Anthropic released Claude Code 2.1.325 on November 13, 2026. Sandboxed Bash commands now use the normal permission flow by default. Scheduled tasks and /loop also ask before running skills that declare tool grants or hooks. The release reports fixes to permission enforcement, background-session credential selection and a security issue in decoding compressed responses.
Why this matters outside a coding team
For IT teams operating unattended AI workflows, the important distinction is between containment and authorization. A sandbox limits where a process can act; an approval decides whether a particular action should happen. Treating the first as a substitute for the second makes an automation easier to run, but harder to govern.
Our operational recommendation is to treat an unexpected pause after an upgrade as a review point, not immediately as a broken job. A process can be healthy while waiting for a decision.
A small rollout check
- Choose a harmless representative task. Run it in a test workspace with no production secrets and record where it asks for approval.
- Assign an owner to unattended runs. Make sure someone can see and resolve a waiting request. Do not count a started task as completed work.
- Review exceptions individually. Avoid restoring blanket permission merely to remove prompts. Document the action, scope and reason for any exception.
- Check the result, not only the exit. Confirm the expected output and account attribution before expanding the rollout.
What is not established
This is a release-note-based assessment, not our own security test. The cited notes do not establish exploitation or a CVE for the decoding issue. Updating is not proof that every workflow or permission boundary has been independently verified.