Claude Code’s Windows Hooks Could Fail Open—Test Yours

Lachlan Reed

Righto, before you kick off your next agent session, here's one worth two minutes. This is The Claude Code Changelog, brought to you by Jellypod AI. I'm Lachlan, and James is here too. No shiny new tool today. Two releases, 2.1.309 on October 22 and 2.1.310 on October 23, 2026, tightened a bunch of sandbox and permission boundaries. If you lean on the sandbox or on hooks, this is the one to check.

James Turner

Start with the sandbox. The 2.1.309 notes say sandboxed Bash commands on macOS and Linux were running the shell's startup files outside the sandbox before each command. Think your bashrc or profile. The release notes don't describe an exploit, so this part is my reading: the command itself was inside the sandbox, but the setup around it wasn't. The fix needs no config. Run claude version and confirm you're on 2.1.309 or later. Same release, two related fixes. macOS denyWrite glob patterns now apply at a path's real location when the folder is reached through a symlink. And sandboxed commands and auto accepted edits could previously modify the MCP config file passed in with the MCP config flag. That's closed too.

Lachlan Reed

And if you're on Ubuntu and the sandbox just won't start, 2.1.310 helps there. The /sandbox command and the startup warning now name Ubuntu's AppArmor restriction on user namespaces, and tell you how to lift it, when that restriction keeps bubblewrap from starting. So run /sandbox, read what it says, and you won't be guessing.

James Turner

Now permission checks. In 2.1.309, Bash permission checks didn't prompt for some compound commands that change directory before running git, when the cd was wrapped or prefixed. A plain cd already prompted; the wrapped versions didn't. Also fixed: an Edit deny rule not blocking a Bash redirect to that path in some commands that also held a subshell. So here's something you can do today. If you have an Edit deny rule on, say, a secrets file, upgrade, then ask Claude to write to that file with a shell redirect and confirm it's refused. One caveat from the same release: sed with the in place flag now gets the standard Bash prompt and runs as written, instead of a simulated file edit preview. Like other Bash edits, it's no longer restored by /rewind.

Lachlan Reed

Now the one I'd flag for anyone on Windows, because it's a proper fail open. In 2.1.309, hooks that run in PowerShell didn't block when the hook's program exited with code 2. And PreToolUse and PermissionRequest hooks with the shell set to powershell failed open when Git for Windows wasn't installed. Then 2.1.310 caught another case: those same hooks on Windows let a tool call through when Git Bash was missing and the hook's command was only quoted strings, like a quoted script path. Failing open means your guardrail was silently not guarding. Exit code 2 is how a hook says stop, so it matters.

James Turner

So test it. Write a throwaway PreToolUse hook that just exits with code 2, trigger any tool call, and confirm Claude Code blocks it. Do it on a machine without Git for Windows, and on your CI runners, since that's where the missing Git Bash case lives. Then swap in your real hook. The changelog doesn't say how many setups were affected, so don't assume you were fine. Verify.

Lachlan Reed

A few smaller wins from 2.1.310. Compaction after a prompt is too long error was keeping too much dense text, like base64 or SVG, so the next request could fail again. That's fixed.

James Turner

File read permission prompts now show where a symbolic link leads, so you can see if a link points outside your workspace before you approve it. In non interactive sessions, like print mode and the Agent SDK, an MCP tool call that times out while the server's elicitation is unanswered now tells Claude that no answer came and not to repeat the call. That should cut retry loops in headless runs. And auto mode's prompt before the first read outside your working directories now says when blocking those reads makes shell commands ask for permission.

Lachlan Reed

So the takeaway: these are fixes, not new settings, so there's nothing to flip. Upgrade to 2.1.310, rerun your deny rule check, run the exit code 2 hook test, and if you're on Ubuntu, let /sandbox tell you what's blocking bubblewrap. That's the lot for today.