Claude Code 2.1.309 fixes sandbox rules

On October 22, 2026, at 7:19pm Brasília time, Anthropic released Claude Code v2.1.309, with fixes to the sandbox and permission checks. The update affects Bash commands, MCP configuration and isolated sessions. Official release.

The official notes total 79 change items, between fixes and improvements. The most relevant security focus is preventing commands from escaping the expected isolation rules.

What it is: an update to the Claude Code CLI. What it is not: an announcement of a new Claude model.

In this article you will see:

what changed in the Bash sandbox
which fixes involve MCP and worktrees
the limits of what the release confirms

Claude Code 2.1.309 fixes sandbox execution

Anthropic fixed a case where Bash commands inside the sandbox were executing shell startup files outside isolation before each command.

The release also adjusts write rules on macOS and the application of deny patterns when paths go through symbolic links.

General demonstration of Claude Code in the terminal with a request to audit test coverage; the screenshot comes from the official README and does not specifically represent version 2.1.309. — Imagem: Anthropic

Credit: Anthropic.

What changes in MCP and isolated sessions

The update fixes a case where sandboxed commands or automatically accepted edits could change the MCP configuration file reported by --mcp-config.

It also adjusts permission checks for compound Bash commands and for worktrees. A worktree is a separate working area from the same repository, used to keep changes isolated.

To compare Claude Code with a coordination platform, see when to use bridgecode alongside Claude Code. The Claude Code installation guide in VS Code covers the initial flow.

What Claude Code 2.1.309 does not announce

The release page describes CLI fixes and improvements. It does not introduce a new model version nor publish a benchmark comparing code quality.

The first frame of the demonstration included here shows a generic Claude Code session. It helps visualize the tool, but it is not a capture of version 2.1.309.

Frequently asked questions about Claude Code 2.1.309

What did Claude Code 2.1.309 fix in the sandbox?

It fixed, among other things, shell startup files running outside the sandbox and write patterns that were not being applied as expected.

Does version 2.1.309 bring a new Claude model?

No. The release describes fixes and improvements to Claude Code, without announcing a new model.

What does the update fix in --mcp-config?

It fixes a case where sandboxed commands or accepted edits could modify the MCP configuration file passed via this parameter.

Was Claude Code 2.1.309 the latest version in the announcement?

Yes. The official repository releases API listed v2.1.309 as the latest version checked in this round.

Claude Code 2.1.309 makes isolation more predictable

The patch focuses changes on command behavior, permissions and configuration files. For teams using the CLI in automations, it is worth checking the changelog before updating and testing local sandbox rules.