Claude Code 2.1.323 Stops "Don't Ask Again" Saving Secrets and Closes Bash Sandbox Gaps

Verdict: upgrade to 2.1.323 now, and do not treat it as the cleanup. It is the first release that stops "Yes, and don't ask again" from writing secret-looking rules to disk. Our 10 November report said no fix had shipped; this is the fix. Any credential that already reached a remote repository is still exposed and still needs rotating. Claude Code stays conditional in our directory: the fix is right, but it arrives after the leak and leaves history untouched. We found no CVE or advisory for any of these changes.

What happened

Anthropic shipped Claude Code 2.1.323 on 12 November 2026. The changelog entry reads: Changed "don't ask again" so an allow rule that looks like it holds a secret, or would be saved to a settings.local.json that git tracks, "lasts for the session only and isn't saved".

A second bullet closes the way the file slipped into repositories: "Fixed .claude/settings.local.json not being ignored globally when the folder became a git repository later, or on a new machine". A third stops Bash prompts from "offering 'don't ask again' for commands that write to sensitive paths such as .git or .claude".

The same entry fixes several sandbox and permission gaps (quoted from 2.1.323 only):

• "Fixed a case where the Bash sandbox could switch off during a session"
• "Fixed claude -p and the Agent SDK running Bash unsandboxed when --settings or SDK settings that turn the sandbox on fail validation; Claude Code now stops at start-up and names the invalid setting"
• "Fixed a case where the Write and Edit tools could write to a path covered by a Read deny rule"
• "Fixed Bash deny and ask rules missing some commands run through sudo, env and similar wrappers"

Two hardening changes ship with them. Claude Code's own ripgrep and most internal git commands now run "without most of its sign-in tokens and API keys", and the tool Claude uses to finish an MCP server sign-in now "asks you to confirm, even in bypass and auto modes".

Why it matters

The "don't ask again" button was a quiet credential sink: approve a command that carries a token, and the token was written into a local settings file that could end up committed. 2.1.323 cuts that path at both ends, by refusing to persist secret-looking rules and by keeping settings.local.json ignored.

The sandbox fixes matter most for headless use. Before this release, a claude -p or Agent SDK run whose sandbox settings failed validation ran Bash unsandboxed instead of stopping. If you run Claude Code in CI or behind an SDK app, that was a silent downgrade of your isolation.

What the release does not do is equally important. Nothing in 2.1.323 touches Git history, so every secret pushed before the upgrade is still in the repository.

What changes for you

Four defaults change on upgrade:

For files already committed: search every repository for .claude/settings.local.json and .claude/settings.json, untrack them with git rm --cached, add them to the repository's .gitignore, and rotate every credential they ever held.

FAQ

Does upgrading remove secrets I already committed? No. 2.1.323 only stops new rules from being saved. Untrack the files and rotate the credentials yourself.

Will my CI runs break after the upgrade? They can. A claude -p or Agent SDK run with invalid sandbox settings now stops at start-up and names the bad setting instead of running unsandboxed. Fix the setting rather than removing it.

Is there a CVE for the leak? We found no CVE or security advisory tied to these changes; the changelog is the only official record.