Claude Code 2.1.234 security upgrade: test paths, marketplace hosts, and redaction before rollout
Quick answer
Claude Code 2.1.234, released on August 17, 2026, closes several different gaps around actions that happen before or around approval. It rejects Windows NT-namespace paths across remote reads and other pre-approval file surfaces, checks the host that an SCP-style plugin marketplace source would actually contact, stops MCP diagnostics from printing resolved secrets, preserves the visible command and destination while masking credentials in permission previews, and keeps session-scoped permission answers for background subagents.
Upgrade promptly, but do not use the version number as the acceptance result. Run five payload-free canaries with synthetic markers, require a visible fail-closed result on every lane, then restore autonomous or background workflows one lane at a time. Never test a credential-leak fix with a real credential or a real remote share.
Who this is for
This guide is for developers and platform teams running Claude Code on Windows, enabling plugins from managed marketplaces, connecting MCP servers, or delegating work to background subagents. It is most useful when Claude Code can read repository instructions, install extensions, display permission previews, or continue unattended.
The release is not one monolithic sandbox fix. Each change protects a different boundary, so a passing Windows path test does not prove marketplace validation, log redaction, or subagent permission persistence. Keep the 2.1.223 permission-bypass canaries and credential-file masking checks as separate controls.
What changed
| Surface | Official 2.1.234 change | What you must prove |
|---|---|---|
| Pre-approval Windows files | Remote reads, session restore, CLAUDE.md includes, workflow scripts, and uploads reject \??\ NT-namespace paths |
A local synthetic NT-path fixture is rejected before any read or upload |
| Plugin marketplaces |
strictKnownMarketplaces no longer accepts an SCP-style Git source when its configured host differs from the host Git would contact |
The actual destination host, not a misleading source string, decides the allowlist result |
| MCP diagnostics | Scope-conflict warnings keep the configured ${VAR} form; connection errors show only the server origin |
Logs preserve debugging context without the expanded marker, path, query, or header |
| Permission previews | Credential masking can no longer hide the command, path, or destination; oversized key-shaped blocks receive full-strength redaction | The approver can see the action while the synthetic credential remains hidden |
| Background subagents | Session-scoped permission answers, including denies, are no longer dropped | A deny remains a deny for the child attempt and does not silently become approval |
The release also fixes long-session auto-mode network rechecks after compaction. Treat that as a sixth optional regression lane if your unattended sessions routinely compact.
A five-canary acceptance workflow
1. Pin one canary installation
Record every launcher that can start Claude Code: terminal, Desktop, VS Code, CI, remote-control host, and self-hosted runner. Upgrade only one disposable lane and verify claude --version reports 2.1.234 or newer. Keep the previous installer or pinned package route available.
Do not mix this upgrade with new marketplace policies, MCP endpoints, or broader permissions. A single-variable rollout makes a failed canary diagnosable.
2. Reject a local NT-namespace fixture before access
On a disposable Windows VM, create an ordinary text file under a temporary directory with a harmless value such as INDIESEEK_PATH_SENTINEL_241. Ask Claude Code to reference the same local file through a synthetic \??\ NT-namespace spelling on each relevant surface: a remote file read, session restore input, CLAUDE.md include, workflow-script reference, and upload selector.
Pass only if every NT-namespace form is rejected before the file contents appear and the normal Win32 path still works as a positive control. Do not use UNC paths, remote hosts, SMB shares, account names, or real secrets in this canary.
3. Compare configured and effective marketplace hosts
Anthropic's marketplace documentation says strictKnownMarketplaces is enforced before network or filesystem operations. Exact source matching is the default, while hostPattern is the documented option for approved internal Git hosts.
Build a disposable policy with one approved .invalid hostname and one denied .invalid hostname. Exercise the normal HTTPS/SSH spelling and an SCP-style spelling through an offline Git stub that records the destination without making a network connection. Require these results:
- Every spelling that resolves to the approved host is allowed by the policy.
- Every spelling that would contact the denied host is rejected before the Git stub records a connection attempt.
- The recorded effective host matches the host the policy evaluated.
- Existing marketplaces outside the allowlist cannot install, refresh, or auto-update.
The goal is not to invent a clever URL parser test. It is to prove that policy authority follows the actual connection target.
4. Separate redaction from reviewability
Create a synthetic environment value such as INDIESEEK_MCP_SENTINEL_241, then reference it through ${INDIESEEK_MCP_SENTINEL_241} in a deliberately unreachable MCP configuration. Capture only the local diagnostic output.
The MCP lane passes when the warning shows the configured variable form and server origin, but never the expanded marker, request path, query, headers, or credentials. Search the captured file for the literal marker and require zero matches before deleting it.
For the permission-preview lane, prepare a harmless command that would write a marker file into a temporary directory and include a fake key-shaped value. Stop at the approval screen. The preview must still show the executable action, target path, and destination while fully masking the fake key. Cancel the command after inspection. If masking hides what would execute, the approval is not informed and the lane fails.
5. Prove a background deny survives
Start a fresh session with a narrow permission rule and a harmless child task that would need one additional approval, such as writing a marker outside the disposable worktree. Answer the prompt with a session-scoped deny. Then let the background subagent retry once and return its result.
Pass only if the marker is absent, the child reports the denial, the parent retains the deny for the rest of the session, and no alternate tool performs the same effect. Repeat after reopening /permissions while Claude is working. This tests state persistence, not the model's willingness to obey prose.
If your workflow uses auto mode across long contexts, run the same harmless allowed and denied network fixtures before and after compaction. The decision must remain stable; repeated prompts or a changed deny result keep that lane canary-only.
Promotion decision tree
Does every launcher report 2.1.234 or newer?
no -> keep autonomous runs paused on the older lane
yes -> do all NT-namespace fixtures fail before access?
no -> isolate Windows file surfaces
yes -> does marketplace policy follow the effective Git host?
no -> disable marketplace additions and updates
yes -> are MCP and approval previews secret-free but readable?
no -> stop log sharing and interactive approvals
yes -> does a background deny persist without side effects?
no -> keep subagents foreground-only
yes -> promote one workflow class at a time
Common mistakes
- Testing with a real API token, private key, SMB share, or production marketplace.
- Checking only
claude --versionand calling the security upgrade complete. - Treating a masked preview as safe even when it also hides the command or destination.
- Allowlisting a displayed Git string without recording the effective connection host.
- Using a prose instruction as proof that a background subagent cannot perform an action.
- Enabling auto-continue, broader permissions, and new plugins in the same rollout.
Copyable acceptance record
date / owner / host / launcher / claude_version:
previous_version / rollback_route:
nt_path_surface / synthetic_fixture / rejected_before_access / positive_control:
marketplace_policy / source_form / effective_host / connection_attempt / result:
mcp_config_form / diagnostic_origin / expanded_sentinel_matches:
permission_preview_action_visible / path_visible / destination_visible / marker_hidden:
background_task / deny_scope / retry_result / side_effect_absent:
pre_compaction_result / post_compaction_result:
decision: hold | windows-only | foreground-only | limited-rollout | promote | rollback
FAQ
Is 2.1.234 a security-only release?
No. It also adds workflow and UI features and fixes reliability issues. This guide scopes only the security-relevant and permission-state changes that need explicit acceptance evidence.
Should I use hostPattern for every marketplace?
No. Anthropic documents exact matching for specific sources and hostPattern for approving a class of hosts such as an internal Git server. Use the narrowest policy that represents your real source inventory, then test every supported URL form.
Does log redaction prove the underlying MCP connection is safe?
No. Redaction limits what diagnostics reveal. MCP authentication, endpoint trust, tool permissions, and data returned by the server remain separate controls.
What if one lane fails after the upgrade?
Disable only the affected capability where possible: keep background work in the foreground, lock marketplace additions, stop sharing diagnostics, or isolate Windows file workflows. Roll back the canary if the boundary cannot be contained, and preserve the exact synthetic fixture and version evidence for the vendor report.
Top comments (0)