Sandbox boundaries and policy enforcement
Anthropic issued Claude Code v2.1.309 to address multiple sandbox escapes and permission boundary oversights. Previously, sandboxed Bash commands on macOS and Linux ran shell startup files outside the sandbox before every command invocation. macOS denyWrite patterns also missed target files when folder paths resolved across symlinks. Additionally, automated edits and sandboxed processes could tamper with MCP configuration files passed on the command line.
The release also hardens environment guards and shell parsing. Worktree-isolated sessions previously executed certain locale-prefixed commands and zsh arithmetic expressions that bypass checks. On Windows, PreToolUse and PermissionRequest hooks running in PowerShell failed open when Git for Windows was missing from the environment.
Subagent inheritance and execution workflows
Tool governance now carries across parallel agent structures. Split-pane teammate agents failed to inherit tool restriction parameters set on the leader instance, allowing subagents broader capabilities than their orchestrator. For orchestrated systems, the claude-api skill now structures managed subagent teams with dynamic workflows enabled by default instead of standard coordinator patterns.
Interactive prompts were also refined to prevent unmonitored failures. The ultrareview tool now demands workspace trust before running, requiring terminal confirmation, a trust flag, or a dedicated environment variable. Unattended runs in bypass permissions mode now reject destructive directory removal commands immediately with rewrite hints rather than pausing on interactive prompts. Finally, sessions handed over to replacement runners clearly flag interrupted actions as outcome unknown.
Our assessment
Teams deploying Claude Code in automated or multi-agent environments should audit their tool denial configurations and review whether custom PowerShell hooks relied on missing Git binaries. If unattended jobs execute destructive operations or rely on coordinator-style subagent arrangements, test runs to ensure new rewrite hints and dynamic workflow defaults do not alter expected command completions.
Source: Anthropic original publication.
Read the original material
Anthropic (opens in a new tab)The article date belongs to Agentic Horizon. The source publication date is listed separately. Vendor claims remain attributed; we have not independently tested the reported capability.
