Anthropic · 2026-10-22 · major
Claude Code 2.1.309 — a round of sandbox and permission fixes
Claude Code 2.1.309 closes several sandbox and permission gaps, such as shell startup files running outside the sandbox. It follows 2.1.307, which added /claude-api api-version and a safety_event OpenTelemetry event.
Claude Code 2.1.309 is a security-focused release that tightens the Bash sandbox and permission checks.
Quick facts
| Version | v2.1.309 (after v2.1.307) |
|---|---|
| Maker | Anthropic |
| Released | 2026-10-22 |
| Sandbox fix | Shell startup files no longer run outside the sandbox |
| ultrareview | Now requires workspace trust (--trust-workspace in scripts) |
| New in 2.1.307 | /claude-api api-version, claude_code.safety_event |
What is it?
Sandbox and permission fixes lead Claude Code 2.1.309. On macOS and Linux, sandboxed Bash commands no longer run the shell's startup files outside the sandbox before each command, and sandboxed commands or auto-accepted edits can no longer change the MCP config file passed with --mcp-config. The release also closes gaps where an Edit(path) deny rule missed some Bash redirects and where compound commands that change directory before running git skipped a prompt.
How does it work?
Several defaults change too. `claude ultrareview` now asks for workspace trust on a terminal and refuses otherwise, unless a script passes --trust-workspace. In bypass permissions mode in the Desktop app and VS Code, a dangerous rm or rmdir is denied at once with a rewrite hint so unattended sessions keep going, and `sed -i` now gets the standard Bash prompt instead of a simulated edit preview.
Why does it matter?
Teams that rely on the sandbox to contain agent commands get real holes closed, including symlinked paths that slipped past macOS denyWrite globs. The earlier 2.1.307 release added /claude-api api-version to move code to Claude API version 2026-10-21, and a claude_code.safety_event OpenTelemetry event that logs every tool call a rule, hook, safety check or the sandbox stopped.
Who is it for?
Claude Code users, teams running sandboxed or unattended agents
Frequently asked questions
- Should I update to Claude Code 2.1.309 if I use the sandbox?
- Claude Code 2.1.309 fixes several sandbox gaps, so sandbox users have good reason to update. Sandboxed Bash commands on macOS and Linux had run the shell's startup files outside the sandbox before each command, and sandboxed commands could modify the --mcp-config file. On Linux, sandbox write denies could also lift when a background command outlived the session.
- Why does claude ultrareview now ask me to trust the workspace?
- Claude Code 2.1.309 changed claude ultrareview to require workspace trust. On a terminal it asks; otherwise it refuses. Scripts can pass --trust-workspace, which takes no value, so a PR number or base branch goes before it. Setting CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1 turns the check off.
- How do I move my code to Claude API version 2026-10-21 with Claude Code?
- Claude Code 2.1.307 added the /claude-api api-version command, which moves Claude API code to API version 2026-10-21. The same release added the claude_code.safety_event OpenTelemetry event for each tool call that a permission rule, auto mode, a safety check, a hook or the sandbox stopped, prompted or sent back.
- Can I still undo sed -i edits with /rewind in Claude Code?
- No. Since Claude Code 2.1.309, sed -i gets the standard Bash permission prompt and runs as written, instead of showing a simulated file-edit preview. Like other edits made through Bash, its changes are no longer restored by /rewind.
Try it
npm i -g @anthropic-ai/claude-code@2.1.309