Closing the "Files Written Inside the Box Run Outside the Box" Gap — Claude Code v2.1.309 Shuts a Cluster of Unattended-Operation Bypasses at Once, While v2.1.307 Puts the Moves It Blocked on the Record

On October 22, 2026, Anthropic released v2.1.309 of its coding agent, Claude Code. Skim the headline and it looks like a routine release of bug fixes and stability improvements. Open the changelog, though, and you find a whole cluster of fixes that close bypasses in the sandbox (the isolation box that confines execution) and in permission checks, lined up together. Two days earlier, v2.1.307 added an audit event that records the moves a guardrail actually blocked. Both are defensive measures that matter most wherever agents run unattended.

The hole where what's written "inside the box" runs "outside the box"

The bypasses closed this time share a common shape. The agent itself lives inside the box, yet a "trusted mechanism" sitting outside the box ends up executing, loading, or applying something written inside it. Centered on macOS and Linux, the following were the main gaps sealed.

• Startup files running outside the box: Bash commands under the sandbox were loading the shell's startup files outside the isolation each time they ran. This is a path by which arbitrary code could run with the user's own privileges.
• Write denials bypassed via symbolic links: macOS denyWrite directives were not being applied to the real location reached by following a symbolic link.
• Tampering with MCP config files: Commands under the sandbox, or auto-approved edits, could rewrite the very config file passed via --mcp-config.
• Missing confirmations on compound commands: Cases where a compound command that changes directory before running git, or a write involving redirects or subshells, failed to raise the approval prompt that should have appeared.
• Worktree-isolation bypasses: The isolation guard was accepting locale-prefixed commands it should have denied, as well as certain arithmetic commands under zsh.
• Reconnecting disabled MCP servers: An MCP server that had been disabled was being reconnected by a later permission prompt (print / SDK sessions).

Taken one by one, these are unremarkable holes. But in unattended operation, or when you let an agent touch someone else's repository, a single bypass can undermine the premises of the entire permission design. That's exactly why closing them all at once matters.

Keeping a record of what the defenses blocked

v2.1.307 added the OpenTelemetry event claude_code.safety_event. Every time a permission rule, auto mode, safety check, hook, or the sandbox blocks, prompts for confirmation on, or rejects a tool call, it is recorded as a structured event.

Until now, "the moment a guardrail kicked in" slipped by and vanished unless a person was watching the screen. In unattended operation, where no one is pressing "yes/no" anymore, being able to later trace "what was stopped, and where" as an audit trail is no small thing. The same release also includes a migration to API version 2026-10-21 via /claude-api api-version — the CLI catching up with the API revision we covered recently (the removal of the sampling-adjustment knobs).

What to do now if you're running unattended

Here are the practical steps the update calls for, listed by task.

• Update first: The bypasses above touch the premises of permissions and isolation. If you run unattended, share repositories, or use headless / SDK setups, the priority for applying the update is on the higher side.
• Prepare for the ultrareview spec change: claude ultrareview now requires a workspace trust confirmation. In a terminal it asks; absent one, it refuses. From scripts you need to pass --trust-workspace (or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1). Patch this in ahead of time so your automation doesn't silently stall.
• Check the change in sed -i behavior: sed -i, previously treated as a kind of pseudo edit preview, now runs as an ordinary Bash command. /rewind cannot undo it. Revisit any flow that assumes rollback.
• Put safety_event on your monitoring: If you're already streaming OpenTelemetry, setting up a path to visualize and aggregate blocked tool calls makes inspecting unattended operation easier.

Why seal this many at once

The fact that a single release lines up this many fixes around permissions and the sandbox shows, conversely, that "confining an agent capable of running code inside a safe box" is still hard. Among researchers, too, there are repeated reports of techniques by which a sandboxed agent slips past its limits through "trusted tools outside the box," along with warnings that isolation should not be overtrusted.

This round of fixes is a steady set of measures in line with that concern. There's nothing flashy about it, but it can be said to harden, by one notch, the premise of running agents unattended. Behind the convenience, the work of permission design and auditing remains the operator's responsibility — that's the register in which it's reasonable to take this in.

References: Claude Code official changelog / anthropics/claude-code v2.1.307 release / Classmethod: Claude Code v2.1.308→v2.1.309 / Classmethod: Claude Code v2.1.307 / VibeHacker: the sandbox / MCP-config fixes in v2.1.309