Claude Code v2.1.290 Update Breakdown: Security Hardening and Stability Improvements Across the Board

Anthropic's AI coding assistant Claude Code has released version v2.1.290. The headline of this update isn't flashy new features — it's a sweeping round of fixes and refinements targeting permission security, session stability, and enterprise governance. Of more than a hundred changes, a significant portion address security risks including permission bypasses, sandbox escapes, and symlink attacks, signaling that this tool is steadily maturing toward enterprise-grade deployment.

Security Is the Central Theme

Looking at the changelog, the densest cluster of changes involves tightening permission and read/write boundaries. Several fixes target the attack vector of "swapping out a file via symlink during a read operation" — for example, image reads on macOS and Windows, @-mention references, and CLAUDE.md, rules files, and AGENTS.md restricted by blockReadsOutsideWorkingDirectories could previously be bypassed by a mid-operation symlink swap, allowing files outside the working directory to be read. All of these paths are now closed.

Bash permission checks have also been hardened in multiple places. Previously, certain commands deemed "read-only" (such as rg or git grep) could still have their arguments shell-expanded into wildcards, granting unauthorized access; discrepancies between zsh and bash in variable name parsing that caused false judgments have also been fixed. These commands will now re-trigger approval prompts. Additionally, sandboxed commands with heredocs in a pipeline (e.g., cat <<EOF | python3) no longer require approval on every run, striking a better balance between security and usability.

For enterprise users, protection for organization-level plugins (mods) and guards has been further strengthened: user-installed mods that attempt to uninstall organization plugins or cause organization guards to skip checks will now be uninstalled in turn. Read deny rules have also been extended to image paths pasted or dragged into the prompt box, as well as filenames listed in @-mentioned folders.

Symlink Attack is a security vulnerability that exploits filesystem soft links. An attacker replaces a target path with a symlink pointing to a sensitive file during the brief window between when a program opens a file and when it actually reads it — causing the program to unknowingly read content outside the working directory. This class of vulnerability is also known as a TOCTOU (Time-of-Check to Time-of-Use) race condition. In the context of AI coding assistants, if @-mention paths or configuration file paths supplied by user input aren't thoroughly validated, a malicious plugin or a specially crafted repository structure could exploit this to read sensitive system files (such as SSH private keys or environment variable files). This fix addresses the root cause by canonicalizing paths at read time and rejecting any links whose resolved destination falls outside the working directory.

Long-Session and Stability Fixes

Long-running, high-load sessions have long been a pain point for AI coding tools, and this release addresses several freeze and crash issues directly. Long sessions containing hundreds of images that previously got stuck on a "Request rejected as unprocessable by the model" error are now fixed; crashes caused by responses with thousands of levels of nested lists or blockquotes triggering "Maximum call stack size exceeded" have also been resolved.

Several "freeze" issues were also cleaned up: stalling after sending an extremely long message, freezing when expanding a transcript (ctrl+o) with large amounts of non-ASCII characters (arrows, dashes, tabs, etc.), and the rewind menu lagging hundreds of milliseconds per keypress when dealing with very large paste stacks or source files — all have been optimized. Pauses during secret scanning or permission prompts triggered by overly long token text have also been fixed.

Session recovery logic is now more reliable. Plan mode no longer loses state when restored via --continue or --resume <session-id>; restored subagents and teammates no longer lose their prior reasoning and prompt cache; scheduled tasks (looped /loop with intervals, reminders) no longer silently stop working after a conversation is compacted. Auto-compaction running during Mac sleep no longer fails silently with "Prompt is too long."

Long-session stability issues in AI coding assistants typically stem from two root causes. The first is context window pressure: as conversation turns accumulate, history messages, tool call results, and code snippets pile up, triggering auto-compaction (summarization) or exceeding the model's maximum token limit. The second is frontend rendering bottlenecks: deeply nested Markdown lists, large amounts of non-ASCII characters, and similar content can trigger recursive parsing in the terminal or UI, leading to call stack overflows (Maximum call stack size exceeded) or full re-renders on every keypress. This release addresses both dimensions: on the backend, auto-compaction can now resume normally after sleep recovery instead of simply giving up; on the frontend, freezing is resolved by limiting recursion depth and virtualizing large list rendering.

Cloud, Proxy, and Network Compatibility

This update includes a number of adaptations for complex network environments. Previously, when behind a proxy or gateway, if the peer rejected a Claude Code beta header with a non-400 status code, the request would fail — this is now fixed. On Bedrock, Vertex, Foundry, and custom gateways, responses interrupted by the computer going to sleep are no longer mistakenly identified as "stream interruptions."

Several issues with cloud sessions (Cowork, Remote Control) have been resolved: container restarts immediately after Claude sends a message or file causing a reply to never complete, container restarts losing /loop wakeups or scheduled tasks, and responses in long remote sessions arriving all at once instead of streaming. WebFetch previously silently dropped page content exceeding 100,000 characters; it now reports how much was not read and supports continuing via an offset parameter.

For users connecting through a gateway (ANTHROPIC_BASE_URL with ANTHROPIC_AUTH_TOKEN) without an Anthropic account, mods previously remained permanently disabled — this has been fixed, which is especially important for teams using self-hosted gateways.

Plugin and Developer Experience

For plugin developers, the turn.step hook result now includes a serverToolUses field, exposing API tool calls made by the advisor itself (including id, name, input, and start/end times); the tool.check event now includes agentId, allowing hooks to distinguish between permission checks from subagents versus the main session; a ceiling field has also been introduced to describe the approval level an organization requires for a given tool. The type system has been supplemented with ThemeKey and Color for editor hints about theme colors.

The CLI has also received convenience improvements: claude attach <name> and claude logs <name> now accept a partial session name instead of a full id; a new /claude-api managed-agents-onboard command is available for configuring Managed Agents mode or building from Console quickstart templates (such as deep-researcher). The login approval page for Claude apps gateways now has a Deny button, allowing pending logins to be terminated within seconds.

The new ceiling field carries significant implications for enterprise deployments. It describes the minimum approval level the organization requires for a given tool, and works together with user-side or plugin-side approval settings to form a layered permission model — with the stricter of the two taking effect. This design allows security teams to enforce mandatory human approval for high-risk tools (such as arbitrary shell command execution or production database access) through organizational policy, without modifying user configurations. Even if a user or third-party plugin sets such a tool to auto-approve, ceiling acts as a last-resort safeguard. This is a foundational capability for deploying Claude Code within enterprise zero-trust architectures.

Summary

v2.1.290 is a quintessential "polish" release — no eye-catching new features, but a systematic sweep of over a hundred fixes closing security vulnerabilities, stability bugs, and edge-case compatibility issues. For individual developers, fewer long-session freezes and permission false positives directly improve the day-to-day experience. For enterprise users, the intensive hardening of permission boundaries and organizational governance fixes are the necessary groundwork for pushing Claude Code into production. Releases like this rarely make headlines, but they are the truest measure of a tool's growing maturity.