Claude Code 2.1.288 ran TZ="$HOME" rm -rf build past sandboxed deny and ask rules 6 of 6 times; 2.1.289 stopped all 6
With the Bash sandbox in auto-allow mode and Bash(rm *) in deny or ask , Claude Code 2.1.288 ran TZ="$HOME" rm -rf build in 6 of 6 runs and the folder was gone every time, while 2.1.289 stopped it in 6 of 6. On 2.1.289, bash -c 'rm -rf build' still ran in 6 of 6 sandboxed runs, and FOO="$(pwd)" rm -rf build ran in 7 of 7 runs where Bash was otherwise allowed or permissions were bypassed. The…
Claude Code version 2.1.288 was able to delete a folder named "build/" using the command "TZ= $HOME rm -rf build" in all six attempts. However, version 2.1.289 was able to prevent this from happening in all six attempts. Even though the command "bash -c rm -rf build" still ran in 6 out of 6 sandboxed runs on version 2.1.289, the other command "FOO= $(pwd) rm -rf build" was stopped in 7 out of 7 runs.
The changelog of version 2.1.289 mentions two fixes related to Bash deny and ask rules. One fix addresses commands hidden behind an environment variable prefix, such as "TZ= $HOME rm -rf build", and the other fixes a rule being skipped when a bare variable assignment comes before the command. Both bugs require the Bash sandbox to be on, its auto-allow mode set to default, and a deny or ask rule that should prevent the command.
These issues were tested in a setup that included the Bash sandbox in auto-allow mode and a deny rule for commands starting with a variable assignment. The sandbox used the "Seatbelt" permission mode, and all commands were run using Claude Code 2.1.289 and version 2.1.288. The only thing that any command could delete was a temporary "build/" folder inside the lab, which was recreated before each attempt.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
