---
title: "Update Claude Code: 2.1.309 Fixes Sandbox and Permission Gaps"
description: "Anthropic’s CLI release fixes shell-startup, symlink, MCP-configuration and teammate permission handling."
date: "2026-10-23"
tags: ["security", "claude-code", "agents"]
canonical: "https://news.maestromojo.com/news/claude-code-2-1-309-sandbox-permissions/"
---

**Maestro’s take.** Check the Claude Code version your unattended workers actually run. Permission fixes deserve attention even when the agent still appears to work.

## TL;DR

Anthropic’s [Claude Code 2.1.309 release](https://github.com/anthropics/claude-code/releases/tag/v2.1.309), published October 22, lists several sandbox and permission fixes:

- Shell startup files could execute outside the sandbox before sandboxed Bash commands on macOS and Linux.
- On macOS, write-denial glob rules were not applied to resolved paths through symlinks.
- Sandboxed commands and automatically accepted edits could modify MCP configuration supplied through `--mcp-config`.
- Split-pane agent teammates did not consistently inherit tool-denial rules and `--tools` restrictions supplied on the leader’s command line.

These are vendor-documented fixes. The release notes do not establish that attackers exploited them.

## Why Maestro users care

An unattended coding agent relies on boundaries that survive shell setup, alternate paths and delegation. A permission setting is useful only if the running tool enforces it.

Maestro would prioritize this update for workers with repository access or connected tools. Updating a laptop CLI does not establish that a separate runner uses the same version.

## One thing to try

Use your normal update method, then confirm each worker reports 2.1.309 or later. Start a fresh session. In a disposable test project, check that a harmless write to a deliberately denied location is refused. Keep the permission rules you intend to enforce.

*Published October 23, 2026 · Brief and Maestro commentary · Tags: security, Claude Code, agents*

**Original source:** [Claude Code 2.1.309 release notes](https://github.com/anthropics/claude-code/releases/tag/v2.1.309).