Claude Code 2.1.231 and 2.1.232: Bash redirections now need permission, sandbox lockdown

Claude Code 2.1.231 and 2.1.232 shipped on August 13. 2.1.231 is a single MCP OAuth fix, while 2.1.232 carries the real weight: a genuine batch of sandbox and permission fixes, plus subagent forking turned on by default. Here's what matters.

Bash < file redirections finally need permission

Until now, a Bash command using an input redirection like < file could read that file without going through the same permission check as a regular file-path argument. In 2.1.232, those redirections are checked like any other file access, on every platform.

In practice, if a hook or automation of yours relied on that redirection to read a file without a prompt, expect a permission request that wasn't there before. It's the kind of change you never notice while things go smoothly, and it closes a real bypass.

A batch of fixes closing six separate holes

2.1.232 bundles several independent bypass fixes into one release:

• PowerShell: a variable-writing parameter could silently overwrite $PSDefaultParameterValues and redirect later commands' file access without a permission check. Fixed.
• Windows / Git Bash: Git Bash followed Cygwin-style symlinks that path validation treated as regular files. Writing through such a symlink now requires permission.
• Nested git repositories: a nested repository inherited trust from its parent directory. Each repository now needs its own trust confirmation.
• Linux sandbox: a protected-path bypass is fixed (the changelog doesn't detail the exact mechanism).
• Cross-session messaging: the auto-generated socket directory on a shared /tmp now refuses a pre-planted symlink or another user's directory instead of using it.
• Gateway: an empty managed.policies[].match.groups or admin.admin_groups entry, or a malformed email_domain (empty, or containing @, whitespace, or a comma), now fails at boot instead of silently matching no one, or worse, granting admin access.

That last one is worth pausing on: a malformed config quietly granting admin access instead of failing loudly is exactly the kind of bug that stays invisible until someone exploits it.

In the same vein, sandbox.ripgrep is now honored only from user, managed, or --settings settings. A project can no longer force its own ripgrep binary onto the sandbox.

Subagent forking is now the default

A subagent_type: "fork" subagent now inherits the full conversation and prompt cache of the session that spawned it, and this is on by default. Related change: in interactive sessions, spawning an agent that isn't a "teammate" now runs in the background by default instead of in the foreground.

If you were driving agent spawns expecting foreground behavior, check your workflows after updating: that's no longer the default.

The rest, worth a skim

• 2.1.231: MCP OAuth for servers using a pre-registered OAuth client (Slack, for instance) no longer fails on a redirect URI mismatch.
• GitLab: redaction added for GitLab token families (glrt-, gloas-, glptt-, glagent-, glimt-, glsoat-, glcbt-, glft-, glffct-), full redaction for routable glpat-/gldt- tokens, and the glab CLI config store gets the same sandbox and credential-path protections as gh. Plugin marketplaces also accept bare GitLab repo URLs (nested subgroups included), same as GitHub.
• Named sessions: typing @ in a prompt lets you mention another Claude session by name; SendMessage reaches it directly, without a confirmation step, when the name matches exactly one live session. Two live sessions on the same machine can no longer share a name (an automatic name-word-word variant kicks in).
• Remote Control: a session hosted by a bridge inside a cloud session could inherit that session's transcript or credentials. Fixed, alongside several other reconnection and resume fixes.
• /code-review at high, xhigh, and max effort now runs as a background agent, like the other levels.
• /plugin install refreshes the marketplace before installing: newly published plugins install without a manual marketplace update.
• MCP: connections no longer hang for the full 30-second timeout when a server fails to respond or sends a malformed reply to the protocol-version probe.
• Cowork: sessions no longer inline external @-imports from user-scope memory files.
• Fable 5 is available again as an advisor via /advisor for organizations with access.

Should you update

Yes, without hesitation. The security batch alone justifies it, especially the gateway config bug that could silently grant admin access and the Bash redirection permission gap. Default subagent forking can change how your existing automations behave, so check them after updating.

Source: official Claude Code changelog.