Claude Code 2.1.309 and 2.1.310: the sandbox and permission fixes to take now

Upgrade to Claude Code 2.1.309 or later if you treat the sandbox, Bash permission rules, Edit deny rules or blocking hooks as controls rather than conveniences. Thirteen of that release's 62 bug fixes are cases where one of those let something through anyway, and the version you are on today still behaves the way the changelog now describes as a bug. 2.1.310, a day later, is a smaller release whose headline is the Monitor tool.

Anthropic's changelog dates 2.1.309 to October 22, 2026 and 2.1.310 to October 23, 2026. The GitHub releases feed gives the precise times: v2.1.309 at 2026-10-22T22:18:57Z and v2.1.310 at 2026-10-23T23:39:00Z. Between them the changelog counts 14 improvements and 76 bug fixes.

#Which fixes in 2.1.309 affect what Claude Code is allowed to do?

The 62 fixes cover the whole product, but one group stands apart from the rest. Taking the changelog's wording, the sandbox fixes are:

• "Fixed sandboxed Bash commands on macOS and Linux running the shell's startup files outside the sandbox before each command"
• "Fixed macOS sandbox denyWrite glob patterns not applying at a path's real location when the pattern's folder is reached through a symlink"
• "Fixed sandboxed commands and auto-accepted edits being able to modify the MCP config file passed with --mcp-config"
• "Linux: Fixed sandbox write denies lifting when a background command outlived the session"

The permission checks are a second group:

• "Fixed the Bash permission check trusting a variable set by a command whose redirect can fail to open"
• "Fixed Bash permission checks not prompting for some compound commands that change directory before running git when the cd is wrapped or prefixed, as they do for a plain cd"
• "Fixed an Edit(path) deny rule not blocking a Bash redirect to that path in some commands that also held a subshell"
• "Windows: Fixed PowerShell permission checks auto-approving some Set-Location or cd commands that target the current directory and carry extra arguments; these now prompt for approval"
• "Fixed a disabled MCP server being reconnected by a later permission prompt in print and SDK sessions"

And a third covers the guards around isolated sessions and hooks:

• "Fixed worktree-isolated sessions accepting some locale-prefixed commands the isolation guard should refuse"
• "Fixed worktree-isolated sessions on zsh accepting some arithmetic commands that the isolation guard should refuse"
• "Fixed profile store write protection not applying when the config directory is reached through a symlink"
• "Fixed hooks that run in PowerShell not blocking when the hook's program exits with code 2, and on Windows PreToolUse and PermissionRequest hooks with "shell": "powershell" failing open when Git for Windows isn't installed"

One entry is filed as a change rather than a fix and belongs with them: "Changed commands the settings exclude from the sandbox to ask before writing to its write-list paths while the sandbox is enabled but cannot run; the unsandboxed fallback is refused there". Two more tighten what runs without being asked for: claude ultrareview now requires workspace trust, and the dangerous rm and rmdir prompt in bypass permissions mode in the Desktop app and VS Code now denies the command outright with a rewrite hint "so unattended sessions keep going".

What these have in common is that none of them is a feature you would notice missing. A deny rule that does not deny, a hook that does not block and a sandbox that leaks at the edges all look exactly like a working setup from the outside. That is the argument for not treating this release as routine.

#Is 2.1.309 a security release?

Anthropic does not present it as one, and the distinction is worth keeping straight. The changelog entry carries no CVE, no advisory link and no statement that any of these were exploited or that anyone was affected. Anthropic does publish security advisories for Claude Code, separately, as GitHub Security Advisories: the newest one on the first page of that list is dated 13 October 2026, which is before both of these releases. That list runs to four pages and we did not read all of it, so this is what the first page shows rather than a complete audit.

So the honest reading is narrow: these are bug fixes that Anthropic published in its changelog, in its own words, describing controls that did not hold as documented. That is not the same as a disclosed vulnerability with a severity rating, and it is not nothing either. If your threat model for an agent on a developer machine rests on the sandbox or on deny rules, the changelog is telling you those rested on less than you thought until 22 October.

#What is new in 2.1.310?

A smaller release, 6 improvements and 14 bug fixes, with one addition at the front: "Added the Monitor tool and plugin monitors on Bedrock, Vertex, and Foundry, and when telemetry or nonessential traffic is disabled; long foreground sleeps are now blocked there too". The entry says where the tool is now available rather than what it does.

Three of its fixes continue the same theme as 2.1.309:

• "Fixed file read permission prompts not showing where a symbolic link leads"
• "Windows: Fixed PreToolUse and PermissionRequest hooks letting a tool call through when Git Bash is missing and the hook's command is only quoted strings, such as a quoted path"
• "Fixed background cleanup deleting some recent files, such as pasted images, when cleanupPeriodDays is set to a very large value"

The first is a prompt that was asking you to approve a read without telling you where the link pointed. The second is the Windows half of the hook problem 2.1.309 started on. The third is not a permission issue at all, but it deletes your files, so it belongs on the list of reasons to take this one.

One more is worth knowing if your traffic goes through a gateway: "Fixed requests failing behind some gateways and compatible servers that reject the effort-2025-11-24 beta value or mid-conversation system messages; Claude Code now retries without them". If you saw blanket request failures behind a proxy on an earlier build, that is the entry to read.

#Which version should you be on?

2.1.310, which carries the Latest badge on the GitHub releases page.

Version	Changelog date	Released (UTC)	What it is	Reason to take it
2.1.308	October 22, 2026	2026-10-22T04:34:55Z	"Bug fixes and reliability improvements", not itemized	Superseded within a day
2.1.309	October 22, 2026	2026-10-22T22:18:57Z	8 improvements, 62 bug fixes	The sandbox, permission check, deny rule and hook fixes above
2.1.310	October 23, 2026	2026-10-23T23:39:00Z	6 improvements, 14 bug fixes	Adds Monitor; carries 2.1.309 with it

There is no reason to stop at 2.1.309. The permission-related fixes in 2.1.310 extend the same work, and nothing in its list reads as a change that would cost you anything.

#What should you check after upgrading?

Three things, in the order they are likely to matter.

If you run with hooks that are meant to block, test one. The PowerShell exit-code-2 fix and the Windows Git Bash fix both describe a hook that failed open, which means a hook you believe is enforcing something may never have blocked anything on those setups. A hook that exits 2 on a tool call you expect to be refused is a one-minute check, and the hooks guide covers how a PreToolUse hook returns a block decision.

If you keep Edit deny rules or Bash permission rules, re-read them against what 2.1.309 fixed. The deny-rule bug involved a Bash redirect inside a command that also held a subshell, and the Bash check bug involved a cd that was wrapped or prefixed. Neither is exotic enough to rule out of your own setup, and our settings and configuration guide is where those keys are laid out.

If you administer Claude Code for other people, note that the MCP config file passed with --mcp-config was writable by sandboxed commands and auto-accepted edits. That is the same class of problem as the managed-MCP allowlist change in 2.1.305 and 2.1.306: a control that is only as strong as the file it is written in. Security hardening covers the wider question of what an agent on a developer machine can reach, and the Claude Code hub is where we keep the platform's current verified facts.

#What could we not confirm?

Four things, named so you do not have to guess what this article rests on.

We did not install either release. Everything above is Anthropic's own description of its own changes, read from the changelog on 24 October 2026, not behaviour we reproduced. A changelog entry saying a bug is fixed is evidence that Anthropic fixed something, not that we watched it work.

We did not establish which earlier versions each fix applies to. The changelog says what 2.1.309 fixed; it does not say when each bug was introduced, so "the version you are on" above is an inference from the fix existing, not a claim about any particular older build.

We did not read the whole security advisory list. The first page of it, sorted newest first, ends at 13 October 2026, and the list has four pages. So the statement that no advisory accompanies these releases is scoped to that first page.

We did not verify the Monitor tool's behaviour or find separate documentation for it. The changelog entry names the platforms it arrived on and the sleep-blocking that came with it, and that is all this article claims about it.