Architecture Development Notes

Oct 17, 2026 · Information Security

Sandbox Write to --plugin-dir Escapes to Host Execution: Claude Code 2.1.299 Analysis

Claude Code 2.1.299 fixed a vulnerability where sandboxed shell commands could write to the --plugin-dir directory, which the host then reloads and executes outside the sandbox, revealing that write protection must be dynamically derived from actual session-loaded code paths rather than static directory lists, and requiring cross-boundary testing that verifies write-to-execution chains.