# Claude Code 2.1.325 — sandboxed Bash commands now ask for permission

> Claude Code 2.1.325 stops running sandboxed shell commands without a prompt unless you opt back in.

- Org: Anthropic
- Date: 2026-11-13
- Category: tool
- Source: https://github.com/anthropics/claude-code/releases/tag/v2.1.325
- Canonical page: https://ai-tldr.dev/releases/anthropic-claude-code-2-1-325/

## In short

Claude Code 2.1.325 makes sandboxed Bash commands follow the normal permission flow by default and fixes a security issue in zstd response decoding. It also closes several gaps in Bash permission checks.

## What it is

The main default change in Claude Code 2.1.325 is for the Bash sandbox: commands that run inside it now go through the normal permission flow instead of running without a prompt. The release also fixes a security issue in how zstd-compressed responses are decoded.

## How it works

Users who want the old behavior set sandbox.autoAllowBashIfSandboxed to true; organizations that turn the sandbox on through managed settings must set it in their highest-ranking managed source. Other permission fixes cover compound Bash commands that could run without asking, an allow rule that could run a different program than the one it names, and relative deny rules such as Read(./.env) that stopped applying after a cd.

## Why it matters

Teams that relied on the sandbox to run commands unattended will now see prompts, and scheduled tasks and /loop now ask before running a skill that declares allowed-tools or hooks. The trade is more prompts for fewer silent gaps in what an agent may run.

## Who it's for

Claude Code users and admins who manage its settings

## Try it

npm i -g @anthropic-ai/claude-code@2.1.325

## Links

- [Release Notes](https://github.com/anthropics/claude-code/releases/tag/v2.1.325)
- [Repository](https://github.com/anthropics/claude-code)