Back to Blog
claude-codeweekly-updatesandbox +5 topics

What's Up Claude Code: Week of October 19th

Claude Code 2.1.309 and 2.1.310 tighten sandbox, MCP-config and hook boundaries, a 2.1.304 fix stops worktree exits from deleting unpushed branches, and two fresh bug reports show why unattended runs need checks outside the model's summary.

Olivier Legris Calculating read time…
In this article

TL;DR

This week’s Claude Code releases are about boundaries again. 2.1.309 closed several ways a sandboxed command could reach outside its box, 2.1.310 fixed a compaction failure, and 2.1.304, published on October 19, stopped claude --worktree from deleting a branch that still held unpushed commits.

My takeaway: after upgrading, re-test your deny rules and hook guards with a known-bad input, and for unattended runs, check the file diff and exit status rather than the assistant’s summary.

1. The sandbox and MCP config got tighter

v2.1.309, published October 22, fixes several escape paths:

  • Sandboxed Bash no longer runs shell startup files outside the sandbox before each command.
  • Sandboxed commands and auto-accepted edits can no longer modify the file passed with --mcp-config.
  • A disabled MCP server is no longer reconnected by a later permission prompt in print and SDK sessions.
  • macOS denyWrite globs now apply at the real path when the folder is reached through a symlink.

The same release also has behaviour changes that can break unattended runs. Bypass-mode rm and rmdir are now denied outright in Desktop and VS Code, and sed -i now gets the standard Bash prompt and is no longer restored by /rewind. Upgrade, then re-run the scripts that depend on those paths.

PowerShell hooks have their own fix in the same window: hooks now block on exit code 2, and PreToolUse and PermissionRequest hooks no longer fail open on Windows without Git for Windows. If you enforce policy with PowerShell hooks, test a deliberate exit 2 and confirm it actually blocks.

2. Worktrees stopped deleting unpushed work

v2.1.304 fixes claude --worktree removing the worktree and its branch without asking at exit when HEAD was detached or on another branch. Commits could be lost that way.

The related report is #103413: a worktree session that symlinked a sibling repo let a test’s rm -rf remove the real .git. It’s a single report, so verify it on your setup. The practical rule is to treat symlinks that point into other repos as unsafe inside worktree sessions, and run destructive tests in a copy.

3. Compaction and the Monitor tool

v2.1.310, published October 23, fixes compaction after a “Prompt is too long” error. It was keeping too much dense text, such as pasted base64 or SVG, so the next request could fail again. If your sessions include large pastes, upgrade and re-test.

The same release adds the Monitor tool on Bedrock, Vertex and Foundry, and blocks long foreground sleeps there too. It also stops background cleanup from deleting recent files when cleanupPeriodDays is set very large, which had removed pasted images.

4. Two open reports to watch

Both were opened on October 25, and both are single reports with no maintainer reply yet:

  • #105012: the reporter measured Bash tool-result gaps of about 8 minutes, median around 500 seconds, after an auto-update from 2.1.306 to 2.1.310. The affected sessions ran many background Workflow subagents. Read, Write, Edit and Workflow calls weren’t affected. If you run large fan-outs, the report suggests pinning 2.1.306 until a fix ships. Verify on your version first.
  • #105046: an agent treated a conditional “test now, check tomorrow” plan as approval and ran 20 scheduled-task deletions and 22 folder removals without reporting back. The lesson is that conditional or deferred plans are not approval. For destructive filesystem or scheduled-task operations, use explicit deny rules or hooks rather than relying on auto mode.

Community projects worth looking at

I scanned r/ClaudeCode and r/ClaudeAI for posts from October 19–25, then checked each repo’s own dates through the GitHub API. The dates below are from the repos, not the Reddit posts. Note that the Reddit listing cap reached back only to October 23, so posts from October 19–22 aren’t covered here.

  • teleclaude, new this week. It runs one Claude Code session per Telegram forum topic, so you can answer permission prompts from your phone. Repo created October 22, MIT licence, 15 stars at check time. The README notes it depends on some Claude Code internals, so updates can break it.
  • checkmate, new this week. A goal-driven plugin that pushes the agent toward the shortest path with fewer tokens. Repo created October 24, MIT licence, 9 stars at check time. The before-and-after examples are the author’s own, not an independent measurement.
  • untrusted-boundary, new this week. A hook that wraps tool results in SHA-256-tagged boundaries and refuses calls when a tag is missing or doesn’t match its content. Repo created October 25, MIT licence. It’s early, and I haven’t reviewed it independently.

From the AI-news feed

Latent Space’s AINews covered the wider AI industry this week. These are the newsletter’s own summaries, not independent benchmarks.

  • Kimi 3.1 Pro. AINews calls it an open-weights model that beats Fable 5.1 on the Artificial Analysis benchmarks it cites, with a faster API tier. Those are the vendor’s and the newsletter’s claims; check them on your own tasks before changing anything.
  • PHP2Shell. Per AINews, two parties independently found serious PHP core vulnerabilities, one of them through OpenAI’s Patch the Planet programme, and the PHP project shipped a coordinated security release on October 21. It’s a reminder that the security of your dependencies is part of the agent’s attack surface.
  • DeepSeek DeepInfer. DeepSeek open-sourced its inference stack on October 21 and reports up to 72-hour prompt caching. It’s relevant if you run open-weights models behind an agent, but the throughput and cost figures are DeepSeek’s claims.

Community events

The synced events.json data is the source of truth for dates, titles, cities and Luma URLs. Between October 26 and November 1 it lists 42 events:

Monday October 26

Tuesday October 27

Wednesday October 28

Thursday October 29

Friday October 30

Saturday October 31

Sunday November 1

What I’m watching

  • Whether #105012 reproduces on 2.1.310, and whether a fix lands before the next release.
  • Whether 2.1.309’s sandbox fixes change anything for existing denyWrite rules.
  • The Monitor tool on Bedrock, Vertex and Foundry, now that long sleeps are blocked there too.