AI 程式工具／代理安全
Claude Code 2.1.233 Limits Bash Memory and Closes a Windows NTLM Credential Leak Vector
The new release can use Linux memory cgroups to cap memory for builds and tests run by the agent, preventing runaway processes from crashing the entire session. It also fixes a Windows special-path validation bypass, an MCP reconnection loop, and a sandbox issue that consumed an entire CPU core while idle.
Anthropic released [Claude Code 2.1.233](https://github.com/anthropics/claude-code/releases/tag/v2.1.233) on August 14, focusing not on a model change but on tightening the execution boundaries of the coding agent. Linux users can now set `CLAUDE_CODE_TOOL_MEMORY_LIMIT` to use a memory cgroup to limit build, test, or installation processes launched by the Bash tool. In large projects, memory leaks or runaway parallel builds should therefore no longer inevitably bring down the agent session. This capability must be explicitly enabled, however, and the changelog does not explain how processes are terminated when they exceed the limit or whether all child processes are covered, so production environments should still validate the behavior independently.
On the security front, previous versions on Windows did not correctly block paths expressed using the NT `\??\` device prefix, potentially allowing crafted paths to bypass UNC validation and trigger outbound NTLM credential disclosure. The new release closes this vector. Version 2.1.233 also rolls back some permission changes from the previous release involving Cygwin symlinks and input redirection. This suggests that path normalization across PowerShell, Git Bash, and Cygwin has not yet fully converged; a narrower fix will be reimplemented in a future release.
The agent infrastructure also received several fixes with practical implications. When MCP v2 connects to serverless servers that periodically close long-lived connections, it no longer restarts `subscriptions/listen` indefinitely. An issue that caused the Linux sandbox to consume an entire CPU core while idle has been fixed. Apps Gateway can optionally forward a signed-in user identity, allowing enterprise agents to attribute costs on a per-user basis. Notably, new models no longer receive the built-in Todo/Task tracking tools by default. Existing workflows that depend on these tools can temporarily restore them by setting `CLAUDE_CODE_ENABLE_TODO_TOOLS=1`.