Claude Code patches four sandbox-escape flaws

Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code anthropics/claude-code

A symlink swapped in at write time lets the agent write outside where you pointed it. If your workflow has Claude Code writing into directories other agents or users control, assume the path check alone was not sufficient before this fix.

Plugin Commit SHA Pin Bypass Allows Installation of Attacker-Controlled Code anthropics/claude-code

Pinning a plugin to a commit SHA was supposed to be the trust boundary; this bypass installs attacker-controlled code anyway. Any plugin you installed by pin this year deserves a re-check against the version that carries the fix.

Uncontrolled Search Path Enables Arbitrary Code Execution via Malicious Git Executable anthropics/claude-code

A malicious git executable earlier on your PATH gets code execution through Claude Code. That is the same class of bug as dropping a bad binary in any directory you launch from, so audit which checkouts your projects inherit.

TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace anthropics/claude-code

The edit tool could be raced into writing outside the workspace, which is the threat model the sandbox exists to answer. Both this and the symlink write were followed by tightening: v2.1.296 and later lock file writes to the working directory.

CLI v3.0.67 cline/cline

by github-actions[bot]

Oversized MCP tool output no longer dies at the context cutoff: the agent gets a preview plus a link it pages through with read_files, so the tail of a large response is recoverable instead of lost. Custom providers in providers.json and models.json now also work when you run a task.

CLI v3.0.73 cline/cline

by github-actions[bot]

GPT-6 models including gpt-6-sol and gpt-6.1-sol work on OpenAI and Azure OpenAI-compatible endpoints; every request had been rejected because Cline sent max_tokens instead of max_completion_tokens. The CLI's JavaScript runtime requirement for plugins is also gone, with failed plugin loads now printing a named warning.

v1.19.0 anomalyco/opencode

by opencode-agent[bot]

The TUI stops installing updates on its own: /update now handles installs, and upgrade --major moves you to OpenCode 2. That is the migration path operators need to plan, since OpenCode 2 is where the session storage and plugin work lands.

Release v0.65.0 google-gemini/gemini-cli

by gemini-cli-robot

gemini-cli enforces read-only workspace settings in untrusted folders and stops duplicate tool response turns when resuming sessions. If you resume long sessions in repos you did not author, that first fix changes what the agent is allowed to touch.