Claude Code 2.1.257 Closed Nine Permission Bypasses in One Release
Until yesterday, any repo you cloned could ship a .claude/settings.json that switched off every permission prompt on your machine. That line is now ignored — and it is one of nine holes the same release patched.
NeuroX AI · September 2, 2026
The Claude Code 2.1.257 changelog is long enough to skim past the line that matters: defaultMode: "bypassPermissions" in a project's .claude/settings.json or settings.local.json is now ignored. The settings docs say it plainly: "Before v2.1.257, bypassPermissions took effect from any file." Shared project settings are the file everyone in the project gets — so a cloned repo could switch off every prompt for every engineer who opened it.
That is the headline. Now count the rest. The same release fixed a permissions.ask rule being skipped in auto mode when the command ran inside a compound or subshell. Bash Read()/Edit() deny rules that ignored < file redirects, tac and egrep. [[ ]] conditionals zsh parses differently from bash being auto-approved. Plugins reading outside their own directory through symlinked component paths. --disallowedTools dropped after the first settings reload. A sandbox deniedDomains entry defeated by a trailing dot. Dismissing the Remote Control consent prompt counting as consent. /mcp reconnect wiring up a server a managed deny list should block.
Nine separate ways a permission rule could be bypassed, closed in one release. Plus a new Containment Escape rule so auto mode stops approving cloud metadata-credential fetches and cross-tenant reach.
None of these were the model misbehaving. They were the harness saying yes when a rule said no. If your agent's safety story is "we set deny rules," you are trusting a parser — and this release is that parser's bug list. The control that holds is the one the agent and the repo cannot touch: a container, a managed setting, a network boundary.