Fetching from the wire…
01
02
03
04
05
06
07
08
Vibe Coding2026-08-29 · source-backed
Server-managed settings that terminate sandbox TLS, route sandbox traffic through your proxy, inject credentials, or weaken isolation all need approval before applying. ANTHROPIC_CUSTOM_HEADERS from managed or project settings needs approval when it sets a credential, org/tenant, routing or API-behavior header like Authorization or Host. And project-level .claude/settings.json env can no longer set CLAUDE_CONFIG_DIR, CLAUDE_CODE_TMPDIR, or TMPDIR/TMP/TEMP. A checked-in project settings file was a config-injection path, and it's now scoped down. Which means cloning an untrusted repo was a bigger deal than most people treated it as. (Claude Code Changelog)
Each link below shares sources, entities, or timing with this story.
The changelog shows sandbox filesystem deny entries being bypassed on Linux and macOS: specifically, denyRead: "~/.aws/" written with a trailing slash was silently ignored. That follows the zsh regex bypass, the PreToolUse auto-allow bypass, and the tabs/invisible-Unicode prom...
Two things in one release, and only one of them is in the security section. CLAUDE_CODE_SUBAGENT_MODEL used to override the model for every subagent. In 2.1.251 it sets the default instead. An agent definition's model: frontmatter now wins, and so does an explicit per-spawn mo...
v2.1.218 took dangerous-rm, background-&, and suspicious-Windows-path checks out of permission dialogs, and stopped prompting in plan mode for Bash the static analyzer can't prove read-only. /deep-research also now starts only when you invoke it. Fewer interrupts, but a model...
The August 7 release adds claude self-hosted-runner so Team/Enterprise customers can host web, mobile and desktop sessions on their own machines or containers, plus cross-session SendMessage/ListAgents so sessions on any of your machines can message each other (macOS and Linux...
One Claude Code release fixed two independent permission-check bypasses on the same day. That's the story. Version 2.1.221, shipped August 4, patches a Bash tool bypass where zsh could execute hidden commands embedded inside [[ ]] regex conditionals. The approval prompt never...
If you've written Claude Code skills with context: fork in the frontmatter, go check them right now. As of the July 22 release, /code-review runs as a background subagent, and any skill declaring context: fork runs in the background by default (release notes). The opt-out is b...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.