Should I upgrade?
If the Sandbox is your main guardrail for unattended sessions, move to v2.1.309 or later. The notes do not say whether anyone exploited these gaps, so urgency depends on how you use it, not on a known attack.
Will my scripts break?
Two places can: scripts calling claude ultrareview now need --trust-workspace or CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1, and any workflow that relied on /rewind to undo sed -i no longer works.
Will the npm stable tag have this version?
I did not verify which npm tag points to v2.1.309. The earlier rm bypass case showed the stable tag can lag, so after upgrading confirm the real version with claude --version.
I'm not an engineer. What is the one-line version?
It is like building access control: no new door, just several spots that looked locked but had a gap. The notes do not say anyone slipped through, but closing them beats leaving them.
Most of the Claude Code v2.1.309 release notes (2026-10-22) are Sandbox and permission fixes, and v2.1.304 through v2.1.307 earlier the same week carried a few security-relevant changes too. Everything below is quoted from the official changelog; the "what this means" section is my own inference and says so.
denyWrite glob patterns did not apply at a path's real location when the pattern's folder was reached through a symlink. Fixed. The sandbox docs likewise say a denied path passing through a symlink on macOS is denied at its real location too.--mcp-config. Fixed.cd was wrapped or prefixed, unlike a plain cd. Fixed.Edit(path) deny rule did not Block a Bash redirect to that path in some commands that also held a subshell. Fixed.Set-Location or cd commands that target the current directory and carry extra arguments; they now prompt.sed -i now gets the standard Bash prompt and runs as written, instead of a simulated file-edit preview, and /rewind no longer restores it. If you relied on /rewind to undo sed -i, that safety net is gone.claude ultrareview now requires workspace trust: it asks on a terminal and otherwise refuses. Scripts pass --trust-workspace, which takes no value (put a PR number or base branch before it), or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1.rm and rmdir commands are now denied at once with a rewrite hint, so unattended sessions keep going.rm -r on mounted drives or top-level folders (such as /Volumes, /media, /mnt/c) now gets a safety prompt.claude_code.safety_event OpenTelemetry event fires for each tool call that a permission rule, auto mode, a safety check, a hook or the sandbox stopped, prompted or sent back.sandbox.allowNestedUserNamespaces; the notes say plainly it lets sandboxed commands get around the sandbox's file protections.The release notes say what was fixed. They do not say whether anyone exploited these gaps, give no CVE identifiers, and I found no independent source describing exploitation, so do not read this as a report of attacks in the wild. The more useful angle is that the fixes cluster at the edges of sandbox and permission checks, the very assumptions you lean on when you trust the sandbox: startup files do not run outside it, deny rules still hold through symlinks, and commands inside it cannot rewrite config files. If your team treats the sandbox as the main guardrail for unattended sessions, moving to v2.1.309 or later is worth doing; whether you actually hit the specific paths above is something I cannot judge for you.