Claude Code 2.1.321 Turns On Mods Claude Writes Without Asking, Even Under Managed Sandbox Keys
- What happened
- Claude Code 2.1.321 (9 November 2026) turns on mods Claude writes without asking in auto and bypass modes, even under managed sandbox and domain keys.
- Why it matters
- Mods run with Claude Code's full access, and their own tool calls now skip ask rules, so those managed keys no longer gate them in those modes.
- What to do
- Before rolling out 2.1.321, make sure your deny rules and organization policy cover what a mod could do.
Verdict: if your organization relies on managed allowUnsandboxedCommands: false or allowManagedDomainsOnly to keep Claude Code contained, treat 2.1.321 as a policy change: mods Claude writes now turn on without asking in auto and bypass modes. Review your deny rules before it reaches developers. Anthropic ships this as a deliberate behaviour change, not a flaw, and we are not calling it a vulnerability. It still removes a guarantee admins may be counting on. Our directory verdict on Claude Code stays conditional: this release is one more reason the condition is "managed carefully".
What happened
Anthropic's 2.1.321 changelog, dated 9 November 2026, carries two bullets that matter here. Quoted exactly:
- "Changed mods Claude writes to turn on without asking in auto and bypass modes, even with managed
allowUnsandboxedCommands: falseorallowManagedDomainsOnly, and not to load indontAskmode" - "Changed mods' own tool calls (
$.tool.call,$.mcp.call) to raise no permission prompt, even under your own ask rules or indontAskand-pruns; deny rules and organization policy still apply"
A third bullet in the same release: headless sessions now reload mods in .claude/skills when their files change. Setting CLAUDE_CODE_PLUGIN_DIR_WATCH=0 turns that off.
Why it matters
Mods arrived on 1 October 2026. Anthropic's announcement says they "run with the same access to your machine as Claude Code itself" and "aren't sandboxed". Before this release, a mod Claude wrote had to be switched on: the changelog lists the new behaviour under "Changed". From 2.1.321, in auto and bypass modes, it turns on by itself, and the managed keys that keep ordinary commands sandboxed or on approved domains do not stop it. Once loaded, the mod's own tool calls skip ask rules entirely.
What still holds, per the changelog:
| Control | Applies to mods in 2.1.321? |
|---|---|
| Deny rules | Yes |
| Organization policy | Yes |
| Your own ask rules | No, for the mod's own tool calls |
Managed allowUnsandboxedCommands: false / allowManagedDomainsOnly | No longer stop a mod Claude writes from turning on in auto and bypass modes |
dontAsk mode | Mods Claude writes do not load |
The practical reading: deny rules and organization policy are now the only fence around a mod Claude writes in auto and bypass modes. If your containment story was built on the sandbox and domain keys, it has a gap from this version on.
What changes for you
| You are | Do this |
|---|---|
| An admin of a managed Claude Code fleet | Review deny rules and organization policy before approving 2.1.321. They are the remaining controls. |
| A developer in auto or bypass mode | Know that a mod Claude writes can now start working without a prompt. |
Running headless or -p jobs | Decide whether mod reloads should be off, using CLAUDE_CODE_PLUGIN_DIR_WATCH=0. |
FAQ
Is this a security vulnerability? We are not calling it one. Anthropic lists it under "Changed" as intended behaviour, but it narrows what managed sandbox and domain settings guarantee.
Which modes are affected? Auto and bypass modes turn on mods Claude writes without asking. In dontAsk mode those mods do not load at all.
What still blocks a mod? Deny rules and organization policy, according to the changelog. Ask rules do not stop a mod's own $.tool.call or $.mcp.call.
What to do
- 1 Hold 2.1.321 on managed fleets until you have reviewed deny rules and organization policy, the controls Anthropic says still apply to mods.
- 2 If you depend on allowUnsandboxedCommands: false or allowManagedDomainsOnly, restrict auto and bypass modes for users, since that is where mods Claude writes now turn on without asking.
- 3 Do not count on ask rules to stop a mod's own $.tool.call or $.mcp.call: from this version they raise no prompt.
Affected tools & models
Never need to catch up again
The weekly delta: only verdict changes and act-now items. No digest filler.