Claude Code 2.1.292 fixes five ways to bypass its guardrails
The release closes five separate holes in permission prompts, the sandbox and the policy plugin, alongside new effort levels for sub-agents and a plugin marketplace install flag.
Anthropic shipped Claude Code 2.1.292 on 6 October, bundling five security fixes alongside new agent and plugin features. Each fix closes a different way the tool’s safety checks could be sidestepped: PreToolUse hook approvals and auto mode could be bypassed for file reads over network (UNC) paths; sandboxed commands could read staged copies of /ultrareview uploads stored under ~/.claude/seed-admin; a tampered on-disk cache of server-managed settings could disable the built-in policy plugin; mid-read link swaps let notebook and PDF reads on macOS and Windows return files outside their approved scope; and rm -rf failed to recognise Windows 8.3 short-name spellings of the home folder as deletions to block.
The same release adds an effort parameter to the Agent tool for running sub-agents at different effort levels, a --marketplace <source> flag for claude plugin install, and switches local MCP server connections to negotiate protocol version 2026-07-28 by default, with an MCP_PROTOCOL_NEGOTIATION=legacy opt-out.
Why it matters: Claude Code runs with real file and shell access on your machine, gated by permission prompts and a sandbox you’re trusting to hold the line. Five separate ways that trust could be undermined, patched in one release, is worth updating for regardless of whether you use any of the new features.
The caveat: none of these carry a CVE or severity rating — they’re bug fixes in routine release notes, with no indication any were exploited before the fix.