Three Claude Code releases in three days, two of them stopping commands that delete files

Anthropic shipped three Claude Code releases on three consecutive days, 2.1.281 on September 23, 2.1.282 on September 24 and 2.1.283 on September 25, and two of the three stopped commands that delete files. Claude Code's changelog says 2.1.281 makes a recursive rm ask before it runs in auto mode, and 2.1.283 stops the Windows PowerShell tool removing drive roots and the home folder.

Two of the three releases published between September 23 and 25 carried a fix to a command that deletes files. Image: Anthropic

The 2.1.281 fix is the blunter of the two. Anthropic says it fixed a recursive rm whose target is only command-substitution output, such as rm -rf "$(pwd)", running unprompted in auto mode and in --dangerously-skip-permissions mode.

After the fix, that command asks for approval even when a Bash allow rule is in place, unless the session sets CLAUDE_CODE_DISABLE_SUBSTITUTION_RM_PROMPT=1. Anthropic attaches no severity rating, no CVE and no account of how long the gap had been open.

2.1.281 widens what counts as a dangerous delete

The same release broadened the check that decides when Claude Code should stop and ask. Anthropic says it now also flags a removal aimed at a shell variable followed by a top-level directory name, at a variable derived from the working directory, or at a backslash-only target.

Unattended sessions get a different treatment. In auto mode and --dangerously-skip-permissions mode the dangerous rm prompt now waits two minutes for an answer, then denies the command with a rewrite hint so the run keeps going, with CLAUDE_CODE_DISABLE_DANGEROUS_RM_TIMEOUT=1 as the way out.

2.1.281 tightened two nearby checks as well. Permission dialogs and attachment checks stopped reading a path under macOS's /.vol, /.nofollow or /.resolve, which can reach a network mount, before approval, and a permission rule containing a NUL byte stopped being expanded into a wildcard match: such a rule now matches nothing.

Windows got its own deletion fix two days later

Version 2.1.283, published on September 25, closed a Windows-only route to the same outcome. Anthropic says it fixed the PowerShell tool letting cmd /c rd, rmdir, del or erase delete drive roots, the home folder and other folders that Remove-Item refuses.

The protection existed, and four older DOS-style commands walked around it. Neither entry claims anyone lost work.

This is a different problem from the symlink hole that 2.1.280 closed on September 22, which was about writes landing outside a project rather than deletions inside one.

Admins get two new switches over which models run

Away from the delete fixes, 2.1.283 adds an availableModelsMatch managed setting. With the value exact, an availableModels entry allows only the model version it names, so new releases stay blocked until an administrator lists them, and a companion deniedModels setting blocks specific models even when availableModels would allow them.

The same release adds /doctor prompt-audit, also reachable as /checkup prompt-audit, which audits CLAUDE.md files, skills, agents and commands for prompting patterns written for older models. It also reverses a change made a day earlier: 2.1.282 had reserved the claude-ai name, and 2.1.283 hands it back, so skills, commands, workflows and MCP servers' skills and prompts with that name load again.

The npm registry puts 2.1.282 at 15:56 UTC on September 24 and 2.1.283 at 18:46 UTC on September 25, so the reservation lasted about 27 hours. Three of the four releases since September 22 have carried a fix to where Claude Code may write or what it may delete.