Back to rankings

Claude Code Patches Twelve Permission, Sandbox, and Auto Mode Gaps

Claude CodeView original changelog

Claude Code 2.1.257 closed twelve separate ways a session could act outside boundaries a user had approved, continuing a pattern of weekly permission-hardening clusters through August. The fixes span auto mode (a new Containment Escape rule blocking cloud metadata-credential theft and cross-tenant reach, a bypass in compound commands and subshells, an auto-approved zsh conditional gap), the sandbox (unblocked trailing-dot domains, a Remote Control consent prompt that counted a dismissal as approval), and policy enforcement (MCP servers reconnecting past a managed block list, deny rules dropped after a settings reload, plugins escaping their own directory through a symlink). Anthropic also closed off a route where a project's own committed settings file could silently turn on full permission bypass.

Key Takeaways

  • A new Containment Escape rule blocks auto mode from silently approving cloud metadata-credential theft, egress evasion, or cross-tenant access attempts.
  • A committed project settings file can no longer force a full permission bypass, closing a route where a repository itself could grant bypass mode to anyone who opened it.
  • Dismissing the Remote Control consent prompt no longer counts as granting consent, a bug that let the next connection request through unchallenged.
  • Bash permission checks now catch zsh-specific [[ ]] conditionals and compound-command or subshell wrapping that previously slipped past a configured permissions.ask rule.
  • This is the fourth permission-hardening cluster in roughly a month, following similar batches on August 20, 25, and 28, 2026.
  • Plugins can no longer escape their own directory via a symlinked component path, closing off a path-traversal route for command, agent, skill, or hook definitions.

Auto Mode Gets New Guardrails

Claude Code 2.1.257 added a Containment Escape rule to auto mode, so cloud metadata-credential fetches, egress evasion, and cross-tenant reach are no longer auto-approved unless a session's environment explicitly marks that behavior as expected. The release also added a one-time prompt before a session's first file read outside its working directories, with a new permissions.blockReadsOutsideWorkingDirectories setting to refuse such reads outright instead of merely asking.

Two existing auto mode checks were also tightened. A permissions.ask rule could previously be skipped when the matching command ran inside a compound command or a subshell, letting it execute without the confirmation prompt a user had configured; that gap is now closed. Separately, Bash permission checks were auto-approving certain [[ ]] conditionals that zsh parses differently from bash, another route by which a command that should have prompted for approval did not.

Cloud Sessions and Consent Prompts

Reading an artifact that isn't the user's own, in Cowork and claude.ai cloud sessions, now always asks for confirmation first, even when auto mode is active. A separate consent bug meant that dismissing the Remote Control consent prompt, whether by pressing Esc or n at claude remote-control, was being treated as consent, so the very next connection request from that client connected without asking again.

Policy and Settings Enforcement

Several fixes closed gaps in how Claude Code enforces organization- and project-level policy. MCP servers listed in a settings file could still be connected or reconnected through /mcp even after a managed MCP allow/deny list or strictPluginOnlyCustomization was supposed to block them. --disallowedTools and session deny rules were being dropped after the first settings reload when allowManagedPermissionRulesOnly was enabled, silently widening what a session could do mid-session. Plugins could also read files outside their own directory by declaring a command, agent, skill, hook, or other component path that was a symlink; such paths are now rejected outright.

Perhaps the most consequential fix in this batch: a full permission-bypass default mode set inside a project's own checked-in settings file is now ignored, the same way the auto mode default already was. Previously, a committed repository settings file could put every session that opened it into full bypass mode without any user or admin action; that setting now has to come from user or managed settings, or be passed explicitly on the command line.

Sandbox Networking

Sandbox network deny rules had a quiet gap: a deniedDomains entry for a host written with a trailing dot, such as example.com., did not actually block traffic to that host from inside the sandbox, and choosing "don't ask again" for it kept prompting on every subsequent request instead of remembering the choice. Both parts of that bug are now fixed.

Taken together, this is at least the fourth cluster of permission, sandbox, and auto-mode fixes Anthropic has shipped in as many weeks, following similarly sized batches on August 20, 25, and 28.