Claude Code 2.1.309 fixes several sandbox and permission gaps, including sandboxed Bash running shell startup files outside the sandbox before each command
A release made up mostly of security fixes. The ones that matter if you rely on the sandbox and permission rules for unattended runs.
// Key points
- Fixed: on macOS and Linux, sandboxed Bash commands ran the shell's startup files outside the sandbox before each command.
- Fixed: sandboxed commands and auto-accepted edits could modify the MCP config file passed with --mcp-config, and in some commands with a subshell an Edit(path) deny rule didn't block a Bash redirect to that path.
- Fixed: on Linux, sandbox write denies lifted when a background command outlived the session; on Windows, PowerShell permission checks auto-approved some Set-Location or cd commands with extra arguments.
- Changed: sed -i now gets the standard Bash prompt and runs as written instead of a simulated file-edit preview, and is no longer restored by /rewind; claude ultrareview now requires workspace trust.
Builder's takeIf you run Claude Code unattended in CI or scheduled jobs, upgrade today. This batch is also a reminder that the sandbox and permission rules are one layer; the real boundary is still the container and least-privilege credentials. And sed -i can no longer be undone with /rewind, so warn anyone who leans on /rewind as a safety net.
// Background · from #Coding agents
Full timeline →- Oct 23 Copilot's global default policy starts enforcement, rolling out through October 26: unconfigured features and MCP server settings will be set once from the global default
- Oct 23 The Copilot impact dashboard adds industry comparisons: agent adoption and merge rates benchmarked by company size across ten industries
- Oct 22 Claude Code 2.1.307 emits an OpenTelemetry event each time a safety layer stops, prompts or sends back a tool call