Update: upgrade Claude Code now — several permission bypasses fixed
The 2.1.289–2.1.296 fixes close sandbox escapes, hook fail-opens and silent rm -rf — recheck your auto-mode rules. Plus Google's on-device EmbeddingGemma 2.
Copy markdown
Auto mode and hooks were skipping your read prompts
Across 2.1.289–2.1.296, Claude Code closed a cluster of permission-bypass bugs: files reached through a symlink or a UNC network path could slip past Read deny rules and the auto-mode/PreToolUse approval, and some checks weren't re-applied after a hook rewrote a tool's input. If you run with auto-accept or managed deny rules, upgrade to 2.1.296+ and recheck your settings.
The sandbox had several escape hatches
Under sandbox auto-allow, Bash commands behind an environment-variable prefix skipped deny and ask rules, and some read-only commands with wildcard args (rg, git grep) missed Read deny rules; a BASH_ARGV0 assignment trick auto-approved too. All of these now prompt as intended.
Hook guardrails could fail open — and rm -rf run silent
The prompt and agent hooks written as instructions ("block commands that…") allowed actions they should have stopped, and a truncated nested tool input let a guard pass content it never saw. Separately, a dangerous rm -rf inside bash -c, or on Windows and Git Bash home paths, ran without a prompt in bypass mode. All patched by 2.1.296.
Build this weekend: private multimodal search
Google's open-weight EmbeddingGemma 2 (Apache-2.0, 740M) maps text, code, images, audio and video into one 768-dim space and runs on-device — about 191MB of RAM for text-only, an 8K context, and MTEB-Code up ~10 points. Weights are on Hugging Face and Kaggle and work with sentence-transformers, Ollama, transformers and MLX, so you can build RAG or semantic search with nothing leaving the device.