$ cat anthropics/week/2026-09-07.log
the week in review · Sep 7 – Sep 13, 2026
Claude Agent SDK patches argument injection
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
buffa tightens descriptor parsing and the sandbox runtime now refuses hostnames that resolve to private addresses.
Argument Injection via resume Option Allows Arbitrary Command Execution anthropics/claude-agent-sdk-python
The resume option took an argument that reached command execution without validation, which is now fixed. Any code path that passes user-influenced values into resume should be audited as soon as the patch is in.
Refuse allow-listed hostnames that resolve to loopback, link-local or configured private ranges anthropics/sandbox-runtime
allowedDomains and deniedDomains decided by name, so whoever controls a permitted name's DNS records chose the address net.connect() reached. sandbox-runtime now rejects hostnames that resolve to loopback, link-local, or configured private ranges.
text: reject unknown fields by default anthropics/buffa
Generated textproto parsers now return UnknownField for unknown field names, with nested messages, map entries, the built-in Any parser, and empty messages following the same strict behavior. Input that previously parsed leniently now fails, so regenerate and retest anything relying on the old default.
Add mods: sec-default, diff and telemetry anthropics/claude-code
sec-default, diff, and telemetry are published as source, each a complete plugin under mods/. They load only where function hooks are enabled, per the early-access note.
security-guidance: resolve repository from command and edited paths (2.0.7 → 2.0.8) anthropics/claude-plugins-official
Repository resolution now comes from git -C <dir> or cd <dir> in the hook command, the commit SHA, or edited file paths when the hook cwd is not a git repository, with PostToolUse matchers added for git. Consumers pinning 2.0.7 should move to 2.0.8.
encode: `encode_to_bytes` writes through `Vec<u8>`, not `BytesMut` anthropics/buffa
encode_to_bytes was 3 to 4 times slower than encode_to_vec on every benchmark shape, with or without LTO, and is now within noise of it. Pure performance change with no behavioural or wire impact.
descriptor: reject invalid extension range bounds anthropics/buffa
DescriptorPool rejects empty and reversed extension ranges where start >= end, keeps valid one-element ranges including MAX_FIELD_NUMBER to MAX_FIELD_NUMBER + 1, and surfaces PoolError::InvalidExtensionRange with the offending bounds. Failed pool additions stay transactional.
Add hubspot-sales plugin anthropics/claude-plugins-official
Alongside: the HubSpot plugin lands in claude-plugins-official and mirrors into knowledge-work-plugins, the ant cask is bumped to v1.31.0, the action repos sync to Claude Code 2.1.267 and Agent SDK 0.3.267, and the sandbox runtime cuts v0.0.76.
$ ls anthropics/week/ # the briefings behind this review
Keep up with Anthropic in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.