mode will not approve it unless the user explicitly asked for it. This matters because diagram-renderer URLs are an easy, inconspicuous way to move data out of a session; treating them as uploads rather than as benign navigation keeps that channel behind the same approval a user would expect for any other file transfer off the machine.

A Wider Net for Dangerous rm Commands

Claude Code has long prompted for confirmation before running a destructive rm -rf, but the detection had blind spots. This release teaches the safety check to also catch rm -rf when the target is passed as a positional shell parameter ($1, $2, and so on inside a script) and when the command is buried inside a double-quoted sh -c "..." string, a pattern commonly used to wrap commands for subshells or scripted execution. Both forms could previously execute without triggering the safety prompt, meaning a crafted or accidentally malformed script could delete files without the confirmation a user expects. Closing these two paths does not add new restrictions to normal rm usage; it simply extends the same prompt that already covers the plain form of the command to two disguised variants of it.

Why It Matters

Neither change is a headline feature, but both fall squarely into the category of permission and safety hardening that Anthropic has been shipping on an almost weekly cadence through August and into September 2026. Users relying on auto mode or on the default rm safety net get slightly stronger guarantees that Claude Code will ask before it does something irreversible or something that moves data off the machine, without any change to how the tool behaves for ordinary commands.