Claude Code 2.1.319: 6 Permission Gaps Closed, Auto Mode Changes Behind Gateways, and How to Upgrade Safely

ClaudeClaude ProThe paid subscription for the Claude AI assistant from Anthropic. It unlocks connectors to outside tools.Open the glossary Code 2.1.319 was released on 6 November 2026 and closes 6 permission gaps, including a sandbox escape when it creates a worktree and a Bash permission bypass through an environment prefix. Upgrade now if your agents use permission rules, the sandbox, or auto mode. First, check 3 behavior changes so that your scheduled jobs do not stop.

Auto mode is a Claude Code permission mode that runs actions without a question, after a safety check examines each action. An LLM gateway is a server between Claude Code and the model APIAPIThe official door 2 systems use to exchange data, without anybody copying it by hand.Open the glossary, for example to record the cost for each developer. Version 2.1.319 changes how auto mode works behind a gateway.

This article covers 3 releases after our article about Claude Code 2.1.316 and the end of Opus 4.8 fast mode. We also ran 2 small tests on 2.1.319 on 7 November 2026, and we read 3 early bug reports from users.

What changed in Claude Code 2.1.317 to 2.1.319?

Three releases in 4 days closed permission gaps, changed auto mode behind gateways, and added tools for jobs that run without supervision.

Version	Release date	Main change	Effect for you
2.1.317	3 Nov 2026	Claude Code asks before a web or shell tool sends your account email address to the network. AgentAI agentAn AI program that performs work steps by itself, for example reading a message, drafting a reply, and recording the result.Open the glossary SDK hook callbacks can use onFailure: "block".	Agent commands have less chance to send out your account email.
2.1.318	4 Nov 2026	claude auth status shows loginExpiresAt. claude -p gives a warning 10 days before a claude.ai sign-in ends. Claude Code no longer installs the IDE extension from an IDE terminal.	Scheduled jobs can read when the sign-in ends.
2.1.319	6 Nov 2026	6 permission and sandbox fixes. Auto mode behind gateways has no fallback to the built-in classifier. The permissions.denyInsteadOfPrompting setting. MCPMCPA standard that lets an AI program use your tools and data under clear permissions.Open the glossary tasks run in the background.	Upgrade for agents with permission rules. Check claude -p scripts and /loop.

Source: official Anthropic release notes on GitHub for v2.1.319, v2.1.318, and v2.1.317. Dates use the GitHub release time in UTC.

The 6 permission gaps that 2.1.319 closes: who must upgrade?

You must upgrade if Claude Code runs with deny or ask rules, the sandbox, worktrees, or a self-hosted runner.

A permission gap lets a command run without a question, although your rules ask for a question or a refusal. The 2.1.319 release notes list these 6 fixes:

No	Gap before 2.1.319	Who is affected
1	A sandbox escape was possible when Claude Code created a worktree.	Sandbox users who use worktrees
2	A crafted environment prefix could hide part of a Bash command from permission checks.	All users of Bash permission rules
3	A sed command could skip the permission check in accept-edits mode and auto mode.	Users of accept-edits mode and auto mode
4	/rewind could restore or delete a file through a directory symlink.	Projects with symlinks to other folders
5	Bash deny and ask rules missed commands written with quoted words.	All users of Bash permission rules
6	--trust-workspace false on a self-hosted runner did not stop hooks in repository settings files and skills.	Teams with self-hosted runners

The release notes give no CVE number or CVSS score for these 6 fixes. On 7 November 2026, the Claude Code repository security advisory page had no advisory for these fixes. The last advisory there was published on 26 October 2026.

Without a score, we do not rate the risk with a number. Gaps 2 and 5 are still important, because Bash rules are the main fence for an agent on a laptop or a server.

Auto mode behind an LLM gateway: why are actions now asked about or refused?

Since 2.1.319, auto mode no longer uses the built-in classifier when the server-side check is not available.

This change applies when telemetry or feature flags are off, also behind an LLM gateway. Actions that the server cannot check are now asked about or refused. Amazon Bedrock, Google Vertex, and Microsoft Foundry do not change.

The release notes give 2 options:

• CLAUDE_CODE_AUTO_MODE_SERVER=1 turns on the server-side check, also when CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS is set. If managed settings set the second variable, managed settings must also set the value 1.
• CLAUDE_CODE_AUTO_MODE_SERVER=0 keeps the built-in classifier as before.

Check the status with /status. Version 2.1.319 fixes the "Auto mode server: Enabled" line, which showed even when the server-side check did not reach the session, for example because a gateway dropped it.

This change also affects scripts. Before, claude -p in auto mode exited with code 0 even when its actions were refused because no check was available. Now text and JSON output exit with code 1, so cron or CI sees that the job failed.

Other changes that can change how you work

Five small changes in 2.1.318 and 2.1.319 can make a session ask more often or stop sooner.

• Self-paced /loop now ends when 1 turn finishes without a new schedule. Before, Claude Code set a fallback wakeup. Set CLAUDE_CODE_LOOP_KEEPALIVE=1 to keep the old behavior.
• An exact ask rule for Bash or PowerShell is now refused, not asked about, when a broader deny rule covers the command.
• which with flags outside the lookup and display set now asks for permission.
• Nested skills in .claude/skills folders below the start folder load only if you start in that folder, when the Bash sandbox is on.
• The IDE extension no longer installs or updates when Claude Code starts from an IDE terminal (2.1.318). Use /ide from an outside terminal or the extensions view of your editor.

New features for agents that run without supervision

These 3 releases add settings and data that help scheduled jobs run safely with no person at the screen.

The permissions.denyInsteadOfPrompting setting refuses a tool call that would wait on a permission prompt, and the turn continues. This setting applies in terminal sessions, subagents, and teammates. Without this setting, an agent can stay idle for a long time while it waits for an answer that does not come.

{
  "permissions": {
    "denyInsteadOfPrompting": true
  }
}

MCP tasks now work in the terminal. When an MCP server runs a tool call as a task, Claude Code moves it to the background and tells Claude the result when it finishes. Set CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND if you want Claude Code to wait inside the tool call.

We tested 2 sign-in features from 2.1.318 on 7 November 2026, with Claude Code 2.1.319 on Linux and the Haiku model:

Test	Command	Result
A	claude auth status	The JSON output has a loginExpiresAt field with a date. The sign-in on the test laptop ends in 26 days.
B	claude -p "Reply with the single word OK." --output-format json	The JSON result has credential_expires_at. The answer was "OK", exit code 0.

For daily use, this field is practical. A night job can read credential_expires_at and send a warning to the team some days before the sign-in ends. Without this field, the job fails only after the sign-in has ended.

Version 2.1.317 also adds onFailure: "block" for Agent SDK hook callbacks. A callback that fails now blocks the action and does not let it run.

User reports after the release: what must you watch?

Between 6 and 7 November 2026, users opened 3 important issues for version 2.1.319, and Anthropic has not confirmed the cause.

• #107931 (6 November 2026, Windows): Edit and Write ran with no visible diff prompt, although there was an ask rule and a PreToolUse hook that answered ask. The transcript recorded a one-time approval from the user.
• #108022 (6 November 2026, Windows, PowerShell): 9 commands that matched an ask rule ran in manual mode with no visible prompt. The commands moved approximately 11 GB of files to the Recycle Bin. The transcript recorded an approval that the user did not give.
• #108077 (7 November 2026, macOS Apple Silicon): the 2.1.319 VS Code extension failed to install because the darwin-arm64 manifest could not be fetched. The reporter used "Install Another Version" to go back to the version from 3 days before.

Both Windows reports have the "has repro" label, but they are still open. The #108022 reporter noted that some approvals were recorded near the time that user messages entered the queue. We cannot confirm the cause.

Until Anthropic replies, do not trust ask rules alone for commands that delete or move files. Use deny rules for these commands, and commit your work to git before a long session.

Example scenario: a night report job through an LLM gateway

This scenario is an illustration of the effect. It is not customer data.

An online shop runs claude -p each night in auto mode to summarize orders and write a report to a shared folder. All model requests go through the team LLM gateway, and telemetry is off.

After the update to 2.1.319, the built-in classifier no longer checks the report write. The action is refused, and the job exits with code 1. The shop owner gets a failure email from cron, not the report.

The fix has 3 steps:

1. Open /status on the job machine. Check if the server-side check reaches the session.
2. If it does, set CLAUDE_CODE_AUTO_MODE_SERVER=1. If it does not, set CLAUDE_CODE_AUTO_MODE_SERVER=0.
3. Add a narrow allow rule for the report folder, so that the job does not depend on auto mode.

Safe upgrade steps for 2.1.319

Use these 6 steps so that the security fixes arrive and your running jobs do not break.

1. Check the version with claude --version.
2. Run claude update. For VS Code on an Apple Silicon Mac, wait with the extension update if the install fails.
3. Open /status and read the auto mode server line. Select a CLAUDE_CODE_AUTO_MODE_SERVER value if you use a gateway.
4. Find scripts that expect the claude -p exit code to always be 0, for example with grep -rn "claude -p" scripts.
5. Set CLAUDE_CODE_LOOP_KEEPALIVE=1 if your workflow depends on the /loop fallback wakeup.
6. On Windows, change ask rules for delete and move commands to deny rules until issues #107931 and #108022 are closed.

Your condition	Action	Deadline
Agent with Bash deny or ask rules	Upgrade to 2.1.319	Today
Sandbox with worktrees	Upgrade to 2.1.319	Today
Auto mode behind an LLM gateway	Select a CLAUDE_CODE_AUTO_MODE_SERVER value, then test 1 job	Before the next job
claude -p scripts in cron or CI	Check how the script reads the exit code	This week
Windows with ask rules for file deletes	Replace them with deny rules	Today
VS Code on an Apple Silicon Mac	Keep the old version if the install fails	Until #108077 is closed

We discussed the sandbox limits of an earlier release in our article Claude Code 2.1.309 closes sandbox gaps. Do you need help to install agents with safe permission limits? See our AI Agent Ops installation service. To train your team to use coding agents safely, see our agentic AI training.

Conclusion: actions for this week

Upgrade to Claude Code 2.1.319 today if your agents use Bash permission rules, the sandbox, or worktrees.

Before the next night job, check auto mode behind your gateway and the claude -p exit code. On Windows, move file delete commands from ask rules to deny rules until the permission bug reports are closed.

Questions and answers

Do the 6 permission fixes in 2.1.319 have CVE numbers?

The 2.1.319 release notes give no CVE number or CVSS score. On 7 November 2026, the Claude Code repository security advisory page also had no advisory for these fixes.

Does auto mode on Amazon Bedrock also change?

No. The 2.1.319 release notes say that Bedrock, Vertex, and Foundry do not change. The change applies when telemetry or feature flags are off, also behind an LLM gateway.

How do I get the old /loop behavior back?

Set the CLAUDE_CODE_LOOP_KEEPALIVE=1 variable. With this variable, self-paced /loop sets a fallback wakeup as before 2.1.319.

What is the difference between denyInsteadOfPrompting and a deny rule?

A deny rule refuses specific commands. The denyInsteadOfPrompting setting refuses all tool calls that would wait on a permission prompt, and the turn continues with no wait for a person.

How do I know when my Claude Code sign-in ends?

Run claude auth status and read the loginExpiresAt field. In our test on 2.1.319, this field was present. The claude -p JSON output also has credential_expires_at.