Anthropic reports multiple sandbox and permission-check fixes in Claude Code 2.1.309. The release was published on October 22.
According to the release notes, shell startup files could run outside the sandbox. Configuration for connected tools was also not consistently protected against changes.
Further fixes concern file-write restrictions, isolated workspaces and tool-denial rules that were not passed to teammate agents.
These are vendor claims. The completeness of the updated protections was not independently tested here. The general defect descriptions provide no individually reconstructable cases of harm.