Claude Code Closes Two More Bash Sandbox and Permission Gaps
Claude CodeClaude Code 2.1.251, released August 28, 2026, closed two more ways a session could act beyond what a user had approved. Bash permission checks were auto-approving commands that assigned an arithmetic expression to an integer shell variable, letting a crafted command such as OPTIND=1/0 or RANDOM=2+2 skip the approval prompt entirely. Separately, Anthropic changed how sandboxed Bash commands create and read back their own output files, so a command running inside the sandbox can no longer redirect or replace them. Both fixes follow the same pattern as several earlier August patches, closing a corner of the permission or sandbox boundary that a crafted command could quietly step around.
Key Takeaways
- A Bash arithmetic loophole let commands like
OPTIND=1/0auto-approve without a prompt, and Claude Code 2.1.251 now routes them through the normal approval flow. - Sandboxed output files were swappable, letting a command running inside the sandbox redirect or replace the files Claude Code reads its results from.
- Both fixes shipped alongside a separate cluster of nine permission and sandbox gaps patched in the same August 28 release.
- This is at least the fourth wave of permission and sandbox hardening in two weeks, following clusters on August 19, August 25, and August 27.
- Neither fix required a new opt-in setting; the safer behavior is automatic for every Claude Code user on 2.1.251 or later.
- The pattern points to shell semantics and sandbox file handling as recurring sources of bypasses, distinct from the network and credential-leak issues patched earlier in August.
Sources & Mentions
3 external resources covering this update
Two More Bypasses Closed in 2.1.251
On August 28, 2026, Anthropic shipped Claude Code 2.1.251, a release with 71 changes spanning hooks, Remote Control, and a long list of fixes. Among them were two changes that tighten the permission and sandbox boundary, separate from the larger batch of nine gaps Anthropic grouped together in the same release.
A Bash Arithmetic Loophole
Claude Code's Bash permission checks are meant to prompt for approval before running most commands, but they had a blind spot: a command that assigned an arithmetic expression to an integer shell variable, such as OPTIND=1/0 or RANDOM=2+2, was auto-approved without ever reaching the user. Because shell arithmetic assignments can trigger side effects or be chained with other logic, a crafted command in this form could slip past a check the user believed was protecting them. Claude Code now routes these commands through the same approval prompt as any other Bash command.
Sandbox Output Files Could Be Swapped
The second fix changes how Claude Code creates and reads back the files it uses to capture output from commands running inside the sandbox. Previously, a sandboxed command could redirect or replace those output files, giving a command running inside the sandbox a path to influence what Claude Code believed the command had actually produced. Anthropic changed the file handling so a sandboxed command can no longer touch its own output files after the fact.
Part of a Broader Pattern
These two fixes shipped in the same release as a separate cluster of nine permission, sandbox, and isolation fixes, following six similar fixes in the August 25 release and two more on August 27. Taken together, Claude Code patched more than a dozen distinct ways a session could act outside an approved boundary in the final two weeks of August 2026 alone, reflecting sustained scrutiny of the tool's permission and sandbox model as adoption grows.