Claude Code 2.1.280 and 2.1.281 fix four cases where permission checks let an action through

Anthropic shipped Claude Code 2.1.280 on September 22, 2026 and 2.1.281 on September 23, 2026. Most of the two long release notes are interface and resume fixes. Four entries, though, describe the permission system approving, or reading, something it should have stopped first.

The four permission fixes

The release notes describe each case in a single line. Taken together, they cover writes, deletions, rules, and file reads.

• Writes through a symlinked path were judged by their spelling inside the project. acceptEdits, allow rules, and auto mode could approve a write that actually landed outside it. Since 2.1.280, the prompt names the real destination and those approvals no longer apply.
• A recursive rm whose target is only the output of a command substitution, such as rm -rf "$(pwd)", ran without asking in auto mode and with --dangerously-skip-permissions. Since 2.1.281 it asks even when a Bash allow rule exists, unless CLAUDE_CODE_DISABLE_SUBSTITUTION_RM_PROMPT=1 is set.
• A permission rule containing a NUL byte was expanded into a wildcard that matched everything. Since 2.1.281 such a rule matches nothing.
• Permission dialogs and attachment checks read paths under the macOS directories /.vol, /.nofollow, and /.resolve before approval, and those paths can reach a network mount. 2.1.281 stops the early read.

Auto mode stops looping

Version 2.1.280 also changes how auto mode behaves when its safety check does not deliver a verdict. An action the check declines to review is now denied once, with a note that retrying will not help. When the check gives no answer at all, retries back off, and the turn stops with a message after 10 in a row.

The change you will notice first

Since 2.1.280, a stray y no longer confirms a dialog, and a stray n no longer closes one. Enter accepts and Esc cancels. Anyone who prefers the old keys can restore them by binding y and n to confirm:yes and confirm:no in keybindings.json.

Two further entries matter for teams. Version 2.1.280 makes Claude Opus 5.5 the default Opus model, with a context of one million tokens. Version 2.1.281 adds "attribution": false to settings.json to hide commit and pull request attribution, and the release notes warn that older versions skip a settings file containing it.