Claude Code 2.1.323: Code Mode and 20 Permission Gaps Closed

Claude Code 2.1.323 came out on 12 November 2026 at 22:12 UTC, which is 13 November at 05:12 WIB. Upgrade today if you use Bash allow rules, the sandbox, or auto mode, because this release closes 20 permission and sandbox gaps.

Claude Code is the Anthropic coding agent that runs in the terminal, VS Code, the desktop app, and the web. The agent reads code, runs commands, and changes files for you. An allow rule is a rule in settings.json that lets 1 command run without a permission prompt. The sandbox limits the files and network that a Bash command can touch.

This release also adds Code Mode as an experimental option. In this mode, Claude writes JavaScript to call its tools. The previous release, 2.1.322 on 10 November 2026, only added fast mode on Vertex AI in the global, us, and eu regions.

What does Claude Code 2.1.323 contain?

The 2.1.323 release notes contain 294 items, and 195 of them are bug fixes. We counted these items from the official release notes on GitHub on 13 November 2026.

Item type	Count	Example
Fixed	195	The allow rule `Bash(ls*)` no longer skips the permission prompt
Changed	48	An unknown model now gets a 1M context window
Added	27	Code Mode and the `engines` field in `plugin.json`
Improved	21	Bash permission checks give more consistent answers on a busy machine
Reverted, Removed, Deprecated	3	The `subagentStatusLine` setting is removed

Most items apply to the CLI in the terminal. The other items apply to VS Code, Claude Code on the web, Remote Control, Claude Tag, and Code Review.

Which permission and sandbox gaps does the release close?

We counted 20 fixes that stop a command from running without a prompt, leaving the sandbox, or writing to a denied path. Anthropic gives no CVE number for these items. The table shows the 8 items with the widest impact.

Problem before 2.1.323	Who is affected
Allow rules with an attached wildcard, for example `Bash(ls*)`, sometimes skipped the permission prompt.	Users with allow rules in the form command* without a space
Bash deny rules and ask rules missed commands run through `sudo`, `env`, and similar wrappers.	Teams that block commands with deny rules
The Bash sandbox could switch off during a session.	Users who depend on the sandbox
`sandbox.excludedCommands` let other commands run outside the sandbox.	Users with a list of excluded commands
Write and Edit could write to a path that a Read deny rule covers.	Teams that hide secret files with a Read deny rule
`--permission-mode auto` could start in a looser mode when auto mode was not available. Now the session starts in Manual mode.	Auto mode users, also through a gateway
`claude -p` and the Agent SDK ran Bash without the sandbox when the sandbox settings failed validation. Now start-up stops and names the bad setting.	Automated pipelines and bots that use `claude -p`
A check of `rm` from the wrong folder skipped the dangerous-removal prompt in bypass mode.	Users of bypass permissions mode

The release also makes some behavior stricter. The "don't ask again" choice now lasts 1 session only when a rule seems to hold a secret or goes to a git-tracked settings.local.json. The sandbox on macOS, Linux, and WSL now ignores write access through a symlink that points outside the folder.

The tool that completes an MCP server sign-in now always asks for confirmation, also in bypass and auto modes. A server approval in .mcp.json must now match the exact server name. Our MCP guide explains the basics of MCP.

A row of teal turnstiles with 1 locked amber turnstile, a symbol of the permission gaps that are now closed — Illustration: 2.1.323 closes 20 ways for a command to pass without a permission prompt or to leave the sandbox. Data: Claude Code 2.1.323 release notes, 12 November 2026.

What is Code Mode, and should you turn it on now?

Code Mode is an experimental option: Claude writes JavaScript to call tools, instead of calling each tool one at a time. The release notes say that an admin can also turn this option off for the whole organization.

This pattern is not new. Cloudflare described the same pattern under the name Code Mode on 26 September 2025. Anthropic wrote about code execution with MCP on 4 November 2025. Both posts say that a model writes code more easily than it calls many tools directly.

The release notes link to a Code Mode documentation page. When we checked it on 13 November 2026 at about 09:20 WIB, the page returned 404. For this reason, we do not describe how to turn it on. Keep Code Mode off on work machines until the official documentation is available.

Which changes can break your workflow?

Five changes in 2.1.323 can change the behavior of running sessions, mostly for users of gateways and non-Anthropic models.

Change	Who is affected	Action
An unknown model ID now gets a 1M context window instead of 200K.	Users of a gateway or another vendor's model	Set `CLAUDE_CODE_DISABLE_1M_CONTEXT=1` for models with a small window.
Organization settings requests no longer use a proxy from `ALL_PROXY`.	Office networks that set only `ALL_PROXY`	Set `HTTPS_PROXY`.
`MCP_SDK_GENERATION=v1` now runs the v2 MCP client in a compatibility mode, because the v1 client is removed.	Users who pin the v1 MCP client	Test each MCP server after the upgrade.
Worktree creation refuses checkouts whose `.git` folder is a link or holds hard links.	Users of git-new-workdir or `cp -al` copies	Use a plain clone.
The `subagentStatusLine` setting is removed, and the plugin `agent` setting is deprecated.	Plugin authors and users of a custom status line	Remove the key and read the plugin warnings.

The 1M context change has the highest risk. The release notes say that a session on another vendor's model with a smaller window can fail every turn after it is full, until you run /clear.

A large teapot pours into a small amber measuring cup that is almost full, a symbol of a small-window model that is assumed to have 1M context — Illustration: a model with a small window can fill up before Claude Code compacts the conversation, because the assumed limit is now 1M. Data: Claude Code 2.1.323 release notes.

How does the release feel in daily use?

For most users, 2.1.323 feels the same, but permission prompts appear a little more often. New prompts appear for rules that passed silently before, for example a rule that names a variable such as Bash(NODE_ENV*).

Example: a small agency runs Claude Code on a VPS through a gateway with a non-Anthropic model that has a 128K window. After the automatic update, Claude Code assumes a 1M window and does not compact the conversation in time. A long session can fail every turn until the operator sets CLAUDE_CODE_DISABLE_1M_CONTEXT=1.

We checked 3 items on our work laptop on 13 November 2026:

Claude Code updated automatically to 2.1.323, as claude --version shows.
Of the 22 allow rules in our user settings, 2 rules use an attached wildcard, and 0 rules use * in a variable value.
The claude plugin validate command now has the --strict and --profile directory options to fail on warnings.

There are few early bug reports. Issue #109420 reports a damaged screen for a background session that you view through claude attach. The reporter tested on 2.1.311 and says that this code path did not change in 2.1.323.

We covered earlier releases in our articles on Claude Code 2.1.321 and Claude Code 2.1.319.

How do you upgrade to 2.1.323 safely?

Do these 7 steps on each machine that runs Claude Code.

Check the version with claude --version. Continue if the number is lower than 2.1.323.
Run claude update, then check the version again.
Open ~/.claude/settings.json and the project settings. Find Bash allow rules with an attached * or a * in a variable value.
Replace a rule that is too wide with the full command. For example, replace Bash(PORT=* npm run dev) with a fixed port value.
If you use a gateway or another vendor's model, set CLAUDE_CODE_DISABLE_1M_CONTEXT=1 for models with a small window.
If your network uses only ALL_PROXY, add HTTPS_PROXY.
Run 1 small task in the mode that you usually use. Make sure that the permission prompts and the sandbox work as you expect.

For internal plugins, run claude plugin validate --strict before you share them with your team.

Questions and answers

Must I install Claude Code 2.1.323 now?

Yes, if you use Bash allow rules, deny rules, the sandbox, auto mode, or claude -p in a pipeline. This release closes 20 permission and sandbox gaps.

Do these 20 gaps have CVE numbers?

No. Anthropic lists these items as fixes in the 2.1.323 release notes, with no CVE number. The number 20 is our count from those release notes.

Is Code Mode safe for daily work?

We do not recommend it yet. Code Mode is still experimental, and its documentation page returned 404 when we checked it on 13 November 2026.

What happens to non-Anthropic models through a gateway?

Claude Code now assumes that an unknown model has a 1M context window. Set CLAUDE_CODE_DISABLE_1M_CONTEXT=1 to keep the 200K limit for the session.

Next steps

Upgrade all machines to 2.1.323 today, then audit your Bash allow rules and the context setting of gateway models. Keep Code Mode off until the official documentation is available.

If your team runs AI agents for business processes and needs a permission audit, see our AI Business Process Automation service.