{
  "id": 14093417,
  "title": "Claude Code 2.1.288 ran TZ=\"$HOME\" rm -rf build past sandboxed deny and ask rules 6 of 6 times; 2.1.289 stopped all 6",
  "url": "https://urgent.news/2026/10/13/claude-code-2-1-288-ran-tz-home-rm-rf-build-past-sandboxed-deny-and",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-13T02:17:00.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/rulestack/claude-code-21288-ran-tzhome-rm-rf-build-past-sandboxed-deny-and-ask-rules-6-of-6-times-4md9"
  },
  "original_language": "en",
  "account": "Claude Code version 2.1.288 was able to delete a folder named \"build/\" using the command \"TZ= $HOME rm -rf build\" in all six attempts. However, version 2.1.289 was able to prevent this from happening in all six attempts. Even though the command \"bash -c rm -rf build\" still ran in 6 out of 6 sandboxed runs on version 2.1.289, the other command \"FOO= $(pwd) rm -rf build\" was stopped in 7 out of 7 runs. The changelog of version 2.1.289 mentions two fixes related to Bash deny and ask rules. One fix addresses commands hidden behind an environment variable prefix, such as \"TZ= $HOME rm -rf build\", and the other fixes a rule being skipped when a bare variable assignment comes before the command. Both bugs require the Bash sandbox to be on, its auto-allow mode set to default, and a deny or ask rule that should prevent the command. These issues were tested in a setup that included the Bash sandbox in auto-allow mode and a deny rule for commands starting with a variable assignment. The sandbox used the \"Seatbelt\" permission mode, and all commands were run using Claude Code 2.1.289 and version 2.1.288. The only thing that any command could delete was a temporary \"build/\" folder inside the lab, which was recreated before each attempt.",
  "summary": "With the Bash sandbox in auto-allow mode and Bash(rm *) in deny or ask , Claude Code 2.1.288 ran TZ=\"$HOME\" rm -rf build in 6 of 6 runs and the folder was gone every time, while 2.1.289 stopped it in 6 of 6. On 2.1.289, bash -c 'rm -rf build' still ran in 6 of 6 sandboxed runs, and FOO=\"$(pwd)\" rm -rf build ran in 7 of 7 runs where Bash was otherwise allowed or permissions were bypassed. The…",
  "key_points": [
    "Claude Code 2.1.288 attempted to delete 'build/' folder 6 times",
    "Claude Code 2.1.289 blocked all 6 attempts to delete 'build/' folder",
    "Version 2.1.289 fixed Bash deny and ask rules preventing folder deletion"
  ],
  "editors_take": "Patching these environment variable vulnerabilities closes a critical loophole that allowed Claude Code to bypass sandbox restrictions and execute prohibited commands despite active deny or ask rules.",
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "Dev.to",
        "title": "Mad at Claude Code? Take it out on the terminal",
        "url": "https://urgent.news/2026/10/12/mad-at-claude-code-take-it-out-on-the-terminal",
        "published": "2026-10-12T23:34:02.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}