Claude Code 2.1.260 fixes four ways a permission rule quietly failed to apply

A permission rule fails in two ways. It can be circumvented, which is loud and gets reported, or it can quietly never apply, which nobody notices until someone reads the changelog. Claude Code 2.1.260, published on September 3, 2026, is a release about the second kind.

Rules that were never in effect

The worst of the four is a path with parentheses in it. An Edit, Write or Read rule whose path contained them could be discarded as invalid or ignored by the Bash sandbox, and the release notes say the effect was that read-only folders stayed writable. Nothing warned about this, because from the outside the rule was in the settings file where it belonged.

The second is a pattern that cannot be compiled at all, an unclosed square bracket for example. Instead of being reported, it made every file edit fail with an invalid regular expression error. Now a deny rule written that way guards the literal path it spells out, which is at least a defined behavior.

• Bash permission checks auto-approved zsh commands that hid a command substitution inside a REPORTTIME, REPORTMEMORY or DIRSTACKSIZE assignment; these now prompt for approval.
• A rule with text after the closing parenthesis, such as Bash(ls) x, matched nothing and was silently ignored; it is now reported as an invalid setting.
• Glob and Grep probed the search path on disk before the permission check ran, so a missing path answered before permission was decided; they now behave like Read.

One rule went the other way

Not every change here tightens things. The 2.1.259 behavior that applied Read() deny rules to Bash arguments has been reverted, because it denied an ordinary build command under a rule like Read(./**/build/**) in every mode. That is the cost of matching rules against argument text rather than against actual file access, and it is a useful reminder that an over-broad rule is also a broken rule.

Commands typed at the ! bash prompt now run outside the sandbox even when strict sandbox mode is on, on the reasoning that typing there is the same as typing into your own terminal. And a managed CLAUDE.md delivered through server-managed settings no longer triggers the security approval dialog, while hooks, shell commands, sandbox settings and unsafe environment variables still do.

What to do with this

If your permission rules contain parentheses or bracket classes in paths, this release is the moment to read them again rather than assume they were doing their job. The same goes for any rule you wrote and never saw fire: until now, a rule that matched nothing looked identical to a rule that was never violated.

There is one more item worth knowing outside the permission story. Agents pinned to a Fable model were ignoring the one-million-token tag on their model setting and quietly running with a 200,000-token context window instead. A silently smaller context is the sort of bug that shows up as worse answers rather than as an error message.