# Claude Code 2.1.321 Turns On Mods Claude Writes Without Asking, Even Under Managed Sandbox Keys

Claude Code 2.1.321 (9 November 2026) lets mods Claude writes turn on without asking in auto and bypass modes, even where managed settings set allowUnsandboxedCommands: false or allowManagedDomainsOnly. Their own tool calls now skip your ask rules, so deny rules and organization policy are the controls left.

By Neomanex. Updated 2026-11-10.

**Verdict: if your organization relies on managed `allowUnsandboxedCommands: false` or `allowManagedDomainsOnly` to keep [Claude Code](/directory/claude-code) contained, treat 2.1.321 as a policy change: mods Claude writes now turn on without asking in auto and bypass modes. Review your deny rules before it reaches developers.** Anthropic ships this as a deliberate behaviour change, not a flaw, and we are not calling it a vulnerability. It still removes a guarantee admins may be counting on. Our directory verdict on Claude Code stays **conditional**: this release is one more reason the condition is "managed carefully".

## What happened

Anthropic's 2.1.321 changelog, dated 9 November 2026, carries two bullets that matter here. Quoted exactly:

- "Changed mods Claude writes to turn on without asking in auto and bypass modes, even with managed `allowUnsandboxedCommands: false` or `allowManagedDomainsOnly`, and not to load in `dontAsk` mode"
- "Changed mods' own tool calls (`$.tool.call`, `$.mcp.call`) to raise no permission prompt, even under your own ask rules or in `dontAsk` and `-p` runs; deny rules and organization policy still apply"

A third bullet in the same release: headless sessions now reload mods in `.claude/skills` when their files change. Setting `CLAUDE_CODE_PLUGIN_DIR_WATCH=0` turns that off.

## Why it matters

Mods arrived on 1 October 2026. Anthropic's announcement says they "run with the same access to your machine as Claude Code itself" and "aren't sandboxed". Before this release, a mod Claude wrote had to be switched on: the changelog lists the new behaviour under "Changed". From 2.1.321, in auto and bypass modes, it turns on by itself, and the managed keys that keep ordinary commands sandboxed or on approved domains do not stop it. Once loaded, the mod's own tool calls skip ask rules entirely.

What still holds, per the changelog:

| Control | Applies to mods in 2.1.321? |
|---|---|
| Deny rules | Yes |
| Organization policy | Yes |
| Your own ask rules | No, for the mod's own tool calls |
| Managed `allowUnsandboxedCommands: false` / `allowManagedDomainsOnly` | No longer stop a mod Claude writes from turning on in auto and bypass modes |
| `dontAsk` mode | Mods Claude writes do not load |

The practical reading: deny rules and organization policy are now the only fence around a mod Claude writes in auto and bypass modes. If your containment story was built on the sandbox and domain keys, it has a gap from this version on.

## What changes for you

| You are | Do this |
|---|---|
| An admin of a managed Claude Code fleet | Review deny rules and organization policy before approving 2.1.321. They are the remaining controls. |
| A developer in auto or bypass mode | Know that a mod Claude writes can now start working without a prompt. |
| Running headless or `-p` jobs | Decide whether mod reloads should be off, using `CLAUDE_CODE_PLUGIN_DIR_WATCH=0`. |

## FAQ

**Is this a security vulnerability?** We are not calling it one. Anthropic lists it under "Changed" as intended behaviour, but it narrows what managed sandbox and domain settings guarantee.

**Which modes are affected?** Auto and bypass modes turn on mods Claude writes without asking. In `dontAsk` mode those mods do not load at all.

**What still blocks a mod?** Deny rules and organization policy, according to the changelog. Ask rules do not stop a mod's own `$.tool.call` or `$.mcp.call`.

Canonical: https://neomanex.com/news/claude-code-2-1-321-mods-turn-on-without-asking-managed-sandbox-keys