Claude Code 2.1.289 fixes plugin and shell permission bypasses
Anthropic’s Claude Code 2.1.289 release repairs permission checks on managed machines. Plugin approvals and certain shell-command prefixes could bypass rules that deny an action or require approval. Other corrections enforce file-reading restrictions through symbolic links and stop plugins changing sign-in tool descriptions on organization-managed servers. The update also addresses terminal freezes and outdated plugin copies loaded from local-folder marketplaces.
Artificial Intelligence··Midday
Permission rules cover more routes to a command or file
Anthropic released version 2.1.289 of Claude Code on 3 October, correcting ways that permission checks could be bypassed on managed machines. One correction prevents approval of a user-installed modification from taking precedence over a rule that blocks or asks about part of a compound shell command. Reading restrictions also apply when an editor points to a file through a symbolic link, a filesystem reference offering another route to the same location.[1]
Shell checks are repaired for commands preceded by expanded environment-variable values and for commands following a bare variable assignment. These corrections concern deny and ask rules even when the sandbox normally allows commands automatically.[1]
A user-installed plugin could change descriptions of sign-in tools served by an organization-managed Model Context Protocol server. The release lists that behavior as corrected. The protocol connects AI tools to external services. Local-folder plugin marketplaces also receive fixes: listing, evaluation and updates could show an outdated plugin copy, while symbolic-link directories had problems with live reloading.[1]
Terminal and browser freezes are addressed
Code containing numerous script tags left open could freeze the terminal or a browser tab displaying a published artifact. Terminal freeze fixes also cover deeply nested shell substitutions. An unrecognized plugin border style could halt startup or force the application to quit. Other corrections cover asynchronous interface errors terminating background or supervised sessions. Anthropic also reverted an earlier authentication-status change in Visual Studio Code after it may have increased sign-outs.[1]
