Anthropic · 2026-11-13 · notable
Claude Code 2.1.325 — sandboxed Bash commands now ask for permission
In short
Claude Code 2.1.325 makes sandboxed Bash commands follow the normal permission flow by default and fixes a security issue in zstd response decoding. It also closes several gaps in Bash permission checks.
Anthropic · 2026-11-13 · 1 source checked
Claude Code 2.1.325 stops running sandboxed shell commands without a prompt unless you opt back in.
What is it?
The main default change in Claude Code 2.1.325 is for the Bash sandbox: commands that run inside it now go through the normal permission flow instead of running without a prompt. The release also fixes a security issue in how zstd-compressed responses are decoded.
How does it work?
Users who want the old behavior set sandbox.autoAllowBashIfSandboxed to true; organizations that turn the sandbox on through managed settings must set it in their highest-ranking managed source. Other permission fixes cover compound Bash commands that could run without asking, an allow rule that could run a different program than the one it names, and relative deny rules such as Read(./.env) that stopped applying after a cd.
Why does it matter?
Teams that relied on the sandbox to run commands unattended will now see prompts, and scheduled tasks and /loop now ask before running a skill that declares allowed-tools or hooks. The trade is more prompts for fewer silent gaps in what an agent may run.
Who is it for?
Claude Code users and admins who manage its settings
Try it
npm i -g @anthropic-ai/claude-code@2.1.325