A symlink could send a Claude Code write outside your project, and 2.1.280 blocks it
Claude Code judged a write through a symlinked path by the path you typed rather than by where the file actually landed, so acceptEdits, permission allow rules and auto mode could each approve an edit that ended up outside the project tree. Anthropic's changelog lists the fix in version 2.1.280, dated September 22, and says the permission prompt now names where the write lands.
Claude Code writing a file with ask-before-editing on. Version 2.1.280 changed how it works out where such a write lands. Image: Anthropic
Anyone running Claude Code should check with claude --version and update. Anthropic publishes no CVE for any of this, names no incident and does not say anyone was attacked, so these are fixes rather than a breach, and the current release is 2.1.282, dated September 24.
Auto mode stops retrying an action it cannot get reviewed
The same 2.1.280 release stopped auto mode retrying an action over and over when a safety check declined to review it. The action is now denied once, with a note that retrying will not help, and a second fix makes retries back off when a check gives no answer at all, ending the turn after ten in a row.
Version 2.1.281, on September 23, added two more permission fixes. A recursive rm whose target comes only from command substitution, such as rm -rf "$(pwd)", now asks first even in auto mode and even with a Bash allow rule, and a permission rule containing a NUL byte no longer expands into a wildcard match. Anthropic had stopped charging API users for those safety checks in 2.1.278.
A project's settings can no longer switch telemetry on
Version 2.1.282 changed project and local settings files to ignore the OpenTelemetry variables that turn on export, set its endpoint or capture content, naming CLAUDE_CODE_ENABLE_TELEMETRY and the OTEL_LOG family. Clone someone's repository and run an agent in it, and the repository can no longer decide that your session content gets shipped to an endpoint of its choosing.
User-level and managed settings still configure telemetry, so this is a question of which file wins. The same release added a startup notice, plus /status and claude doctor entries, listing the telemetry variables in a project's settings that were ignored or that switched telemetry off.
It also repaired a rule that had been failing quietly. Bash permission rules with a mid-pattern :* were skipped in settings files while --allowedTools honoured them, so a rule a developer believed was in force was not. They now work from every source, with a startup warning explaining how they match.
Anthropic reserved its own skill namespaces
Skill folders, command files and workflow commands in the anthropic-skills or claude-ai namespace no longer load, and Skill(anthropic-skills:*) and Skill(claude-ai:*) allow rules now cover only skills synced from a claude.ai account rather than anything that happens to carry the name. MCP servers configured under either name list no skills or prompts, although their tools still work; renaming the server in your MCP configuration brings the listings back.
Anthropic does not say what prompted the change. A related fix in the same release stops repository, user and --add-dir skills, commands and plugin manifests pre-approving their own tools through allowed-tools when managed settings set allowManagedPermissionRulesOnly.
Version 2.1.280 is better known for another line: it made Claude Opus 5.5 the default Opus model in Claude Code, at $4 and $20 per million tokens with cache reads at $0.20 per million, in a week when Claude Code had just started defaulting to Opus on $20 Pro and Team Standard plans. The permission fixes went out with it, and they are the more useful reason to check your version.
