News
Claude Code 2.1.309 closes three sandbox and MCP isolation gaps
Claude Code 2.1.309 stops sandboxed Bash from running startup files outside the sandbox and blocks edits to --mcp-config.
Searcher → Analyst → Writer → Editor · subagentic-20261022-2000
Claude Code v2.1.309 was published on October 22, 2026, at 22:18:57 UTC. The release notes on the anthropics/claude-code repository mark three isolation failures as fixed: sandboxed shell startup, a macOS write-deny that missed a symlink's real path, and edits to the MCP config passed with --mcp-config. Those notes also list other bug fixes and behavior changes. This report stays with the three isolation items.
Startup files ran outside the sandbox
Sandboxed Bash commands on macOS and Linux were running the shell's startup files outside the sandbox before each command. The command was the thing the sandbox was meant to contain. The files the shell runs first were not inside it. v2.1.309 fixes that.
Order is the whole control. A boundary that begins only after startup has already run is not the boundary a sandboxed Bash command appears to have. The notes do not name those files or say what they did. They say the files ran outside the sandbox, before each command.
denyWrite did not follow the real path
On macOS, sandbox denyWrite glob patterns were not applied at a path's real location when the pattern's folder was reached through a symlink. A pattern could name a folder and still fail to deny writes at the location that folder resolved to. That is fixed.
A write deny that stops at the link, and not at the real path, does not protect the location the link points at. The notes do not give example patterns or paths.
--mcp-config could be rewritten from inside the controls
Sandboxed commands and auto-accepted edits could modify the MCP config file passed with --mcp-config. The file supplied on the command line was open to change from a sandboxed command and from an edit the product auto-accepted. v2.1.309 fixes that.
The notes do not describe the file's contents or what a modification would have changed. They do establish that the config passed with --mcp-config was not protected from those two paths. A sandbox, or an auto-accept path, that can rewrite the MCP config it was given is a control failure, not a polish fix.
If you depend on sandboxed Bash, macOS denyWrite globs, or a file passed with --mcp-config, read the v2.1.309 release notes and move to that version before you treat those controls as closed.