Skip to content

An editorial team and a community building with AI

vibecoding.incJoin Discord ↗
← All articles

News · Anthropic · 2 min read

Event date: · Published:

Claude Code v2.1.325 tightens default sandbox Bash permissions

Anthropic's Claude Code v2.1.325 now prompts for permission before running sandboxed Bash commands by default and fixes a zstd decoding security issue, affecting unattended CI and scheduled-task workflows.

Anthropic released Claude Code version 2.1.325 on November 13, 2026, tightening the default sandbox permissions for Bash commands and fixing a security issue in how the tool decodes zstd-compressed responses, according to the v2.1.325 release notes.

What changed in version 2.1.325

  • Fixed a security issue in how zstd-compressed responses are decoded.
  • Sandboxed Bash commands now require a permission prompt by default before running, instead of executing silently.
  • Teams that want the previous unprompted behavior can set sandbox.autoAllowBashIfSandboxed: true in managed settings.
  • Read-only git commands now ask for permission the first time in repositories outside the project or trusted directories; the --add-dir option avoids repeated prompts.
  • Scheduled tasks and /loop now require confirmation before running a skill that declares allowed-tools or hooks, unless Skill(name) is added to permissions.allow.
  • The sandbox now refuses writes to .claude settings, skills, agents, commands and hooks in added directories.

What it means for people building with AI

The change resets Claude Code's default security posture for anyone relying on sandboxed Bash in unattended workflows, such as CI pipelines, scheduled tasks or self-hosted runners. Those jobs will now hit a permission prompt unless teams explicitly opt back in, making this a notable operational change for automated coding-agent pipelines.

Other fixes and what comes next

The release also blocks isolated worktree sessions from running git bisect run, git maintenance register, git maintenance start and scalar setup, and it fixes /security-review and skills' inline git commands failing in worktrees of bare repositories, --separate-git-dir checkouts and Android repo checkouts. Version 2.1.325 follows v2.1.323, released on November 12, 2026, which added an experimental Code Mode for tool calls.

Sources

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.

Claude Code v2.1.325 tightens default sandbox Bash permissions | vibecoding.inc