Claude Code Fixed Five Sandbox Escapes as Plain Changelog Bullets

Anthropic shipped Claude Code v2.1.251 at 18:19 UTC on 28 August. Five of the entries in its changelog are sandbox or permission escapes. They are formatted like every other bullet in the file.

The five

A time-of-check/time-of-use symlink swap that let the Read, Write and Edit tools operate outside an approved directory after the path was validated. Path traversal in plugin loading. Project-level settings that could switch on raw API request-body logging and bypass an administrator-configured telemetry collector. The workflow runner reading a script path before the permission check ran. And Grep and Glob following symlinks past deny rules that were supposed to block those reads.

Why the class matters

These are not model behaviour bugs. They are the enforcement layer that makes a coding agent safe to point at a repository: the promise is that the agent touches what you approved and nothing else. A TOCTOU symlink swap defeats that promise deterministically — the check passes, the link is repointed, the write lands elsewhere. The logging item is a different shape of the same problem: a setting inside a checked-out project altering what the agent records and where it sends it.

What the common framing gets wrong

Changelog placement is being read as a severity judgement — if it were serious, it would have an advisory. That inference does not hold here, because the same repository has published ten security advisories, several of them in exactly this class, including a high-severity symlink sandbox escape earlier in the year. So the project both recognises the category and has a channel for it. Publishing through the changelog instead means downstream users get no CVE, no severity, and no notification through any dependency scanner — the fix ships, and only readers of release notes learn there was something to fix.

The practical consequence

Organisations that gate agent rollouts on advisory feeds saw nothing on 28 August. The correct operational reading is that coding-agent changelogs are now a security feed and have to be monitored as one.