Back to rankings

Claude Code Patches Six Permission, Sandbox, and Isolation Gaps

Claude CodeView original changelog

Claude Code 2.1.246 closes six separate gaps in how the tool enforces permissions, sandboxing, and session isolation. Fixes include Bash commands with a dangling && or || operator that previously skipped approval, sessions that lost plan mode's execution restrictions after resuming, a sandbox filesystem check that ignored the --setting-sources flag, and cross-session leaks where one launch's uncommitted changes appeared in another. Anthropic also patched a credential leak that sent a third-party gateway's API key to its own telemetry endpoint, and added a startup warning for Bash allow rules whose wildcard sits before the subcommand, since those rules can match more than intended.

Key Takeaways

  • Malformed Bash commands could skip approval: commands with a dangling && or || operator sometimes bypassed the permission prompt before this fix.
  • Plan mode could silently drop on resume: sessions that ended in plan mode sometimes resumed with full execution permissions in VS Code and CLI resume flows when no permission mode was explicitly set.
  • A sandbox filesystem check ignored --setting-sources, meaning the sandbox's file access rules could diverge from what a user had scoped with that flag.
  • Concurrent sessions could leak uncommitted changes: launching multiple sessions from the same repository, such as across worktrees, could start one session with another's uncommitted changes.
  • A third-party gateway's API key was leaking to Anthropic's telemetry endpoint instead of staying scoped to the gateway it was configured for.
  • Claude Code now warns about overly broad Bash wildcard rules, flagging allow rules like Bash(git * main) that can match more commands than a user intended.

Six Permission and Isolation Fixes in One Release

Claude Code 2.1.246 lands a cluster of fixes that tighten the boundaries the tool relies on to keep actions inside what a user has actually authorized. None stem from a single root cause, but together they touch permission prompts, plan mode, sandboxed filesystem access, session isolation, and credential handling.

Permission-Prompt Gaps

Two fixes close cases where Claude Code could act without the approval a user would normally see. Bash commands containing a dangling && or || operator, malformed shell syntax, now always require approval instead of occasionally slipping past the permission check. Separately, sessions that ended a previous turn in plan mode, which restricts Claude Code to research and proposal rather than execution, were resuming outside plan mode in the VS Code extension and in claude -p --continue/--resume whenever no permission mode had been explicitly set, silently dropping the safety restriction the user had been relying on.

Claude Code also now warns at startup about Bash allow rules that place a wildcard before the subcommand, such as Bash(git * main), because that pattern can match options inserted before the subcommand and end up approving a broader set of commands than intended.

Sandbox and Session Isolation

The command sandbox's filesystem configuration was not respecting the --setting-sources flag, meaning the filesystem rules applied inside the sandbox could diverge from what a user had scoped with that flag. Separately, /ultrareview runs and cloud sessions launched at the same time from one repository, for example from several worktrees, could start with another launch's uncommitted changes rather than their own, a cross-session isolation failure that risked mixing work between concurrent sessions.

Credential Handling

Telemetry and metrics requests sent to Anthropic were carrying the API key configured for a third-party gateway (ANTHROPIC_BASE_URL) instead of Anthropic's own credentials. Claude Code now scopes each credential to its own host, so a gateway's API key is no longer sent anywhere outside that gateway.

Anthropic did not describe any of the six issues as actively exploited, and most require a user to already be running Claude Code with specific configurations (a third-party gateway, worktrees, plan mode) to be affected. Still, each one allowed Claude Code to behave with more permissiveness, or route data more broadly, than its configuration promised.