Claude Code v2.1.321 closed 5 gaps in permissions and hooks: what to check in your setup

Claude Code v2.1.321, released on 9 November 2026, fixes five security-relevant gaps: MCP OAuth refresh tokens sent to another host on a redirect, a read-only Bash command running outside the sandbox, deny rules missing files written by cp or mv into a folder, a lost PreToolUse ask, and mcp_tool hooks skipped on large answers. Update first, then check the settings below.

Source: v2.1.321 release notes

1. Start with the update

Run claude --version. Anything below 2.1.321 still has these gaps. For teams, pin the minimum version in managed settings or your developer setup script, and add it to your onboarding checklist.

2. MCP OAuth tokens and redirects

Before this fix, a server that redirected an OAuth request could receive secrets, such as refresh tokens, that were meant for another host.

What to check: list your MCP servers with claude mcp list, remove the ones you no longer use, and rotate tokens for any server you do not control. Treat MCP calls as their own tool class with their own rules, separate from shell and file access.

3. Read-only Bash outside the sandbox

A command judged read-only could run outside the sandbox with no prompt. "Read-only" is a judgement made on the command text, and command text can mislead. A second check that sees the full command before it runs (a PreToolUse hook) is a cheap extra layer.

4. cp and mv into a folder

Deny rules and protected-file prompts did not apply to the file that cp x dir/ or mv x dir/ actually writes. It is the same class of gap as the quoted-path fix in v2.1.319: a rule written against one spelling of a path misses another spelling of the same write.

What to check: if you deny writes to .env, .github/workflows/ or your hook config, test cp and mv into those folders after you update, and confirm you get the deny or the prompt.

5. Two hook fixes that matter if you run more than one hook

• An ask from one PreToolUse hook could be lost when another hook's defer finished first.
• An mcp_tool hook was skipped when the answer was over 16 MiB. The call is now refused instead.

If hooks are your safety layer, decide in advance what happens when a hook cannot answer: fail closed (block) or fail open (continue). For shell commands, file writes and MCP calls, failing closed is the safer default. For file reads, failing open is usually acceptable.

6. What this release says about guardrails

Five fixes in one release, all in the layer people trust to stop risky actions. Built-in permissions keep getting better, and they are still pattern checks on command text. Teams that let agents run commands should keep:

1. current versions,
2. narrow allow rules,
3. a pre-execution policy check that sees every tool call, holds risky ones for a person, and records every decision in an audit log,
4. a sandbox for long autonomous runs.

7. Checklist

• [ ] Claude Code version is 2.1.321 or later
• [ ] claude mcp list reviewed, unused servers removed
• [ ] Tokens rotated for third-party MCP servers
• [ ] Deny rules tested with cp, mv and quoted paths
• [ ] One PreToolUse entry per tool class (shell, file writes, file reads, MCP), each with an explicit fail mode
• [ ] Hook config files protected from edits by the agent

Disclosure: I work on SecGuardRail, a pre-execution policy check for Claude Code, Cursor and Codex. It splits hooks by tool class, fails closed by default for shell, writes and MCP, holds risky actions for approval and keeps a hash-chained audit log.