Claude Code 2.1.309: sandbox fixes, ultrareview trust

Claude Code 2.1.309 is mostly a hardening release. Its entry in Anthropic's changelog is dated October 22, 2026, and its biggest items are sandbox and permission fixes. Three behavior changes can affect you: sed -i now gets the normal Bash prompt, claude ultrareview asks for workspace trust, and a dangerous rm in bypass mode is denied at once.

This brief picks up after the 2.1.306-2.1.308 notes. It covers the headline items, not every bug fix.

This site is independent and not affiliated with Anthropic. We read the changelog on 2026-10-24. We did not install or run 2.1.309, so nothing below is a hands-on result.

Sandbox and permission fixes

The first bug fixes in the entry are about the sandbox, the boundary around the shell commands Claude runs. Anthropic's sandbox page calls it "a boundary that the operating system enforces around the shell commands Claude runs on your machine." Two fixes stand out:

Fixed sandboxed Bash commands on macOS and Linux running the shell's startup files outside the sandbox before each command

Fixed sandboxed commands and auto-accepted edits being able to modify the MCP config file passed with --mcp-config

The entry lists both as bugs fixed in this version. It does not say how many people hit them. If you manage a team, treat this as a reason to upgrade, not a reason to panic.

The same list closes permission gaps. One example:

Fixed an Edit(path) deny rule not blocking a Bash redirect to that path in some commands that also held a subshell

For how deny and ask rules work, see our permissions guide.

Three behavior changes to know about

These are the "Changed" entries most likely to alter your day. The first is sed -i:

Changed sed -i to get the standard Bash prompt and run as written, not a simulated file-edit preview; like other Bash edits, it is no longer restored by /rewind

In plain terms, an in-place sed edit now asks like any other Bash command. If you counted on /rewind to undo it, it no longer will.

The second is claude ultrareview:

Changed claude ultrareview to require workspace trust: it asks on a terminal, else refuses; scripts pass --trust-workspace, which takes no value (put a PR number or base branch before it), or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1

If a script calls claude ultrareview, it will refuse until you add the flag. The entry does not say whether the variable is advisable. Prefer the flag.

The third is the dangerous rm prompt:

Changed the dangerous rm and rmdir prompt in bypass permissions mode in the Desktop app and VS Code to deny the command at once with a rewrite hint, so unattended sessions keep going

Our permissions guide describes the earlier behavior as a wait of two minutes, then a denial. The wait is now gone in those two apps.

The Claude moves worth stealing, by email

Workflows tested on real jobs, sent only when they are worth it. Free.

Subscribe

Sandbox fallback and worktrees

Two more changes touch what happens when things go wrong. The first covers a sandbox that is switched on but cannot start:

Changed commands the settings exclude from the sandbox to ask before writing to its write-list paths while the sandbox is enabled but cannot run; the unsandboxed fallback is refused there

The second covers git worktrees, the separate working copies Claude Code creates:

Changed worktree creation and reuse so git no longer fetches objects on demand, in ordinary clones and in partial clones with a Bash sandbox configured; such a partial clone fetches them first

We read both as safety tightening, but the entry gives no examples. Test them in a throwaway repository before relying on them.

Hooks, rewind and the /claude-api skill

A fix for Windows teams matters if you use PowerShell hooks:

Fixed hooks that run in PowerShell not blocking when the hook's program exits with code 2, and on Windows PreToolUse and PermissionRequest hooks with "shell": "powershell" failing open when Git for Windows isn't installed

"Failing open" means a broken hook let the command through. A hook that stops a command only helps if it fails closed.

The /claude-api skill changed in two ways. One entry says it now builds Managed Agents subagent teams "on multiagent_20261001 with dynamic workflows on by default, instead of coordinator". Another says service account keys and Workload Identity Federation tokens "can now manage OpenTelemetry destinations". Our API version brief covers the version this skill moves code to.

Also in the list: a Code Review fix says a push queued behind a running review no longer starts a review after @claude review stop.

Upgrade readout

If you	Do this
Script claude ultrareview	Add --trust-workspace after any PR number or base branch
Rely on /rewind after sed -i	Stop: it is no longer restored
Run bypass mode in Desktop or VS Code	Expect a dangerous rm to be denied with a hint
Use PowerShell hooks on Windows	Retest that a blocking hook still blocks
Run the sandbox on macOS or Linux	Upgrade: startup-file and MCP config gaps are fixed
Anyone else	Routine upgrade

What this brief does not cover

We did not run any command, flag or setting named above. The entry also lists many more bug fixes, a VS Code dictation warning, smaller improvements and a bundled dataviz skill update, which we skipped. The earlier 2.1.305 brief covers the sandbox option that loosens file protections.

Does Claude Code 2.1.309 change how sed -i runs?

Yes. Per the changelog, sed -i now gets the standard Bash prompt and runs as written, not as a simulated file-edit preview. Like other Bash edits, it is no longer restored by /rewind, so commit first.

Do scripts that call claude ultrareview break after 2.1.309?

They can. The changelog says the command now requires workspace trust. On a terminal it asks; otherwise it refuses. Scripts pass --trust-workspace, which takes no value, after any PR number or base branch.

What happens to a dangerous rm in bypass mode on 2.1.309?

In the Desktop app and VS Code, the command is denied at once with a rewrite hint, per the changelog. The stated aim is that unattended sessions keep going.

Sources (checked 2026-10-24)

• Claude Code changelog: the 2.1.309 entry, dated October 22, 2026.
• Configure the sandboxed Bash tool: what the sandbox is.