At about 06:18 Beijing time on October 23, 2026, Anthropic published Claude Code v2.1.309 on GitHub. The Claude Code changelog lists the same date. DigIntoAI has not tested this release.
Per the release notes, the version fixes several sandbox, MCP, and permission gaps. Examples include sandboxed Bash on macOS and Linux running shell startup files outside the sandbox before each command; macOS sandbox denyWrite globs not applying at a path’s real location when the folder is reached through a symlink; sandboxed commands and auto-accepted edits being able to modify the MCP config file passed with --mcp-config; and an Edit(path) deny rule failing to block a Bash redirect to that path in some commands that also held a subshell.
The same release changes claude ultrareview to require workspace trust: on a terminal it asks, otherwise it refuses; scripts can pass --trust-workspace (no value; put a PR number or base branch before it), or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1. The notes also list many other fixes across VS Code, Claude Tag in Slack, Code Review, and cloud sessions.
For DigIntoAI notes on Claude Code limits, auto mode, and related security work, see Claude Code usage limits, Claude Code auto-mode setup, and Anthropic Claude attack surface reduction.
We have not installed or tested Claude Code 2.1.309, and we have not verified the sandbox, MCP, permission, or ultrareview trust changes on a live machine.
