Claude Code 2.1.309 Patches Sandbox and Permission Checks, Closes MCP Configuration Write Path

Anthropic released Claude Code 2.1.309 on October 22, addressing several issues involving command execution, file writes, and permission propagation. Previously, sandboxed Bash commands on macOS and Linux loaded shell startup files outside the sandbox before each execution. On macOS, denyWrite wildcard rules could also fail to apply to the actual path when a directory was accessed through a symbolic link. These fixes directly affect whether the isolation boundary matches the user’s configuration. Release notes

Another set of fixes targets agent configuration and tool permissions: sandboxed commands and auto-approved edits could previously modify MCP configuration files supplied through --mcp-config; disabled MCP servers could also be reconnected by subsequent permission prompts in non-interactive and SDK sessions. The release also fixes a case where agent teammates in split panes did not inherit the main agent’s command-line tool deny rules. From an engineering perspective, these changes affect whether restrictions remain in force across configuration, sessions, and agent delegation. Release notes

Official documentation explains that Claude Code’s Bash sandbox uses operating system enforcement to restrict which files and network resources shell commands and their child processes can access. macOS uses Seatbelt, while Linux and WSL2 rely on components such as bubblewrap. However, built-in file tools, MCP servers, and hooks operate outside this sandbox layer and are governed by separate rules. Enabling the Bash sandbox therefore still needs to be paired with tool permission settings to cover the full agent workflow. Sandboxing documentation

Deployment teams can prioritize validating three scenarios: denied-write directories accessed through symbolic links, protection of specified MCP configuration files, and whether subagents inherit tool restrictions. The documentation also provides methods for testing file writes and network access, and recommends having the agent run tests, since commands users enter themselves at the ! prompt are generally not subject to the same sandbox constraints. The release notes do not specify the earliest affected versions, prerequisites for exploitation, or whether any of these issues were actually abused. They therefore do not support an assumption that all deployments were compromised. Sandboxing documentation Release notes