Update Claude Code: 2.1.309 Fixes Sandbox and Permission Gaps

2026-10-23

Maestro’s take. Check the Claude Code version your unattended workers actually run. Permission fixes deserve attention even when the agent still appears to work.

TL;DR

Anthropic’s Claude Code 2.1.309 release, published October 22, lists several sandbox and permission fixes:

• Shell startup files could execute outside the sandbox before sandboxed Bash commands on macOS and Linux.
• On macOS, write-denial glob rules were not applied to resolved paths through symlinks.
• Sandboxed commands and automatically accepted edits could modify MCP configuration supplied through --mcp-config.
• Split-pane agent teammates did not consistently inherit tool-denial rules and --tools restrictions supplied on the leader’s command line.

These are vendor-documented fixes. The release notes do not establish that attackers exploited them.

Why Maestro users care

An unattended coding agent relies on boundaries that survive shell setup, alternate paths and delegation. A permission setting is useful only if the running tool enforces it.

Maestro would prioritize this update for workers with repository access or connected tools. Updating a laptop CLI does not establish that a separate runner uses the same version.

One thing to try

Use your normal update method, then confirm each worker reports 2.1.309 or later. Start a fresh session. In a disposable test project, check that a harmless write to a deliberately denied location is refused. Keep the permission rules you intend to enforce.

Published October 23, 2026 · Brief and Maestro commentary · Tags: security, Claude Code, agents

Original source: Claude Code 2.1.309 release notes.