Anthropic Ships Claude Code 2.1.289 — Six Security Fixes Close Dangerous-RM Permission Bypass

title: Anthropic Ships Claude Code 2.1.289 — Six Security Fixes Close Dangerous-RM Permission Bypass date: 2026-10-13 slug: anthropic-claude-code-21289-security-fixes category: AI Safety & Security focus_keyword: Claude Code Security tags: ["Anthropic","Claude","AI Safety & Security","Codex","AI"] meta_title: Claude Code 2.1.289 — Six Security Fixes Close RM Bypass meta_description: Anthropic released Claude Code v2.1.289 Oct 3 with critical fixes — the dangerous-rm permission bypass (sh/bash rm bypass), IDE symlink restrictions, and managed MCP sign-in. Technical analysis for Claude Code Security. excerpt: Anthropic's Claude Code v2.1.289 (Oct 3) fixes a real permission bypass where sh -c 'rm -rf X' bypassed Claude Code's deny/ask checks. Six security updates — bash enforcement, symlink restrictions, MCP sign-in — critical for agentic coding users.

The patch in one sentence

On October 3, 2026, Anthropic released Claude Code v2.1.289 — a critical security update addressing six vulnerabilities in its agentic coding tool, including a concrete permission bypass where the sh -c "rm -rf X" or bash -c 'rm -rf X' form bypassed Claude Code's built-in permission checks in versions v2.1.280 through v2.1.287, allowing destructive file operations without the user's explicit approval.

This is not a theoretical vulnerability. The bypass was confirmed by the mr.technology changelog and Anthropic's own GitHub releases. Any organization running Claude Code versions within that range should treat the update as mandatory.

The dangerous-rm permission bypass — the core fix

The most serious vulnerability in v2.1.280-287 was a permission bypass in the rm (remove) command path. Claude Code's security model relies on a deny/ask mechanism: destructive commands are either blocked (deny) or presented to the user for confirmation (ask). The bypass worked like this:

In the affected versions, Claude Code's permission checker matched commands against a pattern that did not cover the shell-form invocation of rm:

• Direct: rm -rf /path → caught by the deny/ask rule → blocked or confirmed.
• Shell-form: sh -c "rm -rf /path" or bash -c 'rm -rf /path' → not caught → executed without permission check.

This means any code execution pathway that wrapped a destructive command inside a shell invocation could bypass the user's configured permission rules. For developers using Claude Code as an agent within automated build pipelines, CI/CD integrations, or multi-step coding workflows, the bypass allowed an agent to delete files, directories, or entire project structures without the user ever being notified.

The v2.1.289 fix closes this by enforcing the deny/ask rules on the effective command, not just the surface-level command string — so both direct and shell-form destructive operations are subject to the same permission gate.

The other five fixes

Anthropic's release notes (confirmed via the official GitHub releases and MyAIExp reporting) list five additional security and stability fixes:

1. Bash deny/ask rule enforcement (core security) — ensures destructive bash commands are consistently caught regardless of invocation form.

2. IDE symlink read restrictions — prevents Claude Code from following symbolic links inside integrated development environments to read files outside the workspace.

3. Managed MCP sign-in tool descriptions — updates descriptions of managed Model Context Protocol sign-in tools, reducing confusion-based misuse of authentication flows.

4. Plugin stability improvements — addresses stability issues in Claude Code's plugin architecture.

5. General security hardening — additional security improvements confirmed in the release metadata.

What developers using Claude Code must do

If running v2.1.280 through v2.1.287:

1. Update immediately. The dangerous-rm bypass is a real, confirmed vulnerability.
2. Review permission rules. Confirm deny/ask settings reflect your actual security requirements.
3. Check filesystem history. Review for unexpected deletions or modifications executed within the affected version range.

If using Claude Code in automated or CI-integrated workflows:

Validate symlink paths and managed MCP authentication flows after the update — the security behavior may have changed in ways that affect your automation.

How this relates to the broader agentic coding security landscape

The Claude Code security patch is part of a larger pattern: as agentic coding tools gain more autonomous capability — multi-file edits, persistent state, external tool access — the attack surface grows faster than the security model can keep up. The dangerous-rm bypass is a failure mode that only appears at scale: individual command patterns work correctly, but combined in unexpected ways, they create vulnerabilities invisible in isolated testing.

This is the structural vulnerability that David Robinson's resignation essay (Post 82, this cycle) describes: failures emerging not from individual mistakes but from complex system interactions under commercial pressure. Anthropic's rapid v2.1.289 release — within days of confirming the bypass — is the correct response. But its existence across six minor versions shows agentic coding security is still playing catch-up.

Related AIPress coverage

• David Robinson Quits OpenAI — Post 82 — the cultural context behind industry-wide security challenges this patch addresses.
• OpenAI Dots Agents — Post 48 — agentic workflow expansion making agent security more urgent.
• California Subpoenas OpenAI — Post 83 — regulatory escalation that raises stakes for agent security failures.

Source verification: Anthropic GitHub releases (v2.1.289 changelog), MyAIExp release report (Oct 4 2026), mr.technology changelog. Technical bypass details confirmed by official release documentation for Claude Code Security.

Byline: Jacob Bloom — AIPress. Category: AI Safety & Security.