I only use default interactive mode and manually click confirm every time — do I need to worry about this vulnerability?
Your risk is relatively low. Exploiting this vulnerability requires either of two conditions: using the --permission-mode bypassPermissions flag, or having configured shell-allow rules yourself. If you've done neither and simply use default mode with manual approval each time, the always-ask protection should still fire normally in your everyday usage.
But even with lower risk, it's worth taking a minute to confirm your version: if you or someone on your team later loosens permission settings for automation efficiency, and the version is still sitting on the vulnerable 2.1.285 or earlier, that protection gap becomes an immediate real risk rather than a theoretical one.
Why doesn't the safety check just parse what command actually runs inside a bash -c string?
This is exactly the common underlying difficulty with checks like this: parsing what command actually executes inside a shell string is far more complex than simply comparing "is the program name rm." A bash -c string can contain variable substitution, pipes, conditionals, and nested subshells — accurately determining "will this string, once expanded, ultimately run a dangerous rm" is effectively equivalent to implementing a full shell grammar parser, not a simple string comparison.
This is also why this category of vulnerability tends to recur across various tools that judge risk by comparing command strings — it's not developer oversight, it's that "fully and correctly parsing an arbitrary shell string" carries genuinely high engineering cost on its own. The official fix doesn't disclose much implementation detail about exactly how this was addressed, but given that it's confirmed fixed, at minimum this specific wrapping technique is now within the check's coverage.
Between npm's latest, next, and stable dist-tags, which should I use for everyday installs?
This incident is a ready-made case study: on October 2, both latest and next had already updated to the fixed 2.1.288, while stable was still sitting on 2.1.285, published three days earlier on September 29. That shows the intuitive impression the name "stable" gives — presumably more thoroughly vetted, more dependable — doesn't necessarily move in lockstep with "has it received the latest security fix."
There's no single answer that fits every situation: if your workflow demands high stability and can tolerate security fixes arriving a few days late, continuing to pin stable is reasonable, but you should know that tradeoff exists. If getting security fixes as fast as possible matters more to you, latest generally updates faster than stable. Whichever you choose, the more important habit in practice is periodically confirming the actual installed version number by hand, rather than assuming you're current just because of a tag name.
I'm not an engineer — I just manage Claude Code installs on my team's computers. What's the practical impact on me?
If you're responsible for internal tool installs and version management, this incident gives you a concrete checklist: first confirm whether your team members' currently installed Claude Code version is 2.1.288 or later; then check whether any automation scripts or CI pipelines use --permission-mode bypassPermissions or have loosened shell permission rules — those pipelines carry the highest risk and should be updated first.
Another point worth remembering: if your team's install scripts pin to the stable tag, you can't assume that always means "latest and secure" — this incident is a live example of a three-day gap doing exactly that. A safer approach is adding one extra step to your version-management process: manually verifying the actual version number, rather than trusting the tag name alone.
Claude Code enforces an "always-ask" safety prompt on rm -rf-style delete commands targeting critical paths — the filesystem root, /usr, /etc, the home directory, the working directory, and its parent directories. In theory, regardless of permission mode, these commands should always trigger a confirmation first. But this protection had a bypass reported on September 23, 2026, that went unfixed until October 2: wrap rm -rf inside a bash -c or sh -c string, and the check simply can't see it at all.
The problem lies in how the safety check makes its judgment. The mechanism inspects the "directly executed program name" — calling rm -rf / directly means the program name is rm, which triggers protection. But wrap the same command as bash -c 'rm -rf /' or sh -c "rm -rf /", and the check sees the executing program as bash or sh, while the actual rm -rf / doing the deleting sits buried inside a string argument. As one technical writeup puts it plainly: "the rm is inside a string argument, so the check never sees it."
The vulnerability existed from at least v2.1.280 (confirmed tested on Windows 10 in Git Bash) and was reported September 23, 2026. Exploiting it requires either of two conditions: the --permission-mode bypassPermissions flag, or shell-allow rules the user had explicitly configured. Anyone using default interactive mode with manual per-action approval is unaffected by this particular gap.
Beyond the bash -c wrapper, there was a separate but similarly-shaped bypass: a dangerous rm targeting / or the home directory would also lose its intended always-ask protection if the same command simultaneously carried syntax redirecting output to a ~ or wildcard path (a structure like rm -rf / > ~/somefile). This issue was fixed alongside the bash -c bypass in v2.1.288 (pushed to npm at 18:30 UTC on October 2, 2026).
Even knowing this vulnerability is fixed, whether you actually get the fix depends on how you installed Claude Code. Reporting notes that as of 21:05 UTC on October 2, 2026, both the latest and next npm dist-tags pointed to the fixed 2.1.288, but the stable tag was still sitting on 2.1.285, published September 29 — three releases behind the fix. Anyone pinning their install to the stable tag was still actually running the vulnerable version, with no obvious indication telling them so.
First, confirm your currently installed version number and check whether it's 2.1.288 or newer; if you installed via npm without pinning a specific version or tag, confirm exactly which version that dist-tag actually resolves to, rather than assuming "I installed the stable release, so it must be the latest fixed one" — this exact gap demonstrates that the name "stable" alone doesn't guarantee it carries the most recent fix. Second, check whether you're using --permission-mode bypassPermissions, or have configured shell-related ask rules that grant broader allowances — if neither applies, manual approval under everyday interactive mode already blocks this kind of command, so your exposure is relatively low; if you deliberately loosened these restrictions for an automated pipeline, confirming your version is up to date should be the priority.