Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-30 · high
A repository's settings file could redirect where Claude Code stores config and temp files, before a single prompt ran.
Why now: Anthropic released v2.1.251 on August 28 and listed these fixes in its changelog.
A symlink swapped into the working directory after Claude Code's permission check passed could redirect a write the check never caught. Anyone opening a repository they didn't write in Claude Code was exposed to file writes and reads outside the directories they'd approved.
Grep and Glob had a matching gap. A symlinked search path let them skip Read(...) deny rules meant to keep files out of reach. A rule written to block a directory could be walked around instead of enforced. Anthropic fixed both in v2.1.251, released August 28, according to its Claude Code changelog.
The same release closes a plugin marketplace issue where entries could point outside the plugin directory. It also closes a settings issue. A project's .claude/settings.json could set CLAUDE_CONFIG_DIR, CLAUDE_CODE_TMPDIR, or TMPDIR through its env block. Cloning a repo in Claude Code let the repo's settings file redirect where the tool reads its configuration and writes its temp files. That happened before a single prompt ran.
Anthropic also tightened approval. Settings that terminate sandbox TLS, route sandbox traffic through a proxy, or inject credentials now require explicit approval. So does ANTHROPIC_CUSTOM_HEADERS when it sets an auth or routing header.
The changelog doesn't say whether these were found through a bug bounty, internal review, or active exploitation. There's no word on how long the gaps sat open before the fix.
Each link below shares sources, entities, or timing with this story.
The August 20 update also lets plugin marketplaces mint short-lived headers instead of storing static tokens in config.
Below that version, file-modifying Bash commands could run during plan mode without waiting for approval, per the changelog.
The default is 200 search calls and 200 subagent spawns per session, adjustable through an environment variable when you hit it.
v2.1.211 stops Bedrock, Vertex, Mantle, and Foundry from rebilling cached system context as full-price input tokens.
A hook could exit code 2, report failure, and still let the tool run if its JSON failed schema validation, per Claude Code's changelog.
An r/ClaudeAI PSA (81 upvotes, 49 comments) and a matching X post surfaced something I checked immediately and then fixed on my own machine. cleanupPeriodDays defaults to 30, and the purge runs on every startup. It unlinks .jsonl files under ~/.claude/projects with no warning,...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.