Claude Code 2.1.309 hardens sandbox and permission boundaries
Anthropic
Claude Code v2.1.309 (October 22, 2026) stops Bash startup files from running outside the sandbox, makes denyWrite symlink-aware, protects --mcp-config, and fixes Bash redirect and Edit(path) permission bypasses plus worktree isolation. The preceding v2.1.307 added the claude_code.safety_event OpenTelemetry event and an api-version command for API version 2026-10-21.
Why it matters
A cluster of permission-bypass fixes directly affects teams running Claude Code unattended or with bypassed approvals.
Importance: 3/5
notable release closing multiple sandbox and permission bypasses
Sources
official
Claude Code changelog
official
Releases - anthropics/claude-code