Claude Code symlink TOCTOU allows arbitrary file write

Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code anthropics/claude-code

Following a symlink at write time, rather than at check time, lets an attacker redirect a write Claude Code makes to any path the process can reach. Treat it as a local write primitive and audit anything that lets an untrusted tree feed paths into a session.

diff: the pane reads every file's hunks with one git process, where it started one per file anthropics/claude-code

by poteat

The pane now starts one git process to read a change's hunks, where it started one per file; up to fifty processes after every tool call become one. The notes put the payoff where starting a process is slow, as on Windows, where one failure or timeout replaces up to fifty.

linux: one mount per destination, so bubblewrap 0.4 starts anthropics/sandbox-runtime

by ronleizrowice-ant

Different spellings of one file, a trailing slash, a symlinked directory, or a denyRead entry that is also a credential mask, each put a file mask at the same destination, and bubblewrap 0.4 takes only a regular file as a mount point. Dropping to one mount per destination is what lets 0.4.0 and 0.4.1 start at all.

security-guidance: follow the newest Opus instead of a pinned release anthropics/claude-plugins-official

by mhegazy

The security-guidance plugin reviewed with a hardcoded `claude-opus-4-7` and fell behind with each Opus release until someone bumped it by hand. It now follows the newest Opus and moves to the next one on release, so its review quality tracks the model without a config edit.

v1.12.0 anthropics/anthropic-sdk-python

by stainless-app[bot]

The Python SDK adds `claude-haiku-5-5` and typed computer and browser toolset tool calls, which replaces hand-built payloads with checked types. The Java SDK picked up the same model in its own release, so both clients move together.

descriptor: bound what reflective JSON parsing materializes anthropics/buffa

by v0ropaev

`DecodeOptions` never reaches a serde `Deserializer`, so the reflective JSON parser had no budget at all while the serialize side had `descend()`. Bounding what parsing materializes closes that gap for anyone decoding untrusted descriptor JSON.

ci: pin GitHub Actions and the conformance tools image to specific commits (#479) anthropics/buffa

by Dev Oskii

Workflow steps referenced GitHub Actions and the conformance tools image by short name, and those names can be pointed at different code later; the input counts two security vulnerabilities. They are now pinned to specific commits, which is the same argument as the Claude Code breakage above, applied to the build.

v2.1.316 anthropics/claude-code

by ashwin-ant

Alongside: Claude Code added `CLAUDE_CODE_DISABLE_ULTRATHINK` to turn the `ultrathink` keyword off, and pooled group budgets on the Claude apps gateway let a group share one monthly budget on top of each member's own limit.