# Claude Code 2.1.323 Stops "Don't Ask Again" Saving Secrets and Closes Bash Sandbox Gaps

Claude Code 2.1.323 (12 November) is Anthropic's fix for the "don't ask again" secrets leak: an allow rule that looks like it holds a secret, or would land in a git-tracked settings.local.json, now lasts for the session only. It also fixes Bash sandbox and permission gaps and changes four defaults. Upgrading stops new leaks; it does not clean files already pushed.

By Neomanex. Updated 2026-11-13.

**Verdict: upgrade to 2.1.323 now, and do not treat it as the cleanup.** It is the first release that stops "Yes, and don't ask again" from writing secret-looking rules to disk. Our 10 November report said no fix had shipped; this is the fix. Any credential that already reached a remote repository is still exposed and still needs rotating. [Claude Code](/directory/claude-code) stays **conditional** in our directory: the fix is right, but it arrives after the leak and leaves history untouched. We found no CVE or advisory for any of these changes.

## What happened

Anthropic shipped Claude Code 2.1.323 on 12 November 2026. The changelog entry reads: Changed "don't ask again" so an allow rule that looks like it holds a secret, or would be saved to a `settings.local.json` that git tracks, "lasts for the session only and isn't saved".

A second bullet closes the way the file slipped into repositories: "Fixed `.claude/settings.local.json` not being ignored globally when the folder became a git repository later, or on a new machine". A third stops Bash prompts from "offering 'don't ask again' for commands that write to sensitive paths such as `.git` or `.claude`".

The same entry fixes several sandbox and permission gaps (quoted from 2.1.323 only):

- "Fixed a case where the Bash sandbox could switch off during a session"
- "Fixed `claude -p` and the Agent SDK running Bash unsandboxed when `--settings` or SDK settings that turn the sandbox on fail validation; Claude Code now stops at start-up and names the invalid setting"
- "Fixed a case where the Write and Edit tools could write to a path covered by a `Read` deny rule"
- "Fixed Bash deny and ask rules missing some commands run through `sudo`, `env` and similar wrappers"

Two hardening changes ship with them. Claude Code's own ripgrep and most internal git commands now run "without most of its sign-in tokens and API keys", and the tool Claude uses to finish an MCP server sign-in now "asks you to confirm, even in bypass and auto modes".

## Why it matters

The "don't ask again" button was a quiet credential sink: approve a command that carries a token, and the token was written into a local settings file that could end up committed. 2.1.323 cuts that path at both ends, by refusing to persist secret-looking rules and by keeping `settings.local.json` ignored.

The sandbox fixes matter most for headless use. Before this release, a `claude -p` or Agent SDK run whose sandbox settings failed validation ran Bash **unsandboxed** instead of stopping. If you run Claude Code in CI or behind an SDK app, that was a silent downgrade of your isolation.

What the release does not do is equally important. Nothing in 2.1.323 touches Git history, so every secret pushed before the upgrade is still in the repository.

## What changes for you

Four defaults change on upgrade:

| Change | What to check |
|---|---|
| Messages your sessions on the same machine can send each other without a prompt go "from about 20 to 100,000" | If you relied on that prompt as a brake on runaway sessions, it is effectively gone |
| A Claude Desktop Code tab session can send your other sessions 100,000 messages (was 20) before it waits for you | Same brake, removed in Desktop |
| The context window assumed for a model ID Claude Code does not recognize goes "from 200K to 1M" | Sessions on other vendors' models with a smaller window "can fail every turn until `/clear`"; set `CLAUDE_CODE_DISABLE_1M_CONTEXT=1` before they fill |
| `MCP_SDK_GENERATION=v1` now runs the v2 MCP client "in a compatibility mode", because the v1 client is removed | Test MCP servers you pinned to v1 |

For files already committed: search every repository for `.claude/settings.local.json` and `.claude/settings.json`, untrack them with `git rm --cached`, add them to the repository's `.gitignore`, and rotate every credential they ever held.

## FAQ

**Does upgrading remove secrets I already committed?**
No. 2.1.323 only stops new rules from being saved. Untrack the files and rotate the credentials yourself.

**Will my CI runs break after the upgrade?**
They can. A `claude -p` or Agent SDK run with invalid sandbox settings now stops at start-up and names the bad setting instead of running unsandboxed. Fix the setting rather than removing it.

**Is there a CVE for the leak?**
We found no CVE or security advisory tied to these changes; the changelog is the only official record.

Canonical: https://neomanex.com/news/claude-code-2-1-323-dont-ask-again-stops-saving-secrets-sandbox-fixes