AI coding 工具
Claude Code 2.1.273 Patches Command Permission Bypasses and Enforces Enterprise MCP Policies
Anthropic fixed two command review gaps in version 2.1.273, along with a settings-merging issue that could cause managed MCP and connector policies to be ignored. The release also adds optional request headers for LLM gateways and MCP disconnection alerts, but Anthropic has not classified these fixes as CVEs or security advisories.
The focus of Claude Code 2.1.273 is not new model capabilities, but tighter control boundaries for agent-executed commands and connections to external tools. According to the official changelog, when `permissions.blockReadsOutsideWorkingDirectories` was enabled, Bash commands that the permission checker could not fully parse could sometimes bypass confirmation. Another fix addresses cases where a subshell could conceal a dangerous `rm` operation in bypass mode. Both issues affect one of the most sensitive parts of a coding agent: how model-generated strings are translated into actual system permissions.
The release also includes substantive fixes for enterprise settings. The `allowManagedMcpServersOnly`, `deniedMcpServers`, and `disableClaudeAiConnectors` policies configured through MDM or `managed-settings.json` might not have been applied when server-side managed settings were also present; version 2.1.273 corrects this merging behavior. Memory data from external working directories is also no longer loaded into prompts, indexed, or used for memory extraction, reducing the risk of data crossing project-configuration boundaries.
On the operational side, the new version can use `CLAUDE_CODE_GATEWAY_HINT_HEADERS=1` to send enterprise LLM gateways information about the request category, agent type, previous tool execution time, and context compaction status. These fields can help route workloads, investigate latency, and distinguish traffic from primary agents and subagents. The interface now also explicitly notifies users when an MCP server disconnects and automatic reconnection fails. A Remote Control session can be forked from the Claude app into a new session that runs locally in the background.
This release also fixes long-running workflow issues, including auto-compaction triggering too early, missing final reports from subagents, and scheduled tasks running in the wrong session. However, the available evidence currently comes mainly from the vendor's changelog; there are no CVEs, severity ratings, documented exploitation conditions, or independent reproduction reports. Teams using enterprise policies, remote sessions, or bypass mode should prioritize upgrading and run regression tests against their own combinations of deny rules, subshells, and MCP settings.